Heads up for fellow Linux admins: CVE-2026-99999 (dubbed "PwnEscape") is out, and it is a nasty one (CVSS 9.3).

Despite being called a KVM escape, the actual bug lives in the host IPv4 networking stack. Untrusted CHECKSUM_PARTIAL offload metadata from a guest can overwrite already-validated packet headers during ip_do_fragment(), leaking host memory or allowing a guest-to-host escape.

Mainline patches landed Oct 14, and stable backports are out. Check your hypervisors and reboot!

https://pwn.ai/blog/pwnescape

#Linux #Kernel #SysAdmin #InfoSec #KVM #ITSEC #CVE

alpinelinux.org is currently unavailable due to emergency patching of the host (CVE-2026-99999).

It should be back soon.

#AlpineLinux #AlpineOps

⚠️ PwnEscape (CVE-2026-99999) is a newly disclosed Linux kernel vulnerability.

AlmaLinux 8, 9, and 10 are affected. Patched kernels are available for testing!

Read more: https://almalinux.org/blog/2026-10-16-pwnescape-cve-2026-99999/

PwnEscape - уязвимость в сетевом стеке ядре Linux, позволяющая обойти изоляцию гипервизоров и контейнеров

https://www.opennet.ru/opennews/art.shtml?num=66487

В ядре Linux выявлена критическая уязвимость (CVE-2026-99999, PwnEscape) в стеке IPv4, позволяющая получить доступ к памяти хост-окружения из гостевой системы.
При успешной эксплуатации уязвимости пользователь гостевой системы может выполнить код с правами ядра на стороне хост-окружения.
Эксплуатация уязвимости продемонстрирована в окружении на базе гипервизора KVM, но так как уязвимость вызвана ошибкой не в гипервизоре, а в механизме обработки сетевых пакетов ядром Linux, потенциально эксплоит может быть адаптирован и для других гипервизоров и механизмов изоляции, в которых используется штатный сетевой стек Linux.

Проблема вызвана некорректной последовательностью операций при проверке контрольной суммы сетевого пакета, позволяющей изменить заголовок IPv4 в момент после проверки корректности информации,

Oh... That's bad

https://app.opencve.io/cve/CVE-2026-99999

#PwnEscape (CVE-2026-99999): a hardcore Guest-to-Host escape based only off IPv4 packets, that impacts most #cloud providers. The timeframe for discovery does show how fundamentally usage of #LLMs changes #cybersecurity research (and how effective #BugBounty programs are).
https://pwn.ai/blog/pwnescape
Expect some maintenance downtime across providers.

I thought CVE-2026-99999 was a joke due to its ID. It is not.

Buying some more potato / carrot seeds.

‼️ A newly disclosed critical Linux kernel flaw, PwnEscape (CVE-2026-99999), lets code inside guest VMs read host memory and enabled VM escape with root access in lab tests.

Read - https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html

Vercel confirmed the memory leak in its live production sandboxes during its $1 million security challenge.

The flaw lies in Linux networking, not the hypervisor, with implications beyond Vercel.

PwnEscape (CVE-2026-99999): The Critical Linux Kernel Flaw That Breaks VM Isolation

https://thecybersecguru.com/exploits/pwnescape-cve-2026-99999-linux-kernel-vm-escape/

⚠️ CRITICAL: Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

A critical Linux kernel vulnerability (CVE-2026-99999) in networking code allows guest VMs to read host system memory. This affects any hypervisor running vulnerable Linux kernels and has been successfully exploited against Vercel's cloud sandboxes. Host memory exposure puts credentials, keys, and…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

En las últimas 24 horas se han revelado vulnerabilidades críticas que afectan desde el kernel Linux y OpenBSD hasta entornos virtualizados KVM y software común como WinRAR, facilitando desde escapes de máquinas virtuales hasta acceso root y espionaje vía anuncios, demostrando la urgencia de reforzar auditorías y protección integral a infraestructuras digitales. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 16/10/26 📆 |====

🔓 PWNESCAPE: ESCAPE GUEST-TO-HOST EN KVM (CVE-2026-99999)

Un desafío de sandbox valorado en 1 millón de dólares reveló una grave vulnerabilidad en el kernel Linux que afecta hipervisores KVM estándares. Esta falla permite mutar encabezados IPv4, provocar divulgación de memoria y, lo más crítico, escapar de máquinas virtuales invitadas hacia el host, comprometiendo la seguridad completa del sistema. Esta vulnerabilidad CVE-2026-99999 abre la puerta a ataques sofisticados que explotan la confianza en checksums parciales. Profundiza en esta amenaza y sus implicaciones para la seguridad en entornos virtualizados 👉 https://djar.co/EwCBx

🕵️‍♂️ EXPOSICIÓN DE ADFECTION: PUBLICAN EL PRIMER CASO DE SPYWARE DE CLIC CERO VIA ANUNCIOS DIRIGIDOS

Investigadores de The Citizen Lab han confirmado la existencia de AdFection, un spyware mercenario de “clic cero” distribuido a través de anuncios segmentados. Este método fue usado para infectar dispositivos vinculados a Al Jazeera con spyware de Candiru, evidenciando cómo plataformas como Discover-Tech habilitan la vigilancia y hackeo global a través de publicidad dirigida sin interacción del usuario. Conoce cómo esta sofisticada técnica redefine las amenazas en la publicidad digital 👉 https://djar.co/qh5AK

