🔥 A new 16-year-old #Linux KVM flaw lets a rooted nested VM crash the x86 host and take down other tenants on the same machine.

Dubbed "Januscape" (CVE-2026-53359), the bug sits in KVM’s shadow MMU.

Researcher says a full guest-to-host escape exploit also exists in a controlled setup; only the host-crash PoC is public.

Explained here: https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html

🛑 A newly found 15-year-old #Linux kernel flaw, GhostLock (CVE-2026-43499), could let any logged-in user gain root on unpatched distributions.

A working exploit code is now public, and it escaped containers in tests.

Read details here: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html

🚨 A flaw in Ubuntu’s snap-confine could turn local user access into root.

CVE-2026-8933 chains FUSE and symlink race conditions to plant malicious udev rules and execute commands as root.

Default Ubuntu #Linux Desktop 24.04, 25.10, and 26.04 installations are affected.

Read how the exploit works: https://thehackernews.com/2026/07/ubuntu-snap-confine-flaw-could-give.html

🛑 A newly disclosed, 9-year-old #Linux flaw lets unprivileged users overwrite root-owned files and gain persistent root access.

On affected XFS systems, the overwrite survives reboot without changing ownership, permissions, timestamps, or the setuid bit.

Read: https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html

🛑 A researcher says AI helped turn a #Linux traffic-control race into a root exploit.

CVE-2026-53264 lets a local user gain root on the tested CentOS Stream 9 build, but needs user namespaces, specific kernel options, and build-specific ROP offsets.

Read how the exploit works: https://thehackernews.com/2026/07/researcher-says-ai-helped-develop-linux.html

🚨 A new Mirai-derived botnet called Tengu can reboot compromised #Linux devices when defenders kill its main process, giving the malware another chance to return.

It also supports 25 DDoS methods, SOCKS5 proxying, shell commands, and additional ELF or APK payloads.

See how Tengu resists removal: https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html

🚨 Alibaba tool users were targeted with a cross-platform RAT.

Researchers linked 18 malicious npm packages to a layered dependency chain that served Windows, #Linux, and #macOS payloads with command execution, persistence, file transfer, and lateral movement capabilities.

How the npm attack worked: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html

⚡ Adobe patches a Magento zero-day already exploited to deploy malware.

CVE-2026-75650 abuses Magento template processing for unauthenticated code execution. Attacks have delivered a Rust #Linux backdoor and PHP web shell.

How the chain works: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

‼️ ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready.

One can be triggered WITHOUT authentication.

Neither has a mainline kernel fix.

Details here ↓ https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

‼️ OpenAI's AI agents generated 948 working #Linux exploits that can escalate local user access to root.

In a 30-hour run, its pipeline reproduced 1,724 vulnerabilities and developed 291 information-leak PoCs.

Total API cost ➜ $1.2 million.

Read ↓ https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html

🚨 OpenSSH flaw exploited within hours of disclosure.

Attackers are targeting CVE-2026-123158 (SSHole), which bypasses password authentication under specific #Linux configurations.

Root access confirmed on an Alpine Linux honeypot.

Details: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html