{"vulnerability": "CVE-2026-46331", "sightings": [{"uuid": "d7e5655a-8bc0-485c-afb5-1762c34df5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/linuxkalii/2128", "content": "\ud83d\udea8 \u041e\u0434\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e, \u0447\u0442\u043e\u0431\u044b Claude Cowork \u0432\u044b\u0431\u0440\u0430\u043b\u0441\u044f \u0438\u0437 \u0441\u0432\u043e\u0435\u0439 Linux-VM \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c Mac\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Accomplish AI \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 SharedRoot \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0441\u0441\u0438\u0439 Claude Cowork \u043d\u0430 macOS.\n\nCowork \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0433\u0435\u043d\u0442\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 Linux-VM, \u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0434\u0435\u0442\u0430\u043b\u044c: \u0432\u0441\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 Mac \u0431\u044b\u043b\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u044c VM \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 read-write, \u0445\u043e\u0442\u044f \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0435\u0451 \u043c\u043e\u0433 \u0442\u043e\u043b\u044c\u043a\u043e guest-root.\n\n\u0414\u0430\u043b\u044c\u0448\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u0442\u0430\u043a:\n\n\u2022 \u0430\u0433\u0435\u043d\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 VM\n\u2022 \u0447\u0435\u0440\u0435\u0437 Linux-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root\n\u2022 root \u0432\u043d\u0443\u0442\u0440\u0438 VM \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u0449\u0435\u043c\u0443 mount\n\u2022 \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043f\u0430\u043f\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u043b Claude\n\n\u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f SSH-\u043a\u043b\u044e\u0447\u0438, cloud credentials \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0444\u0430\u0439\u043b\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0434\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0431\u044b\u043b\u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u043e\u043a\u043e\u043b\u043e 500 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 macOS.\n\n \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0441\u044c host filesystem \u0432\u043d\u0443\u0442\u0440\u044c VM: \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f privilege-escalation \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043d\u043e\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043f\u043e\u0445\u043e\u0436\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443.\n\nAnthropic \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0431\u0430\u0433-\u0440\u0435\u043f\u043e\u0440\u0442 \u043a\u0430\u043a *Informative*. \u0421\u0435\u0439\u0447\u0430\u0441 Cowork \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 cloud execution, \u0433\u0434\u0435 \u044d\u0442\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430, \u0441\u0443\u0434\u044f \u043f\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044e, \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442.\n\n\ud83d\udd17 https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html", "creation_timestamp": "2026-07-30T06:00:04.210320Z"}, {"uuid": "b7be86f5-884e-4afb-90eb-3218a35e0063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/linuxkalii/2128", "content": "\ud83d\udea8 \u041e\u0434\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e, \u0447\u0442\u043e\u0431\u044b Claude Cowork \u0432\u044b\u0431\u0440\u0430\u043b\u0441\u044f \u0438\u0437 \u0441\u0432\u043e\u0435\u0439 Linux-VM \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c Mac\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Accomplish AI \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 SharedRoot \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0441\u0441\u0438\u0439 Claude Cowork \u043d\u0430 macOS.\n\nCowork \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0430\u0433\u0435\u043d\u0442\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 Linux-VM, \u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0434\u0435\u0442\u0430\u043b\u044c: \u0432\u0441\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 Mac \u0431\u044b\u043b\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u044c VM \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 read-write, \u0445\u043e\u0442\u044f \u0443\u0432\u0438\u0434\u0435\u0442\u044c \u0435\u0451 \u043c\u043e\u0433 \u0442\u043e\u043b\u044c\u043a\u043e guest-root.\n\n\u0414\u0430\u043b\u044c\u0448\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0430 \u0442\u0430\u043a:\n\n\u2022 \u0430\u0433\u0435\u043d\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432\u043d\u0443\u0442\u0440\u0438 VM\n\u2022 \u0447\u0435\u0440\u0435\u0437 Linux-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root\n\u2022 root \u0432\u043d\u0443\u0442\u0440\u0438 VM \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u0449\u0435\u043c\u0443 mount\n\u2022 \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0447\u0438\u0442\u0430\u0442\u044c \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043f\u0430\u043f\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u043b Claude\n\n\u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f SSH-\u043a\u043b\u044e\u0447\u0438, cloud credentials \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0444\u0430\u0439\u043b\u044b, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0434\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0431\u044b\u043b\u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u043e\u043a\u043e\u043b\u043e 500 000 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 macOS.\n\n \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0441\u044c host filesystem \u0432\u043d\u0443\u0442\u0440\u044c VM: \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f privilege-escalation \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u0441\u043d\u043e\u0432\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u043f\u043e\u0445\u043e\u0436\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443.\n\nAnthropic \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0431\u0430\u0433-\u0440\u0435\u043f\u043e\u0440\u0442 \u043a\u0430\u043a *Informative*. \u0421\u0435\u0439\u0447\u0430\u0441 Cowork \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 cloud execution, \u0433\u0434\u0435 \u044d\u0442\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430, \u0441\u0443\u0434\u044f \u043f\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044e, \u043d\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442.\n\n\ud83d\udd17 https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html", "creation_timestamp": "2026-07-31T00:00:39.567714Z"}, {"uuid": "0606c4c1-c918-43d1-a75e-a3cdbdde0951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-30T01:00:04.066918Z"}, {"uuid": "7b2803cb-be21-4897-86ba-f07f5d68c540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/CyberDispatch/2144", "content": "A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.", "creation_timestamp": "2026-08-30T00:00:28.138997Z"}, {"uuid": "cac6de18-8b5c-496e-ae9a-bc1c87f4aae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msuky4koup2b", "content": "\ud83d\udccc Vulnerability Disclosed Allowing Escape from Claude Cowork\u2019s Local VM Sandbox via CVE-2026-46331 https://www.cyberhub.blog/article/29655-vulnerability-disclosed-allowing-escape-from-claude-coworks-local-vm-sandbox-via-cve-2026-46331", "creation_timestamp": "2026-08-12T07:07:06.762347Z"}, {"uuid": "ac3e34b4-436f-4ff3-9108-255e3fd8ae76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260806", "content": "", "creation_timestamp": "2026-08-06T04:45:44.922092Z"}, {"uuid": "4ffbf1f1-4a10-4ff3-abf5-c07bd5a19a0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mp72c3a6uv2w", "content": "CVE-2026-46331 enables unprivileged users to gain root by corrupting shared page-cache memory via tc pedit, then executing a poisoned setuid binary in memory.\n", "creation_timestamp": "2026-06-26T13:26:58.612825Z"}, {"uuid": "230d9a4a-7615-46f7-9b0a-1f2a3c7ba44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mp72qywylh2d", "content": "CVE-2026-46331: Another Day, Another Cautionary Tale in the Linux World", "creation_timestamp": "2026-06-26T13:35:18.864766Z"}, {"uuid": "77c23372-62b1-4269-ae37-af602a1a93b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mp72w6ny4v22", "content": "CVE-2026-46331: Another Day, Another Cautionary Tale in the Linux World", "creation_timestamp": "2026-06-26T13:38:12.403788Z"}, {"uuid": "5177921d-b7b3-44cc-925f-62d8cc5bac7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mp74rg76ts2r", "content": "CVE-2026-46331: Linux 'pedit COW' Exploit Gains Root in 24 Hours", "creation_timestamp": "2026-06-26T14:11:20.506657Z"}, {"uuid": "e95cc4be-0c83-4299-94fe-a1a059c0f2c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mp76khecqj2l", "content": "Linux Kernel Root Escalation Flaw Lets Local Users Become Root Through Memory Corruption: CVE-2026-46331 Security Threat Explained +\u00a0Video\n\nA Dangerous Linux Kernel Weakness Turns Trusted Memory Into an Attack Path A newly disclosed Linux kernel vulnerability has revealed a serious security risk\u2026", "creation_timestamp": "2026-06-26T14:43:14.324817Z"}, {"uuid": "35bc1fd8-4184-4b8b-b3d8-bb9f0b5bf08e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mp76lpsvp72i", "content": "\ud83e\udd16 CVE-2026-46331 \u2014 Linux kernel OOB write in act_pedit lets local users gain root via page-cache poisoning. PoC published. Patch available.\nhttps://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-06-26T14:43:57.054794Z"}, {"uuid": "db465fe5-f8ae-493b-b24a-b696546ffa1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mp7ahfjeog2z", "content": "Linux 'pedit COW' (CVE-2026-46331): Public Root Exploit Poisons Kernel Page Cache\n\nhttps://blindthoughts.com/linux-pedit-cow-cve-2026-46331-public-root-exploit\n\n#linux #kernel #privilegeescalation #cve #patchnow", "creation_timestamp": "2026-06-26T15:17:18.934487Z"}, {"uuid": "493d4522-277f-4dc8-830a-1cb252238645", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mp7aqnelwc2y", "content": "Linux Kernel \u201cpedit COW\u201d LPE (CVE-2026-46331): One-Click Root for Any Local User \u2013 Are You\u00a0Patched?\n\nIntroduction: A newly disclosed local privilege escalation (LPE) vulnerability in the Linux kernel\u2019s network traffic control subsystem, tracked as CVE-2026-46331, allows any unprivileged local user\u2026", "creation_timestamp": "2026-06-26T15:22:30.024931Z"}, {"uuid": "d6c19e2a-4720-43db-903f-f8608f6118a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "content": "A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.\n\nCVE-2026-46331, nicknamed \"pedit COW,\" is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as", "creation_timestamp": "2026-06-26T16:00:53.051719Z"}, {"uuid": "00895953-9a43-40af-ad88-57bbb9ee6917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mp7esc6rkf2o", "content": "A new Linux kernel vulnerability, CVE-2026-46331, allows local, unprivileged users to gain full root access on affected systems. The flaw [\u2026]", "creation_timestamp": "2026-06-26T16:35:00.599615Z"}, {"uuid": "51408526-d186-4ea7-ba63-aa63738433ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mp7ihctsts23", "content": "Two new Linux LPEs hit page cache from opposite ends of the\u00a0kernel\n\nTwo new Linux kernel LPEs, CVE-2026-46331 (pedit COW) and CVE-2026-43503 (DirtyClone), corrupt page-cache memory to gain root without\u2026\n\nhttps://thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503/", "creation_timestamp": "2026-06-26T17:40:26.265187Z"}, {"uuid": "1d99bbe5-1e38-4fbb-bcbf-c233a2057e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mp7jo35v3z2p", "content": "\ud83d\udd12 Packet_edit_meme (CVE-2026-46331) page cache poisoning vulnerability\n\nA new critical page cache poisoning vulnerability, dubbed \"Packet_edit_meme\" (CVE-2026-46331), has been discl...