{"vulnerability": "CVE-2026-92574", "sightings": [{"uuid": "959b7b5f-09da-42ea-bbb0-a4db1ad02fdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92574", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117308498552050605", "content": "There is a new vulnerability with elevated criticality in Red Hat Confidential Compute Attestation and other products (CVE-2026-92574) https://vuldb.com/vuln/408086", "creation_timestamp": "2026-09-21T10:13:56.063117Z"}, {"uuid": "3c399111-d84d-4957-93c4-6922824dedd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92574", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ewjabhrbkl5rc", "content": "CVE-2026-92574 - Cri-o: cri-o checkpoint restore bypasses destination security context\nCVE ID : CVE-2026-92574\n \n Published : Sept. 21, 2026, 9:49 a.m. | 11\u00a0minutes ago\n \n Description : A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malic...", "creation_timestamp": "2026-09-21T10:42:40.353481Z"}, {"uuid": "30da0027-e775-4010-ae12-1d7628aa94b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92574", "type": "seen", "source": "https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a", "content": "This threat intelligence briefing covers critical vulnerabilities, active malware campaigns, and emerging AI security governance:\n\n**Vulnerabilities & Advisories:** IBM released advisory AV26-943 requiring immediate patches for multiple enterprise products. Two high-severity CVEs were disclosed: CVE-2026-16651 (a DoS flaw in Temporal\u2019s SQL parser) and CVE-2026-92574 (a CRI-O checkpoint restore bypass enabling Kubernetes privilege escalation).\n\n**Active Threats:** The TASK#STOMP PowerShell backdoor is harvesting documents, Wi-Fi credentials, clipboard data, and screenshots. A sophisticated npm malware campaign evaded script defenses by hijacking core runtime functions, exfiltrated data via Slack/Telegram, used an Ethereum testnet for resilient C2, and accumulated ~2M weekly downloads.\n\n**AI & Device Security:** Five Eyes/CISA guidance recommends restricting autonomous AI agents to low-risk, non-sensitive tasks, while Orchid Security introduced identity drift detection and application-level kill-switches to govern safe AI scaling. Additional insights cover a critical disk encryption bypass in Flock ALPR cameras and security best practices for Windows 11 kiosk deployments.\n\n**Recommendation:** Organizations should apply pending patches, monitor for newly disclosed IOCs, and enforce strict identity hygiene and access controls across software supply chains and AI workloads.", "creation_timestamp": "2026-09-21T16:01:32.888045Z"}]}