⚠️ PoC Exploit Released for Guest-to-Host Escape Linux Kernel Vulnerability
Source: https://t.co/0YG7N6J8Q7
A proof-of-concept (PoC) exploit has been released for a critical Linux kernel vulnerability, CVE-2026-46316, that enables a guest-to-host escape in KVM environments on arm64 systems.
The vulnerability was discovered by security researcher Hyunwoo Kim (V4bel) and affects the in-kernel KVM implementation rather than user-space components like QEMU.
This makes the issue particularly severe, as exploitation results in a direct compromise of the host kernel rather than a confined user-space process. ITScape is caused by a race condition in the vGIC-ITS (Interrupt Translation Service) emulation within KVM on arm64.
#cybersecuritynews
OptimizerDuck, open-source tool yang bikin lo uninstall CCleaner.
Ini bukan cuma "cleaner" biasa. Dia gabungin 30+ tweak Windows dalam satu app, dari matiin telemetry, block bloatware, sampai GPU registry tweaks yang biasanya lo harus edit manual.
Yang gue suka, dia kasih risk rating buat setiap tweak. Jadi lo tau sebelum apply, bukan asal pencet terus nyesel.
Fitur yang kerasa banget:
- Disable Windows telemetry, Cortana, Copilot, advertising ID
- Startup manager, lo bisa matiin semua app yang auto jalan pas boot
- Service host tuning based on RAM lo
- Custom high-performance power plan
- Keyboard latency reduction buat gaming
Dan semua reversible. Ga cocok? Balikin lagi.
Yang paling penting adalah, portable .exe. Download, langsung jalan. Ga install, ga registry sampah. Bisa di USB stick.
Dan dia open-source, bukan freemium yang nanti nagih. 2.3k stars, aktif dikembangin (commit terakhir 2 hari lalu). Support 8 bahasa termasuk Indonesia? Engga. Tapi EN, Vietnam, China, Korea, Prancis, Spanyol, Rusia ada.
Link: https://t.co/WjfhDLm30C
CCleaner Pro $40/tahun buat apa kalau ini ada.
Rust-Based Malware Hits 1.4% of Arch User Repository
The data stealing code compromised over 1,500 packages in the Arch Linux User Repository, making use of Rust, Systemd, NodeJS, & Bun.
🚨 Attackers hijacked 400+ Arch #Linux AUR packages by taking over abandoned projects and changing their build scripts.
The payload stole developer secrets, targeted tokens and SSH keys, and could hide with an eBPF rootkit if it ran as root.
If you used AUR after June 11, check your system.
Details ➝ https://t.co/7ClUL4fKCo
🚨 BREAKING: More than 400 Arch Linux User Repository packages have been compromised with infostealer malware and a rootkit.
Attacker posed as a trusted maintainer and "adopted" orphaned packages.
Arch maintainers are purging infected packages now. Audit your AUR installs.
🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io.
Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.
TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.
Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.
On iOS and macOS, WhatsApp stores chat databases unencrypted in an app group container accessible to apps from the same developer. So all Meta apps on the same iPhone (e.g., Facebook) can read WA chats in plaintext without permission, and users wouldn't be notified. Demo👇
CVE-2026-0265, the PAN-OS auth bypass (when Cloud Auth Services are enabled) was fun to reproduce and load into the watchTowr Platform.
Our friends @ @HacktronAI are publishing their analysis this week, so we won’t be publishing. Looking forward to it 🚀
⚠️ Critical Linux Kernel Flaw ‘ssh-keysign-pwn’ Exposes SSH Keys and Shadow Passwords
Source: https://t.co/wzp6CCp2lT
A newly disclosed Linux kernel vulnerability is raising serious concerns across the security community, as it allows attackers to access highly sensitive data, including SSH private keys and password hashes, on affected systems.
Tracked as CVE-2026-46333, the flaw has been nicknamed “ssh-keysign-pwn” and impacts a wide range of Linux distributions. The GitHub PoC ssh-keysign-pwn demonstrates exactly how to weaponize this race condition on pre‑31e62c2ebbfd kernels.
#cybersecuritynews #Linux
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
DON'T SIGN IN WITH GOOGLE
🚨 Critical Linux Kernel Vulnerability Alert
Qualys has disclosed ssh-keysign-pwn: a 6-year race condition in __ptrace_may_access() that lets unprivileged local users read root-owned files.
A privileged process (e.g. ssh-keysign or chage) opens sensitive FDs. During do_exit(), after exit_mm() (mm=NULL) but before exit_files(), pidfd_getfd() can steal those FDs.
Impact: • Theft of host SSH private keys → real impersonation & MitM risk until keys are rotated • Full read access to /etc/shadow → offline password cracking
Affected: All kernels before 31e62c2ebbfd (May 14, 2026) — Ubuntu, Debian, Arch, CentOS, Raspberry Pi OS and more.
Immediate action required: Apply the kernel patch NOW.
🔗 PoC: https://t.co/UZJyKb6Szj 🔗 Patch: https://t.co/rNU2YB4mVv…/31e62c2ebbfd 🔗 Full analysis: Phoronix & Qualys oss-security
#LinuxSecurity #KernelVulnerability #CyberSecurity #InfoSec #OpenSSH #PrivilegeEscalation #ThreatIntelligence #Linux #CyberThreat #PatchNow