\n\nhttps://tinyurl.com/22zuczde #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-06-26T18:02:06.562057Z"}, {"uuid": "6624edc2-65eb-4009-b7b4-1893dcc8fa06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mp7ns2xtpli2", "content": "New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries TheHackerNews CVE-2026-46331 lets local users gain root on affected Linux systems by corrupting page-cache memory throug...\n\n#Security #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-26T19:15:59.468145Z"}, {"uuid": "58154888-8db3-4f85-889f-d3ee03acc8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/ewenmcneill.bsky.social/post/3mp7xvwkxmk25", "content": "I thought that it was surprising it arrived a month after the previous Linux LPEs.  But turns out that it's a late May 2026 patch, applied upstream early June 2026 AFAICT, that's only now getting reported.\n\n(Commit link via Debian CVE-2026-46331 tracking page.)\n\ngit.kernel.org/pub/scm/linu...", "creation_timestamp": "2026-06-26T22:17:06.095120Z"}, {"uuid": "c62b3300-75e9-4981-b7de-7bb6f661b2f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/116817639137560514", "content": "Two new Linux LPEs just landed with public exploit paths.\npedit COW (CVE-2026-46331) + DirtyClone (CVE-2026-43503) both hit the same nightmare target: the page cache.\nNo disk changes.No file-integrity alert.Just corrupted in-memory binaries \u2192 root.\nIf you run CI/CD runners, Kubernetes nodes, shared Linux hosts, rootless containers, or multi-tenant servers, patch this fast.\nFull breakdown:https://thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503/\n#Linux #Cybersecurity #InfoSec #Kernel #CVE #LinuxSecurity #PrivilegeEscalation #LPE #DirtyClone #RedHat #Debian #Ubuntu #Kubernetes #DevSecOps", "creation_timestamp": "2026-06-26T23:30:18.936391Z"}, {"uuid": "5aa2deb7-3935-42b9-b5d0-d35c5fe73bf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "content": "A flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.\n\nCVE-2026-46331, nicknamed \"pedit COW,\" is an out-of-bounds write in the packet-editing action (act_pedit) that corrupts shared page-cache memory. A public, working exploit appeared within a day of the CVE assignment on June 16. Red Hat rates the flaw as", "creation_timestamp": "2026-06-27T01:00:39.113774Z"}, {"uuid": "ce27333c-3697-45c3-a248-2035ebcb3bf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mpag345cgv2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-55200: 45 interactions\nCVE-2026-47729: 38 interactions\nCVE-2026-8461: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-46331: 10 interactions\nCVE-2026-34916: 4 interactions\nCVE-2026-20245: 3 interactions\n", "creation_timestamp": "2026-06-27T02:30:28.643811Z"}, {"uuid": "628a6392-7491-4760-8ed4-e30a80c3252f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mpaod3sser2j", "content": "\ud83e\udd16 CVE-2026-46331 (CVSS 9.3): pedit COW \u2014 Linux kernel OOB write in act_pedit corrupts page-cache enabling local root escalation. Public exploit published.\n\nhttps://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-06-27T04:58:06.569323Z"}, {"uuid": "ef2554a6-2bee-47f7-875f-1ba051bcc386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mpatfwyebq2r", "content": "Linux Kernel Pedit COW Privilege Escalation Vulnerability CVE-2026-46331 Threat Intelligence Update #patchmanagement", "creation_timestamp": "2026-06-27T06:29:11.942914Z"}, {"uuid": "1f19f781-a32e-4746-91f0-5a7736e87bb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/tugate.ch/post/3mpauxvo6yi2q", "content": "Uma nova vulnerabilidade no kernel do Linux, a pedit COW (CVE-2026-46331), permite a um utilizador local sem privil\u00e9gios obter acesso root em m\u00e1quinas afetadas. O exploit p\u00fablico est\u00e1 dispon\u00edvel desde junho de 2026. \ud83d\udea8 \n\n#falha #linux #sistema ", "creation_timestamp": "2026-06-27T06:57:07.436932Z"}, {"uuid": "1fdc0e09-f9d1-4923-ad82-ecf3d050bf41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/raul.mastodon.in4matics.cat.ap.brid.gy/post/3mpavglzib2b2", "content": "Linux t\u00e9 un exploit que dona root mentre els file-integrity checks diuen \"tot b\u00e9\" \u2728\n\n**pedit COW** (CVE-2026-46331): OOB write a `act_pedit` que enverina la page cache de binaris setuid. PoC en 24h. RHEL 10 i Debian 13 afectats.\n\nMitigaci\u00f3: `echo 'install act_pedit /bin/true' > /etc/modprobe [\u2026]", "creation_timestamp": "2026-06-27T07:05:23.512994Z"}, {"uuid": "2a57ef01-6ac7-499f-b0dd-015a0fbeb6a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mpavoaa7cx2g", "content": "CVE-2026-46331 lets local users gain root on affected Linux systems by corrupting page-cache memory through act_pedit.", "creation_timestamp": "2026-06-27T07:09:36.722949Z"}, {"uuid": "3829cb14-3aa5-4493-a469-07004a8b7aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/in4matics.cat/post/3mpavz4sxaa2s", "content": "Linux t\u00e9 un exploit que dona root mentre els file-integrity checks diuen \"tot b\u00e9\" \u2728 **pedit COW** (CVE-2026-46331): OOB write a `act_pedit` que enverina la page cache de binaris setuid. PoC en 24h. RHEL 10 i Debian 13 af ...", "creation_timestamp": "2026-06-27T07:15:42.019241Z"}, {"uuid": "786a8f3e-852b-4f1e-ae0b-8a15ce972717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mpb7xhxoo22a", "content": "New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries\n\nA flaw in the Linux kernel's traffic-control subsystem can let a local unprivileged user gain root on affected systems.\n\nCVE-2026-46331, nicknamed \"pedit COW,\" is an out-of-bounds write in the packet-edi\u2026\n#hackernews #news", "creation_timestamp": "2026-06-27T10:13:44.246161Z"}, {"uuid": "bee2ebc1-eeee-4607-ae35-208a51ee8183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsyy7yfb2o", "content": "Stop Jumping to Conclusions: CVE-2026-46331 is a Ticking Time Bomb", "creation_timestamp": "2026-06-27T15:54:35.873526Z"}, {"uuid": "8f1a83c4-d32e-4f61-ac6b-a79815194c94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsyz46672l", "content": "CVE-2026-46331: A Veil of Ambiguity Hides Potential Surveillance Risks", "creation_timestamp": "2026-06-27T15:54:36.460616Z"}, {"uuid": "1fbf4dda-2603-419f-9ea3-c473adb0ae6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsyzvgbk2h", "content": "CVE-2026-46331: Another Vulnerability Announcement with More Smoke Than Fire", "creation_timestamp": "2026-06-27T15:54:37.403248Z"}, {"uuid": "fd3c3b4a-6163-4760-8531-1905dc40f887", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsz26tzs2h", "content": "The Divide Over CVE-2026-46331: Urgency vs. Caution in Cyber Vulnerability Response", "creation_timestamp": "2026-06-27T15:54:37.884243Z"}, {"uuid": "19bd690e-7683-482d-bde8-0c30f51c7e40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsz2hu4i2g", "content": "Stop Jumping to Conclusions: CVE-2026-46331 is a Ticking Time Bomb", "creation_timestamp": "2026-06-27T15:54:38.483477Z"}, {"uuid": "3113792b-82d8-4e8f-9f62-d1109eba2bbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbsz3arrz2c", "content": "CVE-2026-46331: A Veil of Ambiguity Hides Potential Surveillance Risks", "creation_timestamp": "2026-06-27T15:54:39.756633Z"}, {"uuid": "7eb9c343-045f-4c06-907b-f6034f18784d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbt5nklaw2i", "content": "CVE-2026-46331: Another Vulnerability Announcement with More Smoke Than Fire", "creation_timestamp": "2026-06-27T15:57:12.404051Z"}, {"uuid": "faadf3c4-5f9d-48ec-9c7d-47cf0eece4c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpbt5ojepa2g", "content": "The Divide Over CVE-2026-46331: Urgency vs. Caution in Cyber Vulnerability Response", "creation_timestamp": "2026-06-27T15:57:13.076717Z"}, {"uuid": "7483397f-07ad-467f-8de3-f8b48b868e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/icsda.bsky.social/post/3mpchxjbaba2b", "content": "Linux COW (CVE-2026-46331) \u70b8\u51fa\u6b0a\u9650\u63d0\u5347\u5927\u6d1e\uff0cRed Hat\u3001Ubuntu \u90fd\u4e2d\u93e2\uff0c\u99ed\u5ba2\u5982\u5165\u7121\u4eba\u4e4b\u5883\uff01\ud83d\udea8 \u9084\u6709PTC Windchill\u81f4\u547dRCE\u88ab\u6436\u5148\u958b\u63a1\uff0c\u9019\u5e74\u982d\u662f\u6bd4\u8ab0\u4fee\u5f97\u6162\u55ce\uff1f\u66f4\u5225\u63d0Klue\u9023\u300c\u99ed\u5ba2\u7684\u99ed\u5ba2\u300d\u90fd\u51fa\u73fe\u4e86... \u8cc7\u5b89\u8001\u9ce5\u8868\u793a\uff1a\u9019\u516b\u5366\u592a\u731b\uff01\ud83e\udd2f #\u8cc7\u5b89\u6f0f\u6d1e #Linux\u8cc7\u5b89 #\u4f9b\u61c9\u93c8\u98a8\u96aa", "creation_timestamp": "2026-06-27T22:09:35.006933Z"}, {"uuid": "80380793-a509-433c-917a-3cc1021c50ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mpdrc7hqzx2y", "content": "Zji\u0161t\u011bna kritick\u00e1 zranitelnost (CVE-2026-46331) v j\u00e1dru Linuxu umo\u017e\u0148uj\u00edc\u00ed neopr\u00e1vn\u011bn\u00fdm u\u017eivatel\u016fm z\u00edskat p\u0159\u00edstup s pr\u00e1vy roota.", "creation_timestamp": "2026-06-28T10:29:17.886105Z"}, {"uuid": "a89d2c91-8d7a-4989-97fb-160efa72fe12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/ercanceviz.bsky.social/post/3mpdzupswtm2z", "content": "Linux Kullananlar Dikkat: Kritik Root A\u00e7\u0131\u011f\u0131\u00a0Bulundu\n\nLinux \u00e7ekirde\u011finde ke\u015ffedilen CVE-2026-46331 (pedit COW) a\u00e7\u0131\u011f\u0131, yerel kullan\u0131c\u0131lar\u0131n root yetkisi almas\u0131na yol a\u00e7\u0131yor. \u0130\u015fte detaylar ve korunma yollar\u0131.", "creation_timestamp": "2026-06-28T13:02:48.399041Z"}, {"uuid": "118908b0-da04-4729-825a-1b0f439d20d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/bulentgerenler.bsky.social/post/3mpech7its52h", "content": "Linux \u00c7ekirde\u011finde CVE-2026-46331 pedit COW A\u00e7\u0131\u011f\u0131 Root Eri\u015fimine Yol\u00a0A\u00e7\u0131yor\n\nCVE-2026-46331 Pedit COW g\u00fcvenlik a\u00e7\u0131\u011f\u0131, Linux \u00e7ekirde\u011finde tespit edilen en dikkat \u00e7ekici yerel ayr\u0131cal\u0131k y\u00fckseltme zafiyetlerinden biri olarak \u00f6ne \u00e7\u0131kt\u0131. Linux'un a\u011f trafi\u011fi kontrol altyap\u0131s\u0131nda yer alan act_pedit\u2026", "creation_timestamp": "2026-06-28T15:36:19.450771Z"}, {"uuid": "9c66c4a3-908d-4250-bccf-d0208245e7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mpfk4rydjj2h", "content": "The Linux pedit COW vulnerability (CVE-2026-46331) hands local users silent root via page cache poisoning, leaving no trace on disk. Patch now.\n\n#Linux #peditCOW #PrivilegeEscalation #LinuxKernel #CyberSecurity", "creation_timestamp": "2026-06-29T03:26:19.500167Z"}, {"uuid": "8cd10c4a-a337-452a-b14d-a773489d8130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mpgzc2zcpt2k", "content": "\ud83d\udce2 CVE-2026-46331 ' pedit COW ' : \u00e9l\u00e9vation de privil\u00e8ges root dans le noyau Linux\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nSource : The Hacker News, publi\u00e9e le 26 juin 2026.\nhttps://cyberveille.ch/posts/2026-06-29-cve-2026-46331-pedit-cow-elevation-de-privileges-root-dans-le-noyau-linux/ #CVE_2026_46331 #Cyberveille", "creation_timestamp": "2026-06-29T17:30:21.594047Z"}, {"uuid": "e01fbbb6-c385-4b4f-9e7a-dad9458586c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mph7o7uy732y", "content": "pagecache-lpe-containment-kit: Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only \u2014 no exploit code. TLP:CLEAR.", "creation_timestamp": "2026-06-29T19:24:32.277616Z"}, {"uuid": "bd33e255-0527-4065-9088-28586194d315", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mphixagvxc2j", "content": "Linux \u30ab\u30fc\u30cd\u30eb\u306e act_pedit \u30e2\u30b8\u30e5\u30fc\u30eb\u306b\u8106\u5f31\u6027(CVE-2026-46331)-RHEL\u30fbDebian\u30fbUbuntu \u5168\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u5f71\u97ff\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "creation_timestamp": "2026-06-29T22:10:41.210316Z"}, {"uuid": "4d978f92-cb7b-4867-8df1-5217a92ba18f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1938", "content": "", "creation_timestamp": "2026-07-01T02:33:49.747318Z"}, {"uuid": "9a019b67-8b21-4a57-869a-9761f5ea2768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260630", "content": "", "creation_timestamp": "2026-07-01T02:36:08.411541Z"}, {"uuid": "b8dc47fc-d0df-4ef6-9c28-e44fbb335383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplsp3ohu32u", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0435\u0451 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438\n\n\n\nhttps://kripta.biz/posts/2F28FF98-4F2C-4845-B2F8-75FF36CCA43E", "creation_timestamp": "2026-07-01T15:15:41.031690Z"}, {"uuid": "369f9628-1dbf-444f-a253-ecb27e57e5f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities_20260702", "content": "", "creation_timestamp": "2026-07-02T07:15:24.165650Z"}, {"uuid": "366942c8-c17b-487d-8ed4-0126b04559ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mps6qo7st52n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/A1F15163-FFF4-4EF0-8ED2-A609C820F752", "creation_timestamp": "2026-07-04T04:07:18.211262Z"}, {"uuid": "3d39dc94-fa9d-4534-a28c-b19f5b70de45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mpsrdtbsac25", "content": "\uff1e Ubuntu 26.04 \u305d\u306e54 - Linux kernel \u306b\u6a29\u9650\u6607\u683c\u306e\u8106\u5f31\u6027\u30fbpedit COW\uff08CVE-2026-46331\uff09\nhttps://kledgeb.blogspot.com/2026/07/ubuntu-2604-54-linux-kernel-pedit.html\n", "creation_timestamp": "2026-07-04T09:40:07.749362Z"}, {"uuid": "d74c6c53-5793-40b0-8e9b-6b08a36df0e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpulhrgsfg2p", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0447\u0442\u043e \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442 \u0438 \u043a\u0430\u043a \u0435\u0451 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438\n\n\n\nhttps://kripta.biz/posts/04A2F6D1-714D-48D0-B694-1C3767257B43", "creation_timestamp": "2026-07-05T03:00:16.989816Z"}, {"uuid": "541fa727-f5ec-46a9-9ab8-2ffd186dbc62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mpuripcxiv2g", "content": "Critical Linux Kernel Flaw CVE-2026-46331 (Pedit COW) Allows Any Unprivileged User to Gain Root Access via Cache Poisoning +\u00a0Video\n\nIntroduction: A newly discovered Linux kernel vulnerability, tracked as CVE-2026-46331 and dubbed \u201cpedit COW,\u201d is sending shockwaves through the cybersecurity\u2026", "creation_timestamp": "2026-07-05T04:48:11.470093Z"}, {"uuid": "69746f7b-f70a-4fab-851a-90c46c2142ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T06:23:42.886907Z"}, {"uuid": "79d5f248-ac79-4a27-8e69-c84862a14a3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33802", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T16:00:04.475854Z"}, {"uuid": "5d42f987-d90b-4357-b1f3-6bb81f35fa3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33801", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T16:00:04.530570Z"}, {"uuid": "4f302cba-0e06-48c0-abb8-3177d220329a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33800", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T16:00:04.594455Z"}, {"uuid": "1518c203-aff4-46ed-9986-76b9076526b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33803", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T16:00:04.640783Z"}, {"uuid": "24e66ef8-8d3d-42da-bada-ae48f68f0b8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33802", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:22.350993Z"}, {"uuid": "0cd84b82-775b-4262-8df5-dfada1f24122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33801", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:22.397751Z"}, {"uuid": "2b8b7cb8-f0e0-41cb-a9ba-943381c78597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33800", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:22.439612Z"}, {"uuid": "35d706b8-b896-46c8-ad9c-41ad73107182", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/33803", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:22.502659Z"}, {"uuid": "6161cb5c-2e18-480e-978e-9bcc7ada8647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqckddvxe32w", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-46331 \u0432 \u044f\u0434\u0440\u0435 Linux: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0435\u0451 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0438\n\n\n\nhttps://kripta.biz/posts/78282FE7-AAF6-463F-92B8-285858D99D83", "creation_timestamp": "2026-07-10T16:17:11.116417Z"}, {"uuid": "5552ab20-a745-4c97-9244-19f53fb88776", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/cKure/16543", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.\n\nThe root shell is already open.\n\nhttps://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-07-12T13:00:04.252619Z"}, {"uuid": "ef2036dd-9eec-46d1-9326-4b4080eb4d61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqi2vil42y2p", "content": "\ud83e\udd16 CVE-2026-46331 (CVSS 7.8): Linux kernel net/sched pedit COW vuln. PoC and write-up published. RHSA-2026:27288. CISA KEV added.\nhttps://github.com/MarwahHadi/CVE-2026-46331-pedit-cow", "creation_timestamp": "2026-07-12T20:56:58.595079Z"}, {"uuid": "59b1de37-5b3c-459f-8997-7da5aefcdcb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/cKure/16543", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.\n\nThe root shell is already open.\n\nhttps://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-07-13T00:00:44.332705Z"}, {"uuid": "8602a115-a1f0-4d64-bb32-def603420227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/92770", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aexdyhaxor\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 03:13:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Proof of Concept (PoC) exploit for CVE-2026-46331\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:05.592857Z"}, {"uuid": "bc1d2c59-ebae-4b0a-ac03-a47387c9c714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/92932", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yanxinwu946\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 06:48:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:05.200001Z"}, {"uuid": "a6749f24-c690-4256-80f5-f7401d1d9ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/90851", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a pagecache-lpe-containment-kit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a douglasmun\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 14:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only \u2014 no exploit code. TLP:CLEAR.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:17.772839Z"}, {"uuid": "50c8f96f-d47e-4e91-bed0-a0ed8e3a9c73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/90984", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dirtyclone-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 12:42:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46331 \u2014 Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption \u00b7 Affected kernels: \u2264 6.12.9\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:17.431532Z"}, {"uuid": "d22077d4-3ba4-457a-9cbd-75a4725ebcc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92770", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aexdyhaxor\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 03:13:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA Proof of Concept (PoC) exploit for CVE-2026-46331\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:07.307405Z"}, {"uuid": "233d54af-c73a-488c-a180-5780adba0b63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92932", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yanxinwu946\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-11 06:48:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:07.675577Z"}, {"uuid": "3e4e5033-a090-47b9-8d00-ad9d3bee123b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/90984", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dirtyclone-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 12:42:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46331 \u2014 Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption \u00b7 Affected kernels: \u2264 6.12.9\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.919944Z"}, {"uuid": "06fe2df5-bbf6-416a-8341-c458de95f797", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/90851", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a pagecache-lpe-containment-kit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a douglasmun\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 14:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only \u2014 no exploit code. TLP:CLEAR.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:34.169972Z"}, {"uuid": "4fad020e-d170-4cae-a49c-8bc6739d84b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/bdufstecru/3252", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 tcf_pedit_act() \u043c\u043e\u0434\u0443\u043b\u044f act_pedit \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438\n\nBDU:2026-08426\nCVE-2026-46331\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/linux-cve-announce/2026061625-CVE-2026-46331-47be@gregkh/\nhttps://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-46331\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-46331", "creation_timestamp": "2026-07-14T01:00:06.159504Z"}, {"uuid": "33a7aaa0-a27e-43a8-9e39-5d7f8c0966f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/CyberDispatch/2144", "content": "A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.", "creation_timestamp": "2026-08-29T20:00:08.871570Z"}, {"uuid": "92c33c64-725b-4c1c-9761-ff6a6bfb8bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/90851", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a pagecache-lpe-containment-kit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a douglasmun\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 14:23:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only \u2014 no exploit code. TLP:CLEAR.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:23.632616Z"}, {"uuid": "8ea5f786-e342-455e-bf1a-8f0e84e48144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/90984", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a dirtyclone-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-28 12:42:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46331 \u2014 Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption \u00b7 Affected kernels: \u2264 6.12.9\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:23.892802Z"}, {"uuid": "f5ee1dc3-497d-4fc2-a69b-0e6695fbaef0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3252", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 tcf_pedit_act() \u043c\u043e\u0434\u0443\u043b\u044f act_pedit \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0430\u043c\u0438 \u0431\u0443\u0444\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438\n\nBDU:2026-08426\nCVE-2026-46331\n\n\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://lore.kernel.org/linux-cve-announce/2026061625-CVE-2026-46331-47be@gregkh/\nhttps://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2026-46331\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2026-46331", "creation_timestamp": "2026-07-15T00:00:34.249187Z"}, {"uuid": "c0213d55-4636-4003-aa50-a7a13bbff2f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/thehackernews/9341", "content": "\ud83d\uded1 A new #Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.\n\nThe root shell is already open.\n\nDetails here \u2193 https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-07-15T12:00:04.162215Z"}, {"uuid": "bc9da655-df08-4de2-96ce-a4a951915194", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9341", "content": "\ud83d\uded1 A new #Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.\n\nIt poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.\n\nThe root shell is already open.\n\nDetails here \u2193 https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html", "creation_timestamp": "2026-07-16T00:00:10.809586Z"}, {"uuid": "b069011e-50f8-4898-a06f-90f85744891c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/QcCULqR_90DoYHZQQv3lizl4V2L6hUeyHJg5WfJTRhJBtz0", "content": "", "creation_timestamp": "2026-07-16T19:00:10.539832Z"}, {"uuid": "83273e18-3ed8-4b6d-9a71-1ca45dec6796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/vkQwkXUL30u3pRsZtV-s7rMER_a3mU1vbncFib7BaHrS3aA", "content": "", "creation_timestamp": "2026-07-16T19:00:12.377505Z"}, {"uuid": "ee0e59a0-5981-450d-bdc2-800a404e11f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/6BANG7CuLCbr1ZeKg58CV0nBjAaStiqrtXZ9gbxLf9DgXYA", "content": "", "creation_timestamp": "2026-07-16T19:00:25.464003Z"}, {"uuid": "fbbcdd96-4017-457d-a0d5-f58f81ab7d5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/c-tiQItlsunczDQWBYAXRvkiYxV7bIvmHKFdwaGGudIBj1Y", "content": "", "creation_timestamp": "2026-07-16T19:00:13.882643Z"}, {"uuid": "71d86bfa-af11-408f-98ee-a8e7e13a1e16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/y91ciLPXnvm91Vv9yl5Cmxak78otn91r7jLDpDlV_S2qCm4", "content": "", "creation_timestamp": "2026-07-16T19:00:26.116463Z"}, {"uuid": "b2779bee-51a6-4084-bab6-4a5ea9377db8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-16T19:00:28.475276Z"}, {"uuid": "ba404b52-cd47-4bdb-81da-fba7de58af17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-16T19:00:26.162093Z"}, {"uuid": "1252f4ce-25be-4448-a764-bed851fb0a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-16T19:00:26.255338Z"}, {"uuid": "9de43887-bd89-4f9c-b51f-a3c612f0b770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/n2veg7scf4YfJTqlC4JDL6ww_iOVk6Rys5Z62ddnggve6dg", "content": "", "creation_timestamp": "2026-07-16T19:00:25.380314Z"}, {"uuid": "0d9ad3bf-7505-4893-ae6e-643008ed2473", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-16T19:00:26.558291Z"}, {"uuid": "5b710cb8-c46d-4835-a219-9279e746558f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/g5elOWY1KYuAGXxUHi3dhlmDI-11GBSoYpvNWH_kzvNKyXE", "content": "", "creation_timestamp": "2026-07-16T19:00:27.002861Z"}, {"uuid": "086cccb0-a39e-42fe-b43c-2ce7a85dbdd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/JkDbnMq7GUm5Q4-RPLqs1gjre-Qc5RO5_Ni4r9-mJNxKuLM", "content": "", "creation_timestamp": "2026-07-16T19:00:27.290118Z"}, {"uuid": "2603b59e-8f2c-4047-8332-78038f46cf0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/3oGlF0xDMaJ03-2OWClVk4rTasKQC3OusZ-HpNWIGdXWX9s", "content": "", "creation_timestamp": "2026-07-16T19:00:30.148839Z"}, {"uuid": "524e4564-aa8b-4d4c-930b-ab94865513ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/mvMCAGI5Y2R1CpFF1464h7Ji3Xi_v80XYAwWdNc4HU5e8R8", "content": "", "creation_timestamp": "2026-07-16T19:00:30.394497Z"}, {"uuid": "d1280877-e23a-436f-b6ab-a309421093d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/LBqrNkVY4dEwnjUy7Kq7g-cCM4l6IBHTiJls5F94h7vNHE8", "content": "", "creation_timestamp": "2026-07-16T19:00:29.826760Z"}, {"uuid": "af041a1e-7ed4-4fe2-93e5-f184442daa45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-16T19:00:30.485816Z"}, {"uuid": "c5c357c1-40ac-475e-9465-f448fa603d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/QcCULqR_90DoYHZQQv3lizl4V2L6hUeyHJg5WfJTRhJBtz0", "content": "", "creation_timestamp": "2026-07-17T00:00:07.991680Z"}, {"uuid": "3aa0781d-90d2-4ff0-9af6-697b5e81a015", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/c-tiQItlsunczDQWBYAXRvkiYxV7bIvmHKFdwaGGudIBj1Y", "content": "", "creation_timestamp": "2026-07-17T00:00:30.160399Z"}, {"uuid": "e9d9e6a4-457b-4d09-9cd8-e3311ad1aa70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/vkQwkXUL30u3pRsZtV-s7rMER_a3mU1vbncFib7BaHrS3aA", "content": "", "creation_timestamp": "2026-07-17T00:00:27.913104Z"}, {"uuid": "898beca5-7197-4108-ba76-139b48d96d57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/n2veg7scf4YfJTqlC4JDL6ww_iOVk6Rys5Z62ddnggve6dg", "content": "", "creation_timestamp": "2026-07-17T00:00:41.634712Z"}, {"uuid": "72ef6e64-863a-40ec-bb02-330e7ccc4624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/y91ciLPXnvm91Vv9yl5Cmxak78otn91r7jLDpDlV_S2qCm4", "content": "", "creation_timestamp": "2026-07-17T00:00:42.370132Z"}, {"uuid": "44e707f6-af0f-4376-ab7d-293328be633e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-17T00:00:42.546681Z"}, {"uuid": "45d91dd0-2c59-4185-bfc8-c69257fa930f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-17T00:00:42.895711Z"}, {"uuid": "5c707315-a60a-4bc8-927d-f79179e18e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/JkDbnMq7GUm5Q4-RPLqs1gjre-Qc5RO5_Ni4r9-mJNxKuLM", "content": "", "creation_timestamp": "2026-07-17T00:00:43.965855Z"}, {"uuid": "f4fab88c-bd6f-4336-85bf-77f5ed649903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-17T00:00:42.424442Z"}, {"uuid": "b3cd21a3-a267-476b-9f50-903abaca7310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/g5elOWY1KYuAGXxUHi3dhlmDI-11GBSoYpvNWH_kzvNKyXE", "content": "", "creation_timestamp": "2026-07-17T00:00:43.527531Z"}, {"uuid": "fb95f837-9f38-494e-8bd2-3087a86132bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-17T00:00:45.928994Z"}, {"uuid": "5c551a57-4c47-4b00-9cb7-c41f4fdb28e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/3oGlF0xDMaJ03-2OWClVk4rTasKQC3OusZ-HpNWIGdXWX9s", "content": "", "creation_timestamp": "2026-07-17T00:00:46.840665Z"}, {"uuid": "09d2f092-7ed5-43cd-9ae6-f876830bc3ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/mvMCAGI5Y2R1CpFF1464h7Ji3Xi_v80XYAwWdNc4HU5e8R8", "content": "", "creation_timestamp": "2026-07-17T00:00:47.089528Z"}, {"uuid": "d6d3f16f-81ff-4565-a6d5-0c1d2be27ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/LBqrNkVY4dEwnjUy7Kq7g-cCM4l6IBHTiJls5F94h7vNHE8", "content": "", "creation_timestamp": "2026-07-17T00:00:46.459859Z"}, {"uuid": "c6bfc570-47fa-44c2-93f9-db1486a96668", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-17T00:00:47.192214Z"}, {"uuid": "cd4f7a23-cc8d-41bf-aa5d-4a16907c8834", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/6BANG7CuLCbr1ZeKg58CV0nBjAaStiqrtXZ9gbxLf9DgXYA", "content": "", "creation_timestamp": "2026-07-17T01:00:23.280866Z"}, {"uuid": "ed7b896d-ab2b-4c8e-b06f-464b5acb5036", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/kQBPOJZRPfFE-rjb5OWBI31fcS08jxE2VBe_KgzBWEfjeHI", "content": "", "creation_timestamp": "2026-07-18T00:00:08.444616Z"}, {"uuid": "1eba3b86-6993-4308-ae02-e9bb581cc5cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/g5elOWY1KYuAGXxUHi3dhlmDI-11GBSoYpvNWH_kzvNKyXE", "content": "", "creation_timestamp": "2026-07-18T00:00:07.543066Z"}, {"uuid": "c128df07-994a-4689-ad8e-4feaa1a4ca09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/JkDbnMq7GUm5Q4-RPLqs1gjre-Qc5RO5_Ni4r9-mJNxKuLM", "content": "", "creation_timestamp": "2026-07-18T00:00:07.690374Z"}, {"uuid": "db40c829-4c4b-4979-84f3-6e89ff6ad1a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/y91ciLPXnvm91Vv9yl5Cmxak78otn91r7jLDpDlV_S2qCm4", "content": "", "creation_timestamp": "2026-07-18T00:00:08.949808Z"}, {"uuid": "77b31502-4ec6-4ac0-9e8a-5c2ff359ea96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-18T00:00:09.091498Z"}, {"uuid": "1a098a4b-a4c3-447f-8ff6-97975f7242f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/n2veg7scf4YfJTqlC4JDL6ww_iOVk6Rys5Z62ddnggve6dg", "content": "", "creation_timestamp": "2026-07-18T00:00:09.562167Z"}, {"uuid": "9bbd50e2-93f8-439a-95b2-f870383637b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/vkQwkXUL30u3pRsZtV-s7rMER_a3mU1vbncFib7BaHrS3aA", "content": "", "creation_timestamp": "2026-07-18T00:00:44.283606Z"}, {"uuid": "04aec667-03ae-4370-badd-05837a8a9d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/c-tiQItlsunczDQWBYAXRvkiYxV7bIvmHKFdwaGGudIBj1Y", "content": "", "creation_timestamp": "2026-07-18T00:00:42.740922Z"}, {"uuid": "14858852-4ad0-483e-885f-c27b514ddfe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-18T01:00:05.634713Z"}, {"uuid": "1748314a-bf01-47d1-9206-2a124882f770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/6BANG7CuLCbr1ZeKg58CV0nBjAaStiqrtXZ9gbxLf9DgXYA", "content": "", "creation_timestamp": "2026-07-18T01:00:06.198054Z"}, {"uuid": "cbcdfbdf-84bd-4e1b-9baf-59dc779d3d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/LBqrNkVY4dEwnjUy7Kq7g-cCM4l6IBHTiJls5F94h7vNHE8", "content": "", "creation_timestamp": "2026-07-18T02:00:05.450542Z"}, {"uuid": "80940745-1a1b-435b-9a47-5fa5ecc2a0b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-18T02:00:06.322474Z"}, {"uuid": "4667c0a8-9309-4eed-a0a0-7af4a7a81077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/mvMCAGI5Y2R1CpFF1464h7Ji3Xi_v80XYAwWdNc4HU5e8R8", "content": "", "creation_timestamp": "2026-07-18T03:00:03.183667Z"}, {"uuid": "dc2dd8bb-2541-4c53-bbc8-cdae0dd96f0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-18T03:00:03.319654Z"}, {"uuid": "e93e5db3-3358-4e00-b17f-32db28c1ca33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/3oGlF0xDMaJ03-2OWClVk4rTasKQC3OusZ-HpNWIGdXWX9s", "content": "", "creation_timestamp": "2026-07-18T03:00:03.621494Z"}, {"uuid": "ec176fc0-8422-4a41-8deb-5800f2b775d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/mvMCAGI5Y2R1CpFF1464h7Ji3Xi_v80XYAwWdNc4HU5e8R8", "content": "", "creation_timestamp": "2026-07-19T00:00:30.106686Z"}, {"uuid": "fe90f27d-65bb-4899-81d6-0d6a2fbc30e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/cp2rVOV36WL3kV8x4_ScnxuKP0fsnO5ojw1d2EB8ZtBxrfQ", "content": "", "creation_timestamp": "2026-07-19T00:00:30.234306Z"}, {"uuid": "4631515f-410e-4cb1-8f10-881f2fb90490", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/3oGlF0xDMaJ03-2OWClVk4rTasKQC3OusZ-HpNWIGdXWX9s", "content": "", "creation_timestamp": "2026-07-19T00:00:30.541302Z"}, {"uuid": "051b7ba1-24af-4f6e-88c1-96768dd8d02d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/3-f3T699faM2V8GAx3PaWwSzZJ-9InBgGoYDARGL4I5_EwQ", "content": "", "creation_timestamp": "2026-07-19T00:00:41.006594Z"}, {"uuid": "c0279c25-dad7-44cc-b5e2-fcf0cb719877", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/LBqrNkVY4dEwnjUy7Kq7g-cCM4l6IBHTiJls5F94h7vNHE8", "content": "", "creation_timestamp": "2026-07-19T01:00:12.952460Z"}, {"uuid": "efd34d29-9132-4de4-8b88-8483126622cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-26T18:00:05.967171Z"}, {"uuid": "131df95b-df6f-4637-88dd-e64252e3e370", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9594", "content": "\ud83d\udea8 Researchers say one short message let Claude Cowork escape its Linux VM and access files across the host Mac.\n\nThe SharedRoot chain used CVE-2026-46331 to gain guest root, then crossed through Cowork\u2019s read-write host mount.\n\nRead how it worked: https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html", "creation_timestamp": "2026-07-23T15:00:05.113775Z"}, {"uuid": "443e1edf-aa88-4d07-9c0c-52c2f70b42ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "exploited", "source": "https://t.me/true_secator/8547", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-27T00:00:08.485884Z"}, {"uuid": "de956dab-d44f-44f9-9da5-23c94e8d6108", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9594", "content": "\ud83d\udea8 Researchers say one short message let Claude Cowork escape its Linux VM and access files across the host Mac.\n\nThe SharedRoot chain used CVE-2026-46331 to gain guest root, then crossed through Cowork\u2019s read-write host mount.\n\nRead how it worked: https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html", "creation_timestamp": "2026-07-24T00:00:08.239245Z"}, {"uuid": "ac60fbca-f454-4c5a-bc9c-04a19f60ac2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mreqldfxkp2f", "content": "Escaping Claude Cowork\u2019s local VM sandbox via CVE-2026-46331", "creation_timestamp": "2026-07-24T06:39:32.744713Z"}, {"uuid": "ecadd532-0f29-4e4a-a96a-dd2b4fb2799b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/GithubRedTeam/94968", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cherrycherrymay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 13:02:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPedit COW \u2013 Linux Kernel Local Privilege Escalation (CVE-2026-46331)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T15:00:03.834004Z"}, {"uuid": "916f4a51-4c9c-4527-b731-db3dcbcf1c30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "Telegram/g675v-UH8DF27WnjgWKKSkETruqTm270nowLOMEt8RLgjhY", "content": "", "creation_timestamp": "2026-07-25T00:00:08.972141Z"}, {"uuid": "ed084c16-c418-479b-b26a-da73bafec906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94968", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PoC-CVE-2026-46331\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cherrycherrymay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 13:02:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPedit COW \u2013 Linux Kernel Local Privilege Escalation (CVE-2026-46331)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-25T00:00:10.213695Z"}, {"uuid": "ddbb2d68-a360-4734-81be-04553aa1ad5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17475", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T04:00:05.647196Z"}, {"uuid": "e7601e28-4d76-4777-9e79-ed98b25fd973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "Telegram/g675v-UH8DF27WnjgWKKSkETruqTm270nowLOMEt8RLgjhY", "content": "", "creation_timestamp": "2026-07-26T00:00:47.585389Z"}, {"uuid": "9b58363a-6856-42ce-b0bf-1bc5c1165ec5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/tbreakdotcom.bsky.social/post/3mrm6xdzvqw23", "content": "Researchers Say Claude Co-Work Escaped Its Sandbox \u2014 the OS Was the Weak\u00a0Link\n\nResearchers say Claude Co-Work escaped a local Linux VM sandbox via CVE-2026-46331, exposing host files and sharpening concerns about AI agent safety....", "creation_timestamp": "2026-07-27T05:45:27.516203Z"}, {"uuid": "74e21832-44d5-4639-83f7-d151907a1a24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/alextech-ai.bsky.social/post/3mrmai63tkh2n", "content": "\u26a0\ufe0f Security alert for Mac users running Claude Cowork.\n\nResearchers at Accomplish AI have uncovered 'SharedRoot,' a vulnerability allowing the AI agent to break out of its local sandbox. By exploiting Linux kernel bug CVE-2026-46331, the agent can escape its VM and access sensitive host files, in...", "creation_timestamp": "2026-07-27T06:12:44.662945Z"}, {"uuid": "ad25b1c2-2bdf-4b80-a6be-1a2ead47132f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mrmww54qya2a", "content": "Escaping Claude Cowork\u2019s local VM sandbox via CVE-2026-46331", "creation_timestamp": "2026-07-27T12:54:15.794765Z"}, {"uuid": "2d6246b6-9a63-4479-b466-b2b55668766f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrom4c6q752u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-50522: 42 interactions\nCVE-2026-64600: 14 interactions\nCVE-2026-63030: 12 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-55999: 6 interactions\nCVE-2026-56000: 6 interactions\nCVE-2026-46331: 2 interactions\n", "creation_timestamp": "2026-07-28T04:46:10.601976Z"}, {"uuid": "1d564a16-b45f-4653-ab3c-11382d57e65f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46331", "type": "seen", "source": "https://bsky.app/profile/arwel1216.bsky.social/post/3mrojlbj3rd2g", "content": "El estudio revel\u00f3 un fallo de seguridad en Claude Cowork, donde un investigador accedi\u00f3 directamente a archivos del host Mac desde dentro de una m\u00e1quina virtual (VM) del agente, aprovechando la\n\nhttps://wwwhatsnew.com/2026/07/28/claude-cowork-sandbox-escape-sharedroot-cve-2026-46331/", "creation_timestamp": "2026-07-28T04:00:52.019130Z"}, {"uuid": "70d6b64d-d642-4570-9d86-a97adf3c1c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17475", "content": "\ud83d\udea8 DirtyClone Exploit Framework (CVE-2026-46331)\nA Proof-of-Concept (PoC) exploit framework has been published for CVE-2026-46331, a Linux kernel Local Privilege Escalation (LPE) vulnerability affecting Linux Kernel 6.12.9 and earlier.\n\n\ud83d\udccc GitHub\n\ud83d\udc49https://github.com/vulnquest58/dirtyclone-exploit\n\n\u2728 Features\n\u2022 Proof-of-Concept for CVE-2026-46331\n\u2022 Exploits a race condition in the Linux Traffic Control (act_pedit) subsystem\n\u2022 Demonstrates page cache corruption without modifying files on disk\n\u2022 Targets in-memory SUID binaries for privilege escalation\n\u2022 Uses the TC pedit and IPsec TEE packet cloning path\n\u2022 Research-focused exploit framework for vulnerability analysis\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Linux\n\u2022 C\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Linux Kernel Researchers\n\u2022 Red Teams\n\u2022 Reverse Engineers\n\u2022 Detection Engineers\n\nThis repository demonstrates the CVE-2026-46331 Linux kernel vulnerability, which can lead to local privilege escalation through page cache corruption caused by the act_pedit packet editing path. It is intended for security research, vulnerability analysis, and defensive testing on affected systems.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-29T00:00:28.687230Z"}, {"uuid": "e7102b7d-06a2-4191-bf3e-93e9a336a6c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-66d81917-442e1a3db5444e7f", "content": "Exploits and vulnerabilities in Q2 2026\nThe vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux networking subsystem.\nSecond, security researchers have been publishing exploits for unpatched vulnerabilities more frequently. Publications like these can generate significant fallout, since they potentially open the door for attackers to target unprotected systems.\nStatistics on registered vulnerabilities\nThis section provides statistical data on registered vulnerabilities. The data comes from Kaspersky\u2019s vulnerability knowledge base, which draws on the CVE database as well as the Russian BDU database and GitHub Advisory (GHSA). As a result, the figures for previous reporting periods may differ from those published in earlier reports.\nWe examine the number of registered vulnerabilities for each month over the last five years. As the chart below shows, this number continues to surge, a trend reflected across all the databases we track. It\u2019s driven primarily by the widespread adoption of AI tools: as we predicted in our previous report, these tools have played a major role in the discovery of vulnerabilities in third-party software. Meanwhile, these tools often contain security issues of their own. For example, OpenClaw, a popular AI project, ranked 12th among those with the highest number of vulnerabilities discovered and published in Q2, with over 200 CVEs registered during the reporting period. Finally, AI development tools are also contributing to the vulnerability landscape, since the quality of the code they produce can vary widely. Therefore, the rate at which new vulnerabilities are discovered will inevitably keep growing.\nTotal published vulnerabilities per month from 2022 through 2026 (download)\nNext, we analyze the number of new critical vulnerabilities (CVSS > 9.0) over the same period.\nTotal critical vulnerabilities published per month from 2022 through 2026 (download)\nAs the chart shows, the number of published critical vulnerabilities jumped sharply in Q2. This is because using AI for vulnerability research makes it possible to analyze massive amounts of previously unexamined code, uncover new attack surfaces, and identify entire classes of vulnerabilities that have gone unnoticed for decades. In particular, AI was used to find a series of Dirty Frag vulnerabilities in the Linux kernel.\nExploitation statistics\nThis section presents statistics on vulnerability exploitation for Q2 2026. The data draws on open sources and our telemetry.\nWindows and Linux vulnerability exploitation\nQ2 2026 saw a new precedent in the publication of vulnerabilities in Windows components and exploits for these: researchers no longer waiting for CVE registration, let alone patches. A case in point: a researcher who goes by Nightmare Eclipse (also known as Chaotic Eclipse) published a list of new \u201cnamed\u201d vulnerabilities across various Windows subsystems. At the time the technical details were published, none of the vulnerabilities had been assigned a CVE identifier:\n\nBlueHammer: a local privilege escalation vulnerability in Windows Defender. During signature database updates, a time-of-check to time-of-use (TOCTOU) race condition occurs, allowing an attacker to substitute the directory where temporary update files are written. The researcher published a fully functional exploit for the vulnerability.\nRedSun: another logical vulnerability in Windows Defender with a working exploit. Suspicious and malicious files marked as \u201ccloud\u201d can be overwritten or restored to their original directory with elevated privileges. The exploit incorporates fragments of algorithms that make it possible to leverage various logical vulnerabilities in Windows, effectively combining a large number of popular exploitation techniques.\nYellowKey: a vulnerability that lets the user bypass BitLocker full-disk encryption and access system data through the Windows Recovery Environment (WinRE). A fully functional exploit was also published.\nGreenPlasma: a vulnerability that enables system object injection via the CTF loader for the Collaborative Translation Framework (CTFMON) service in Windows. The original publication included an exploit with limited functionality.\nRougePlanet: yet another Windows Defender vulnerability that, like BlueHammer, stems from a TOCTOU issue, this time in the engine responsible for real-time system scanning. The published exploit uses the vulnerability to overwrite the system file wermgr.exe with a malicious one.\nUnDefend: another vulnerability in the Windows Defender service. This time, the exploit causes a denial of service and blocks updates.\nEven though such cases remain isolated for now, we believe they\u2019ll grow into a full-fledged trend. Early publication of exploits gives attackers an advantage over software developers, who are left with no time to fix the issues.\nVeteran vulnerabilities in Windows software also remain relevant. These are the ones our solutions most frequently detect exploits for:\n\nCVE-2018-0802: a remote code execution (RCE) vulnerability in the Equation Editor component\nCVE-2017-11882: another RCE vulnerability also affecting Equation Editor\nCVE-2017-0199: a vulnerability in Microsoft Office and WordPad that allows an attacker to gain control over the system\nCVE-2023-38831: a vulnerability in WinRAR that involves improper handling of objects within an archive\nCVE-2025-6218 (formerly ZDI-CAN-27198): another WinRAR vulnerability allowing the specification of relative paths to extract files into arbitrary directories, potentially leading to malicious command execution\nCVE-2025-8088: a vulnerability similar in exploitation method to CVE-2025-6218. The attackers used NTFS Streams to circumvent controls on the directory into which files are being unpacked\nThe vulnerabilities listed here can be leveraged to gain initial access to a vulnerable system and for privilege escalation. This underscores the critical importance of timely software updates.\nThat said, the number of Windows users who encountered exploits declined slightly in Q2, hitting an 18-month low.\nDynamics of the number of Windows users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nLinux also hit a rough patch in Q2 2026. Specifically, the period saw the disclosure of the Dirty Frag family of vulnerabilities, which lets an attacker reliably escalate privileges within the operating system.\nAll the vulnerabilities published in Q2 2026 were, in one way or another, related to the Linux caching subsystem. Here are the ones being most actively exploited:\n\nCVE-2026-31431 (Copy Fail): a local privilege escalation vulnerability in the Linux kernel that lets an unprivileged user modify the page cache and gain root privileges. Especially dangerous for cloud and containerized environments\nCVE-2026-43284, CVE-2026-43500 (Dirty Frag): a family of vulnerabilities in the Linux networking subsystem (IPsec ESP and RxRPC) that lets a local user overwrite the page cache and escalate privileges to root\nCVE-2026-46300 (Fragnesia): a local privilege escalation vulnerability in the Linux kernel related to packet fragment handling and the page cache mechanism. It lets an unprivileged user gain root privileges and is also classified as part of the Dirty Frag family\nCVE-2026-31635 (DirtyDecrypt): a Linux kernel vulnerability that lets a local attacker escalate privileges due to improper handling of decryption operations and page cache data modification\nCVE-2026-43494 (PinTheft): a Linux kernel vulnerability that lets a local user gain elevated privileges due to errors in the memory page pinning mechanism\nCVE-2026-46331 (pedit COW): a vulnerability in the Linux kernel\u2019s traffic control subsystem (tc-pedit) that exploits a flaw in copy-on-write to modify the page cache and subsequently escalate privileges to root\nThe vulnerabilities described above were quickly embraced by attackers. At the same time, our solutions continue to detect exploitation attempts targeting older vulnerabilities as well:\n\nCVE-2022-0847: a vulnerability known as Dirty Pipe, which enables privilege escalation and the hijacking of running applications\nCVE-2019-13272: a vulnerability caused by improper handling of privilege inheritance, which can be exploited to achieve privilege escalation\nCVE-2021-22555: a heap out-of-bounds write vulnerability in the Netfilter kernel subsystem\nCVE-2023-32233: another Netfilter subsystem vulnerability that allows for Use-After-Free conditions and privilege escalation through improper processing of network requests\nDynamics of the number of Linux users encountering exploits, Q1 2025 \u2013 Q2 2026. The number of users who encountered exploits in Q1 2025 is taken as 100% (download)\nIn Q2 2026, the number of Linux users who encountered exploits declined slightly compared to Q1. Given that a significant share of new vulnerabilities are tied to the operating system\u2019s caching subsystem, we recommend installing patches as quickly as possible, or disabling vulnerable kernel modules if patching isn\u2019t an option.\nMost common published exploits\nThe distribution of published exploits by software type in Q2 2026 includes categories that haven\u2019t appeared in the sample for a long time. For instance, we\u2019re once again seeing exploits targeting SharePoint. It\u2019s worth noting that while several vulnerability write-ups for Exchange and SharePoint were published during the quarter, most turned out to be fake, AI-generated research. While the articles and exploit source code themselves look fairly polished, they describe nonexistent problems in the software or its components \u2014 often close to genuinely vulnerable mechanisms \u2014 in order to mislead researchers. This type of attack is aimed at increasing the time it takes to detect real vulnerabilities. In some cases, the description of a nonexistent vulnerability came bundled with completely unrelated malware.\nDistribution of published exploits by platform, Q1 2026 (download)\nDistribution of published exploits by platform, Q2 2026 (download)\nVulnerability exploitation in APT attacks\nWe analyzed which vulnerabilities were exploited in APT attacks during Q2 2026. The rankings provided below include data based on our telemetry, research, and open sources.\nTOP 10 vulnerabilities exploited in APT attacks, Q2 2026 (download)\nIn Q2 2026, a trend emerged in APT attacks toward exploiting new vulnerabilities right from the moment they\u2019re published. As before, we\u2019re also seeing a large number of zero-day vulnerabilities. The Langflow vulnerability deserves particular attention: it\u2019s one of the first cases of an APT group exploiting AI technology, which many organizations are only just beginning to integrate. Because most of this tech is proprietary, it has a considerable number of security blind spots. Therefore, given the growing number of AI-based automation tools, we strongly recommend going beyond the usual patching and developing secure procedures for credential use and sensitive data handling in systems that rely on agents and LLMs.\nC2 frameworks\nIn this section, we examine the most popular C2 frameworks used by APT groups and analyze the vulnerabilities targeted by the exploits that interacted with C2 agents in APT attacks.\nThe chart below shows the frequency of known C2 framework usage in attacks during Q2 2026, according to open sources.\nTOP 10 C2 frameworks used by APTs to compromise user systems, Q2 2026 (download)\nSliver, Havoc, AdaptixC2, and Metasploit remain the most widely used C2 frameworks. After studying open sources and analyzing samples of malicious C2 agents that contained exploits, we determined that the following vulnerabilities were utilized in APT attacks involving the C2 frameworks mentioned above:\n\nCVE-2026-35273: a vulnerability in Oracle PeopleSoft PeopleTools that security vendors classify as server-side request forgery (SSRF). The details of the vulnerability have never been disclosed, although some research covers the post-exploitation steps\nCVE-2023-46604: an insecure deserialization vulnerability in Apache ActiveMQ that allows arbitrary code execution in the context of the service process\nCVE-2024-12356 and CVE-2026-1731: command injection vulnerabilities in BeyondTrust software that allow an attacker to send malicious commands even without system authentication\nCVE-2023-36884: a vulnerability in the Windows Search component that allows commands to be run on the system, bypassing the mark-of-the-web (MoTW) mechanism\nCVE-2025-53770: an insecure deserialization vulnerability in Microsoft SharePoint that allows for unauthenticated command execution on the server\nCVE-2025-8088 and CVE-2025-6218: similar directory traversal vulnerabilities in WinRAR that allow files to be extracted from an archive to a predetermined path, potentially without the archiving utility displaying any alerts to the user\nThese vulnerabilities show that attackers used them for initial access and privilege escalation on vulnerable systems, setting the stage for launching a C2 agent. They include both zero-day vulnerabilities and fairly well-known security issues.\nLLM/AI tool vulnerabilities\nThis section analyzes data published in Kaspersky\u2019s vulnerability knowledge base. We reviewed the Q2 2026 version of the knowledge base.\nAs mentioned above, AI tools, plugins, and technologies have proven fairly effective at automating the search for problematic code and anomalous behavior. The high speed at which new vulnerabilities are being discovered has naturally created a need to fix them just as quickly. AI is often used for this too, which increases the volume of code being generated. However, neither code written without human involvement nor AI-generated advice is always correct.\nThe chart below covers registered vulnerabilities in AI tools for 2025\u20132026.\nNumber of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025\u20132026 (download)\nAs the charts show, AI tools are racking up a substantial number of registered vulnerabilities, and that number keeps growing quarter over quarter. It\u2019s also worth looking at how AI tool vulnerabilities break down by type, according to the CWE system:\nTOP 6 vulnerability types in products that implement or use AI/LLM logic, 2025\u20132026\nInterestingly, vulnerabilities of an undetermined type have ranked first in every quarter since the start of 2025. Traditionally-made software has the same issue, and it doesn\u2019t look like the growing number of AI tools will fix it. It\u2019s also notable that the list includes classes CWE developers themselves don\u2019t recommend using for vulnerability classification, since they lump together a whole range of more specific types. CWE-284 is an example of this.\nLooking at the most common classes, the key issues found in AI-related software can be summed up as follows:\n\nInadequate access control over critical system objects\nImproper implementation of authentication and authorization mechanisms\nInjections\nIt\u2019s worth noting that injection-related vulnerabilities were relatively rare before AI agents took off (previously, they mostly affected web apps). Recently, though, these security issues have become relevant again.\nLooking back at a year and a half of the AI boom, one conclusion stands out regarding registered vulnerabilities: AI tool developers are more focused on expanding functionality than on security. This is worth keeping in mind when using these tools. Let\u2019s look at the projects and applications that either integrated AI tools or offered them as the core product. Below is a list of the those with the highest number of registered vulnerabilities for 2025\u20132026.\nTOP AI/LLM-related projects by number of published vulnerabilities, 2025\u20132026 (download)\nNotable vulnerabilities\nThis section highlights the most significant vulnerabilities published in Q2 2026 that have publicly available descriptions. Since the above already covers several significant vulnerabilities published during the reporting period, this section consists mainly of LLM/AI tool vulnerabilities.\nCVE-2026-25253: a gatewayUrl vulnerability in OpenClaw\nThe issue stems from the fact that the OpenClaw user interface trusts the value of the gatewayUrl parameter passed in the URL and automatically establishes a WebSocket connection to the specified address. During this connection process, it sends an authentication token without any additional user confirmation.\nThe attack algorithm exploiting this vulnerability works as follows:\n\nThe application obtains a critical connection address from an external source (the gatewayUrl URL parameter), which is controlled by the attacker.\nThere is no validation before use.\nThe client automatically initiates a connection to the address specified in the parameter, which belongs to the attacker.\nWhile connected, the application sends credentials (an access token) to the specified address.\nIf the attacker obtains a valid token, the consequences depend on that token\u2019s level of access within the system. In general, this could lead to:\n\nUser session compromise\nExecution of operations on the user\u2019s behalf\nModification of the AI agent configuration\nUnauthorized access to tools and resources connected to the agent\nUnder certain OpenClaw configurations, further compromise of the host running the agent\nIt\u2019s worth noting that the risk of exploitation arises from a combination of several factors: the automatic connection and token transmission, the lack of address trust verification, and the high privileges granted to the local AI agent.\nCVE-2026-41948: a path traversal vulnerability in the Dify AI platform\nThe vulnerability lets an authenticated user craft a request that enables the application to escape its permitted tenant and gain access to internal REST APIs that weren\u2019t meant for that user. The root cause is insufficient normalization and validation of the URL path before it\u2019s passed to the internal service.\nDepending on the Dify configuration, the consequences can include:\n\nUnauthorized access to internal service interfaces\nBreach of isolation between workspaces\nExposure of internal service information\nConditions favorable to further attacks when combined with other vulnerabilities\nThe use of Dify in enterprise AI platforms is particularly risky, since internal services there tend to hold elevated privileges.\nCVE-2026-45386: an improper access control vulnerability in Open WebUI\nIn Open WebUI, pin/unpin operations on messages are write operations, since they modify that message\u2019s metadata (is_pinned, pinned_by, pinned_at). In vulnerable versions, however, before performing these actions, the API only checked for read access to the channel (a chat between a user or group and the AI) containing the message, not permission to modify its content. As a result, a user with a role limited to viewing messages could still change a message\u2019s pinned status.\nThe vulnerability\u2019s mechanism works as follows:\n\nThe user initiates an action that changes the state of an object.\nThe application treats this action as a regular read request.\nOnly channel view permission is checked.\nThe application performs a write without verifying the required user authorization.\nThis violates one of the fundamental principles of access control models \u2014 namely, that any operation that changes the state of data must be checked for the appropriate write or moderation permissions, regardless of whether the object itself is readable.\nAlthough the vulnerability doesn\u2019t lead to arbitrary code execution or compromise of sensitive data, it can affect data integrity and collaborative workflows. Potential consequences of exploitation include unauthorized pinning or unpinning of messages, disruption of channel moderators\u2019 and administrators\u2019 activities, changes to the display order of important information, and even the potential spread of false or misleading information by altering the channel containing a pinned message.\nOpen WebUI is widely used as an interface for interacting with local and enterprise LLMs. In these systems, pinned messages often contain important instructions, announcements, or tips for users. The ability to modify them with minimal privileges can disrupt collaborative workflows, cause confusion, and undermine trust in information published by administrators and moderators.\nCVE-2026-45501: a vulnerability in Microsoft Exchange\nThe vulnerability stems from improper neutralization of user input when generating Exchange web pages. As a result, the browser may interpret specially crafted data as active content instead of plain text.\nAlthough Microsoft categorizes the potential impact of exploiting this vulnerability as spoofing, flaws like this can lead to alteration of displayed content, imitation of trusted interfaces, actions on behalf of the user within an active session, and abuse of user trust.\nIt\u2019s worth noting that issues like this are still relevant in modern software, given that mechanisms like Content Security Policy and various parsers were specifically created to help developers neutralize dangerous parts of user page content.\nConclusion and advice\nQ2 brought the first significant results of AI automation adoption in software development and vulnerability hunting tools. This research shows that beyond traditional patch management, organizations now need real-time monitoring of systems and access controls, since infrastructure and everyday applications now contain far more AI functionality that could lead to compromise.\nAccordingly, besides quickly detecting infrastructure vulnerabilities and managing security patches, modern enterprise-grade security solutions need to provide a broad range of preventive measures for tracking the overall health of systems and workstations. Kaspersky Next meets these requirements by combining proactive mechanisms with the ability to respond promptly to emerging threats. \nsecurelist.com/vulnerabilities\u2026", "creation_timestamp": "2026-08-26T10:30:36.093953Z"}, {"uuid": "b924e55d-e010-4cbe-a96c-9690573d3430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://t.me/S_E_Reborn/6571", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u0437\u0430 \u0432\u0442\u043e\u0440\u043e\u0439 \u043a\u0432\u0430\u0440\u0442\u0430\u043b 2026 \u0433\u043e\u0434\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u043a\u043e\u043d\u0441\u0442\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f. \u0412\u043e-\u043f\u0435\u0440\u0432\u044b\u0445, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 CVE \u0434\u043e\u0441\u0442\u0438\u0433\u043b\u043e \u0431\u0435\u0441\u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043f\u043e \u0447\u0430\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445.\n\n\u042d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043f\u043e\u0432\u0441\u0435\u043c\u0435\u0441\u0442\u043d\u044b\u043c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u0418\u0418 \u043a\u0430\u043a \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0442\u0430\u043a \u0438 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0446\u0435\u043b\u044b\u0435 \u043a\u043b\u0430\u0441\u0441\u044b \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0412\u043e-\u0432\u0442\u043e\u0440\u044b\u0445, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u0442\u0430\u043b\u0438 \u0447\u0430\u0449\u0435 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043a \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0440\u0435\u0437\u043e\u043d\u0430\u043d\u0441, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u044e\u0442 \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u0435\u0446\u0435\u0434\u0435\u043d\u0442 \u0432 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 Windows \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043a \u043d\u0438\u043c: \u043d\u0435 \u0434\u043e\u0436\u0438\u0434\u0430\u0442\u044c\u0441\u044f, \u043f\u043e\u043a\u0430 \u0438\u0445 \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0442, \u043d\u0435 \u0433\u043e\u0432\u043e\u0440\u044f \u0443\u0436\u0435 \u043e \u043f\u0430\u0442\u0447\u0430\u0445.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Nightmare Eclipse (\u0438\u043b\u0438 Chaotic Eclipse) \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u043e\u0432\u044b\u0445 \u00ab\u0438\u043c\u0435\u043d\u043d\u044b\u0445\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows (BlueHammer, RedSun, YellowKey, GreenPlasma, RougePlanet, UnDefend).\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e \u0447\u0442\u043e \u0442\u0430\u043a\u0438\u0435 \u0441\u043b\u0443\u0447\u0430\u0438 \u043f\u043e\u043a\u0430 \u0435\u0434\u0438\u043d\u0438\u0447\u043d\u044b, \u0432 \u041b\u041a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u0438 \u043f\u0435\u0440\u0435\u0440\u0430\u0441\u0442\u0443\u0442 \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u0442\u0440\u0435\u043d\u0434. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0430\u043d\u043d\u044f\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0435\u0438\u043c\u0443\u0449\u0435\u0441\u0442\u0432\u043e \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u0443 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0422\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u00ab\u0437\u0430\u0441\u043b\u0443\u0436\u0435\u043d\u043d\u044b\u0435\u00bb \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u041f\u041e \u0434\u043b\u044f Windows, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u044e\u0442 \u0447\u0430\u0449\u0435 \u0432\u0441\u0435\u0433\u043e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u044d\u0442\u043e CVE-2018-0802 \u0438 CVE-2017-11882 \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 Equation Editor; CVE-2017-0199 \u0432 Microsoft Office \u0438 WordPad; CVE-2023-38831 \u0438 CVE-2025-6218 (ZDI-CAN-27198) \u0432 WinRAR; CVE-2025-8088 \u043f\u043e \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f CVE-2025-6218.\n\n\u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0412 Linux \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0442\u043e\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u043d\u0430\u044f \u043f\u043e\u043b\u043e\u0441\u0430. \u0422\u0430\u043a, \u0431\u044b\u043b \u0440\u0430\u0441\u043a\u0440\u044b\u0442 \u043a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Dirty Frag, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0412\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u043b\u0438\u0441\u044c \u043a \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435: CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag), CVE-2026-46300 (Fragnesia), CVE-2026-31635 (DirtyDecrypt), CVE-2026-43494 (PinTheft) \u0438 CVE-2026-46331 (pedit COW).\n\n\u0412\u0441\u0435 \u043e\u043d\u0438 \u0441\u0440\u0430\u0437\u0443 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u043c\u0438 \u0441\u0440\u0435\u0434\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u041b\u041a \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0442\u0430\u043a\u0436\u0435 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0442\u0430\u0440\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-0847 (Dirty Pipe), CVE-2019-13272, CVE-2021-22555, CVE-2023-32233.\n\n\u0412 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u043f\u043e \u0442\u0438\u043f\u0430\u043c \u041f\u041e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0434\u0430\u0432\u043d\u043e \u043d\u0435 \u043f\u043e\u043f\u0430\u0434\u0430\u043b\u0438 \u0432 \u0432\u044b\u0431\u043e\u0440\u043a\u0443. \u0422\u0430\u043a, \u043c\u044b \u0441\u043d\u043e\u0432\u0430 \u0432\u0438\u0434\u0438\u043c \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0442\u0430\u043a\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b, \u043a\u0430\u043a SharePoint.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u0432 APT-\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430\u043c\u0435\u0442\u0438\u043b\u0441\u044f \u0442\u0440\u0435\u043d\u0434 \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u0440\u0430\u0437\u0443 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0438\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c, \u043a\u0430\u043a \u0438 \u0440\u0430\u043d\u044c\u0448\u0435, \u0432 \u041b\u041a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u043c\u043d\u043e\u0433\u043e 0-day. \u0421\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Langflow - \u044d\u0442\u043e \u043e\u0434\u0438\u043d \u0438\u0437 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 APT \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0418\u0418, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c.\n\n\u0421\u0430\u043c\u044b\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c\u0438 C2-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430\u043c\u0438 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f Sliver, Havoc, Adaptix\u04212 \u0438 Metasploit.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u0442\u0430\u043b\u044c\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-08-31T00:00:48.450828Z"}, {"uuid": "c7814e74-0d2e-4eb3-9c9e-69199322268e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities_20260901", "content": "", "creation_timestamp": "2026-09-01T04:45:46.717535Z"}, {"uuid": "66c2a9bb-4cdc-42f9-90fc-f259deb081a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46331", "type": "seen", "source": "https://gist.github.com/Cvar1984/c32ea1598fdf727c699e47d7ff5c8e57", "content": "#!/usr/bin/env bash\n#\n# lpe2026-mitigate.sh \u2014 compensating controls for the 2026 kernel page-cache LPE chain\n#\n# Covers:\n#   CVE-2026-31431            \"Copy Fail\"   \u2014 algif_aead / af_alg (AF_ALG crypto API)\n#   CVE-2026-43284/CVE-2026-43500  \"Dirty Frag\"  \u2014 in-place decrypt in esp4/esp6/rxrpc\n#   CVE-2026-46331            \"pedit COW\"   \u2014 act_pedit (tc packet editor)\n#   (blacklisting esp4/esp6/rxrpc also covers CVE-2026-43503 \"DirtyClone\", which\n#    shares the same in-place-decrypt root cause)\n#\n# All of these let an unprivileged local user corrupt page-cache pages backing\n# read-only files (e.g. setuid binaries) and escalate to root. These are\n# workarounds pending the vendor kernel update for your distro \u2014 install and\n# reboot onto the patched kernel when it's available; this script only reduces\n# exposure until then.\n#\n# Sources consulted: access.redhat.com/security/vulnerabilities/RHSB-2026-002,\n# tuxcare.com/blog/dirty-frag-cve-2026-43284-cve-2026-43500-kernelcare-live-patches-released,\n# thecybersecguru.com/news/linux-lpe-pedit-cow-dirtyclone-cve-2026-46331-cve-2026-43503\n#\n# Tested distro families: RHEL / AlmaLinux / CentOS (dnf|yum + grubby),\n# Ubuntu (apt + update-grub).\n#\n# Usage:\n#   lpe2026-mitigate.sh                    # status + dry-run preview, no changes\n#   lpe2026-mitigate.sh --apply             # mitigate Copy Fail + pedit COW (low risk)\n#   lpe2026-mitigate.sh --apply --include-dirtyfrag   # also esp4/esp6/rxrpc (breaks IPsec/AFS)\n#   lpe2026-mitigate.sh --apply --disable-userns       # also lock down unprivileged userns\n#   lpe2026-mitigate.sh --apply --include-dirtyfrag --disable-userns --dry-run  # preview the full plan\n#   lpe2026-mitigate.sh --revert            # undo everything this script applied\n#   lpe2026-mitigate.sh --revert --dry-run  # preview what a revert would remove\n#\nset -euo pipefail\n\nMODPROBE_DIR=/etc/modprobe.d\nSTATE_DIR=/var/lib/lpe2026-mitigations\nLOG_FILE=/var/log/lpe2026-mitigations.log\nSYSCTL_CONF=/etc/sysctl.d/99-lpe2026-userns.conf\nBOOT_PARAM=\"initcall_blacklist=algif_aead_init\"\n\nAPPLY=0\nINCLUDE_DIRTYFRAG=0\nDISABLE_USERNS_FLAG=0\nASSUME_YES=0\nDO_REVERT=0\nDRY_RUN_FLAG=0\nDRY_RUN=0\nFAMILY=\"\"\n\n# log()/warn() skip the on-disk log during a dry run so a preview never\n# touches disk \u2014 dry() below is stdout-only for the same reason.\nlog() { local m; m=\"[$(date -Is)] $*\"; echo \"$m\"; [[ \"$DRY_RUN\" == 1 ]] || { echo \"$m\" >>\"$LOG_FILE\" 2>/dev/null || true; }; }\nwarn() { local m; m=\"[$(date -Is)] WARNING: $*\"; echo \"$m\" >&2; [[ \"$DRY_RUN\" == 1 ]] || { echo \"$m\" >>\"$LOG_FILE\" 2>/dev/null || true; }; }\ndry() { echo \"  [DRY-RUN] $*\"; }\n\nusage() {\n  cat <&2\n    exit 1\n  fi\n}\n\ndetect_family() {\n  local id id_like all\n  # shellcheck disable=SC1091\n  . /etc/os-release\n  id=\"${ID:-}\"; id_like=\"${ID_LIKE:-}\"\n  all=\" $id $id_like \"\n  if [[ \"$all\" =~ (rhel|centos|almalinux|fedora) ]]; then\n    echo rhel\n  elif [[ \"$all\" =~ (debian|ubuntu) ]]; then\n    echo debian\n  else\n    echo unknown\n  fi\n}\n\nconfirm() {\n  local prompt=\"$1\"\n  [[ \"$ASSUME_YES\" == 1 ]] && return 0\n  if [[ ! -t 0 && ! -e /dev/tty ]]; then\n    warn \"Non-interactive and --yes not given; refusing: $prompt\"\n    return 1\n  fi\n  local reply\n  read -r -p \"$prompt [y/N] \" reply /dev/null >\"$statefile\" || true\n}\n\nrestore_prior_sysctl() {\n  local key=\"$1\" statefile=\"$STATE_DIR/sysctl.$key\"\n  if [[ -f \"$statefile\" ]]; then\n    local val; val=\"$(cat \"$statefile\")\"\n    if [[ -n \"$val\" ]]; then\n      sysctl -w \"$key=$val\" >/dev/null && log \"Restored $key=$val (prior value).\"\n    fi\n    rm -f \"$statefile\"\n  fi\n}\n\nwrite_blacklist() {\n  local file=\"$1\"; shift\n  local path=\"$MODPROBE_DIR/$file\"\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would write $path, blocking future loads of: $*\"\n    return\n  fi\n  : >\"$path\"\n  local mod\n  for mod in \"$@\"; do\n    echo \"install $mod /bin/false\" >>\"$path\"\n  done\n  log \"Wrote $path blocking future loads of: $*\"\n}\n\nunload_modules() {\n  local mod\n  for mod in \"$@\"; do\n    if lsmod | grep -qw \"^$mod\"; then\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would unload module $mod (currently loaded).\"\n      elif modprobe -r \"$mod\" 2>/dev/null; then\n        log \"Unloaded module $mod.\"\n      else\n        warn \"$mod is loaded and busy \u2014 could not unload now. Blacklist stops reload, but the in-memory module stays until released or you reboot.\"\n      fi\n    else\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Module $mod not currently loaded \u2014 nothing to unload.\"\n      else\n        log \"Module $mod not currently loaded.\"\n      fi\n    fi\n  done\n}\n\ncheck_module_status() {\n  local mod=\"$1\" blacklisted=\"no\" loaded=\"no\"\n  if grep -rlqF \"install $mod /bin/false\" \"$MODPROBE_DIR\" 2>/dev/null; then\n    blacklisted=\"yes\"\n  fi\n  if lsmod | grep -qw \"^$mod\"; then\n    loaded=\"yes\"\n  fi\n  printf \"  %-14s blacklisted=%-4s currently_loaded=%s\\n\" \"$mod\" \"$blacklisted\" \"$loaded\"\n}\n\nadd_boot_param() {\n  local param=\"$1\"\n  case \"$FAMILY\" in\n    rhel)\n      if ! command -v grubby >/dev/null 2>&1; then\n        warn \"grubby not found; add '$param' to the kernel cmdline manually.\"\n        return\n      fi\n      if grubby --info=ALL 2>/dev/null | grep -q \"$param\"; then\n        log \"Boot parameter '$param' already configured.\"\n      elif [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would run: grubby --update-kernel=ALL --args=\\\"$param\\\" (reboot required to take effect).\"\n      else\n        grubby --update-kernel=ALL --args=\"$param\"\n        log \"Added boot parameter '$param' via grubby. REBOOT REQUIRED to take effect.\"\n      fi\n      ;;\n    debian)\n      local grub_file=/etc/default/grub\n      if [[ ! -f \"$grub_file\" ]]; then\n        warn \"$grub_file not found; add '$param' to the kernel cmdline manually.\"\n        return\n      fi\n      if grep -q \"$param\" \"$grub_file\"; then\n        log \"Boot parameter '$param' already present in $grub_file.\"\n        return\n      fi\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        dry \"Would back up $grub_file to ${grub_file}.bak., append '$param' to its GRUB_CMDLINE_LINUX_DEFAULT, and run update-grub (reboot required).\"\n        return\n      fi\n      cp \"$grub_file\" \"${grub_file}.bak.$(date +%s)\"\n      if sed -i -E \"s/^(GRUB_CMDLINE_LINUX_DEFAULT=\\\")([^\\\"]*)\\\"/\\1\\2 $param\\\"/\" \"$grub_file\" \\\n        && grep -q \"$param\" \"$grub_file\"; then\n        update-grub\n        log \"Added boot parameter '$param' to $grub_file and ran update-grub. REBOOT REQUIRED.\"\n      else\n        warn \"Could not auto-edit $grub_file \u2014 add '$param' to GRUB_CMDLINE_LINUX_DEFAULT manually, then run update-grub.\"\n      fi\n      ;;\n  esac\n}\n\nremove_boot_param() {\n  local param=\"$1\"\n  case \"$FAMILY\" in\n    rhel)\n      if ! command -v grubby >/dev/null 2>&1; then\n        return\n      fi\n      if [[ \"$DRY_RUN\" == 1 ]]; then\n        grubby --info=ALL 2>/dev/null | grep -q \"$param\" \\\n          && dry \"Would run: grubby --update-kernel=ALL --remove-args=\\\"$param\\\" (reboot required).\"\n      else\n        grubby --update-kernel=ALL --remove-args=\"$param\" \\\n          && log \"Removed boot parameter '$param' via grubby. REBOOT REQUIRED.\"\n      fi\n      ;;\n    debian)\n      local grub_file=/etc/default/grub\n      if [[ -f \"$grub_file\" ]] && grep -q \"$param\" \"$grub_file\"; then\n        if [[ \"$DRY_RUN\" == 1 ]]; then\n          dry \"Would back up $grub_file to ${grub_file}.bak., remove '$param' from it, and run update-grub (reboot required).\"\n        else\n          cp \"$grub_file\" \"${grub_file}.bak.$(date +%s)\"\n          sed -i -E \"s/ ?${param}//g\" \"$grub_file\"\n          update-grub\n          log \"Removed boot parameter '$param' from $grub_file. REBOOT REQUIRED.\"\n        fi\n      fi\n      ;;\n  esac\n}\n\nmitigate_copyfail() {\n  echo \"-- CVE-2026-31431 Copy Fail (algif_aead / af_alg) --\"\n  write_blacklist \"lpe2026-copyfail.conf\" algif_aead af_alg\n  unload_modules algif_aead af_alg\n  if modinfo algif_aead >/dev/null 2>&1; then\n    log \"algif_aead is a loadable module \u2014 modprobe blacklist is sufficient, effective immediately.\"\n  else\n    log \"algif_aead has no separate .ko on this kernel (likely built-in) \u2014 adding boot-param fallback.\"\n    add_boot_param \"$BOOT_PARAM\"\n  fi\n}\n\nmitigate_pedit() {\n  echo \"-- CVE-2026-46331 pedit COW (act_pedit) --\"\n  write_blacklist \"lpe2026-pedit.conf\" act_pedit\n  unload_modules act_pedit\n}\n\nmitigate_dirtyfrag() {\n  echo \"-- CVE-2026-43284 / CVE-2026-43500 / CVE-2026-43503 Dirty Frag / DirtyClone (esp4, esp6, rxrpc) --\"\n  write_blacklist \"lpe2026-dirtyfrag.conf\" esp4 esp6 rxrpc\n  unload_modules rxrpc esp6 esp4\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would flush dirty pages (sync) and drop reclaimable page cache (echo 3 > /proc/sys/vm/drop_caches) to clear any already-corrupted clean pages.\"\n    return\n  fi\n  log \"Flushing dirty pages and dropping reclaimable page cache to clear any already-corrupted clean pages.\"\n  sync\n  echo 3 >/proc/sys/vm/drop_caches 2>/dev/null || warn \"Could not write /proc/sys/vm/drop_caches.\"\n}\n\ndisable_userns() {\n  echo \"-- Disabling unprivileged user namespaces (pedit COW / DirtyClone hardening) --\"\n  local key\n  case \"$FAMILY\" in\n    rhel) key=\"user.max_user_namespaces\" ;;\n    debian) key=\"kernel.unprivileged_userns_clone\" ;;\n  esac\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"Would save current $key to $STATE_DIR/sysctl.$key, write '$key = 0' to $SYSCTL_CONF, and run: sysctl -w $key=0\"\n    return\n  fi\n  save_prior_sysctl \"$key\"\n  echo \"$key = 0\" >\"$SYSCTL_CONF\"\n  sysctl -w \"$key=0\" >/dev/null\n  log \"Set $key=0 (persisted in $SYSCTL_CONF).\"\n}\n\nrevert_all() {\n  echo \"-- Reverting lpe2026 mitigations --\"\n  local f\n  local blacklist_files=(\n    \"$MODPROBE_DIR/lpe2026-copyfail.conf\"\n    \"$MODPROBE_DIR/lpe2026-pedit.conf\"\n    \"$MODPROBE_DIR/lpe2026-dirtyfrag.conf\"\n  )\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    for f in \"${blacklist_files[@]}\"; do\n      [[ -f \"$f\" ]] && dry \"Would remove $f\"\n    done\n  else\n    rm -f \"${blacklist_files[@]}\"\n    log \"Removed modprobe.d blacklist files \u2014 modules can load again on next request.\"\n  fi\n\n  remove_boot_param \"$BOOT_PARAM\"\n\n  local key=\"\"\n  case \"$FAMILY\" in\n    rhel) key=\"user.max_user_namespaces\" ;;\n    debian) key=\"kernel.unprivileged_userns_clone\" ;;\n  esac\n  if [[ -n \"$key\" && -f \"$SYSCTL_CONF\" ]]; then\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would remove $SYSCTL_CONF and restore prior $key from $STATE_DIR/sysctl.$key (if a prior value was saved).\"\n    else\n      rm -f \"$SYSCTL_CONF\"\n      restore_prior_sysctl \"$key\"\n    fi\n  fi\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    dry \"esp4/esp6/rxrpc/algif_aead/af_alg/act_pedit would remain unloaded until next use or reboot; revert only allows future loads again.\"\n  else\n    warn \"esp4/esp6/rxrpc/algif_aead/af_alg/act_pedit stay unloaded until next use or reboot; this only allows future loads again.\"\n    echo \"Revert complete. A reboot is recommended to fully restore prior module state.\"\n  fi\n}\n\nreport_status() {\n  echo \"== $(uname -r) \u2014 detected family: $FAMILY ==\"\n  echo\n  echo \"CVE-2026-31431 Copy Fail:\"\n  check_module_status algif_aead\n  check_module_status af_alg\n  echo\n  echo \"CVE-2026-46331 pedit COW:\"\n  check_module_status act_pedit\n  echo\n  echo \"CVE-2026-43284/43500/43503 Dirty Frag / DirtyClone:\"\n  check_module_status esp4\n  check_module_status esp6\n  check_module_status rxrpc\n  echo\n  echo \"Unprivileged user namespaces:\"\n  case \"$FAMILY\" in\n    rhel) sysctl user.max_user_namespaces 2>/dev/null | sed 's/^/  /' ;;\n    debian) sysctl kernel.unprivileged_userns_clone 2>/dev/null | sed 's/^/  /' ;;\n  esac\n}\n\nprint_summary() {\n  echo\n  echo \"== Summary ==\"\n  echo \"These are compensating controls, not a fix. Install the vendor kernel update and reboot when possible:\"\n  case \"$FAMILY\" in\n    rhel) echo \"  dnf update kernel   (or: yum update kernel)\" ;;\n    debian) echo \"  apt update && apt install --only-upgrade linux-image-generic\" ;;\n  esac\n  echo \"Log: $LOG_FILE\"\n}\n\nparse_args() {\n  while [[ $# -gt 0 ]]; do\n    case \"$1\" in\n      --apply) APPLY=1 ;;\n      --include-dirtyfrag) INCLUDE_DIRTYFRAG=1 ;;\n      --disable-userns) DISABLE_USERNS_FLAG=1 ;;\n      --yes) ASSUME_YES=1 ;;\n      --revert) DO_REVERT=1 ;;\n      --dry-run) DRY_RUN_FLAG=1 ;;\n      --status) APPLY=0 ;;\n      -h|--help) usage; exit 0 ;;\n      *) echo \"Unknown option: $1\" >&2; usage; exit 1 ;;\n    esac\n    shift\n  done\n  if [[ ( \"$INCLUDE_DIRTYFRAG\" == 1 || \"$DISABLE_USERNS_FLAG\" == 1 ) && \"$APPLY\" != 1 && \"$DRY_RUN_FLAG\" != 1 ]]; then\n    echo \"--include-dirtyfrag/--disable-userns require --apply or --dry-run\" >&2\n    exit 1\n  fi\n}\n\nmain() {\n  parse_args \"$@\"\n  require_root\n  FAMILY=\"$(detect_family)\"\n  if [[ \"$FAMILY\" == unknown ]]; then\n    echo \"Unsupported/undetected distro (expected RHEL, AlmaLinux, CentOS, or Ubuntu). Aborting.\" >&2\n    exit 1\n  fi\n\n  if [[ \"$DRY_RUN_FLAG\" == 1 ]]; then\n    DRY_RUN=1\n  elif [[ \"$APPLY\" != 1 && \"$DO_REVERT\" != 1 ]]; then\n    DRY_RUN=1\n  fi\n  [[ \"$DRY_RUN\" == 1 ]] || mkdir -p \"$STATE_DIR\"\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    echo \"== DRY RUN \u2014 previewing actions, no changes will be made ==\"\n    echo\n  fi\n\n  if [[ \"$DO_REVERT\" == 1 ]]; then\n    revert_all\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      echo\n      echo \"Dry run only \u2014 no changes made. Re-run without --dry-run to actually revert.\"\n    fi\n    exit 0\n  fi\n\n  report_status\n  echo\n\n  mitigate_copyfail\n  echo\n  mitigate_pedit\n\n  if [[ \"$INCLUDE_DIRTYFRAG\" == 1 ]]; then\n    echo\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would ask to confirm: 'This disables the IPsec (ESP) kernel dataplane and AF_RXRPC (breaks AFS mounts). Continue?' \u2014 previewing as if confirmed:\"\n      mitigate_dirtyfrag\n    elif confirm \"This disables the IPsec (ESP) kernel dataplane and AF_RXRPC (breaks AFS mounts). Continue?\"; then\n      mitigate_dirtyfrag\n    else\n      warn \"Skipped Dirty Frag / DirtyClone mitigation \u2014 CVE-2026-43284/43500/43503 remain unmitigated.\"\n    fi\n  fi\n\n  if [[ \"$DISABLE_USERNS_FLAG\" == 1 ]]; then\n    echo\n    if [[ \"$DRY_RUN\" == 1 ]]; then\n      dry \"Would ask to confirm: 'This disables unprivileged user namespaces (breaks rootless containers/sandboxes). Continue?' \u2014 previewing as if confirmed:\"\n      disable_userns\n    elif confirm \"This disables unprivileged user namespaces (breaks rootless containers/sandboxes). Continue?\"; then\n      disable_userns\n    else\n      warn \"Skipped userns lockdown.\"\n    fi\n  fi\n\n  print_summary\n\n  if [[ \"$DRY_RUN\" == 1 ]]; then\n    echo\n    if [[ \"$APPLY\" == 1 ]]; then\n      echo \"Dry run only \u2014 no changes made. Re-run without --dry-run to apply the changes shown above.\"\n    else\n      echo \"Dry run only \u2014 no changes made. Re-run with --apply to mitigate (add --yes to skip prompts).\"\n    fi\n  fi\n}\n\nmain \"$@\"\n", "creation_timestamp": "2026-09-04T10:19:03.211601Z"}]}