🐟 EXPLOTAN BUG DE 37 AÑOS EN EL KERNEL DE OPENBSD PARA OBTENER ACCESO ROOT

Un fallo crítico que ha permanecido en el kernel de OpenBSD por más de tres décadas fue finalmente explotado para conseguir privilegios root y abrir una shell con control total. Esta vulnerabilidad histórica pone en alerta sobre la importancia de auditorías continuas en sistemas considerados altamente seguros. Descubre los detalles técnicos y el impacto de esta explotación en sistemas protegidos 👉 https://djar.co/VVj6k

🛡️ VULNERABILIDAD CRÍTICA EN LINUX PERMITE A MÁQUINAS VIRTUALES LEER MEMORIA DEL HOST

Se identificó una vulnerabilidad grave en el kernel de Linux que permite a las máquinas virtuales invitadas leer la memoria del sistema host en entornos sandbox activos. Aunque por ahora no se han reportado ataques en producción, pruebas de laboratorio demostraron la posibilidad de ejecutar código en el host, lo que plantea un alto riesgo en la virtualización y aislamiento de sistemas. Infórmate sobre esta amenaza y cómo proteger tus infraestructuras virtualizadas 👉 https://djar.co/WHCw

🦊 SILENT LYNX EXPLOTA FALLA EN WINRAR PARA IMPLANTAR REVERSE SHELL EN ATAQUES A GOBIERNOS CIS

El grupo de ciberamenazas Silent Lynx está utilizando la vulnerabilidad CVE-2025-8088 en WinRAR para desplegar reverse shells en las carpetas de inicio de sistemas Windows. Estas acciones forman parte de campañas dirigidas a gobiernos de la Comunidad de Estados Independientes (CIS), permitiendo acceso remoto y control persistente a los atacantes. Conoce cómo esta técnica aprovecha software común para comprometer entornos gubernamentales 👉 https://djar.co/oCw4V

RE: https://infosec.exchange/@BleepingComputer/117449130155748204

BeyondTrust patched a Remote Support zero-day (CVE-2026-102764) exploited since August.

Mandiant attributes the attacks to Armory Castle (formerly UNC5221), a China-nexus espionage group that has also targeted Citrix NetScaler and Ivanti Connect Secure appliances.

BeyondTrust has 20,000+ customers, including 75% of the Fortune 100.

The China-linked hacking group Armory Castle targeted BeyondTrust Remote Support systems in late August 2026 using an undisclosed vulnerability tracked as CVE-2026-102764 with a 9.3 severity score.

The flaw enabled remote file manipulation, resulting in web shell installation and credential collection from device databases.

BeyondTrust issued cloud updates by October 9 and released manual patches for self-hosted in…

https://en.hacks.gr/omada-chaker-poy-syndeetai-me-tin-kina-ekmetalleytike-provlima-toy-beyondtrust-se-mia-syskeyi/

#BeyondTrust #Vulnerability #CVE2026102764 #WebShell

Patch CVE-2026-102764 now. This critical BeyondTrust Remote Support vulnerability is exploited in the wild as an ARMORY CASTLE zero-day.

#BeyondTrust #CVE2026102764 #ZeroDay #ArmoryCastle #Mandiant #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/beyondtrust-remote-support-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

📰 China-Linked Group Exploits BeyondTrust Zero-Day in Espionage Attacks

A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay #CVE

🔗 https://cyber.netsecops.io/articles/china-linked-hackers-exploit-beyondtrust-zero-day-in-espionage-campaign/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️ CRITICAL: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Chinese APT Armory Castle has been actively exploiting CVE-2026-102764, a zero-day in BeyondTrust Remote Support appliances, since August to gain root access and exfiltrate data. Organizations running BeyondTrust are at immediate risk of credential theft, lateral movement, and data loss. Attackers…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Windows Updates Can Stall Exchange, Plus 4 Stories https://raymondtec.com/2026/10/windows-updates-stall-exchange-plus-4-stories/?utm_source=mastodon&utm_medium=social&utm_campaign=daily_brief

October Windows Server updates can disrupt on-premises Exchange mail flow. Plus a BeyondTrust zero-day, court notices, Microsoft lock-in, and Android scams.

#TechNews #Android #BankruptcyCourts #BeyondTrust #CVE2026102764 #GoogleMessages #MicrosoftExchange

🚨 Rapid Response | BeyondTrust Remote Support/Privileged Remote Access Zero-Day (CVE-2026-102764) (CVSS 9.3) is a critical vulnerability.

The flaw allows unauthenticated attackers to perform file operations on affected appliances.
Censys currently detects 9,569 Internet-exposed hosts and 177,497 web properties running BeyondTrust Remote Support or Privileged Remote Access. These figures represent detected installations, not confirmed vulnerable or unpatched instances.

BeyondTrust has released patches for both products. Organizations should prioritize patching self-hosted appliances and investigate potential compromise, as patching does not remediate prior exploitation.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-102764/

#CensysARC #Cybersecurity #VulnerabilityManagement #BeyondTrust #InfoSec

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

#CISA #KEV #Beyondtrust #fortinet

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

Cisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise

Cisco has confirmed that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8, to gain root access. Cisco urged customers to update, use its scanner tools, and check for compromise. https://securityaffairs.com/200985/security/cisco-urges-customers-to-patch-email-gateway-flaw-and-check-for-compromise.html

📰 Cisco Secure Email Gateway Flaw Actively Exploited for Root Access

Cisco warns of a critical, actively exploited zero-day (CVE-2026-76519) in its Secure Email Gateway. The 9.8 CVSS flaw allows unauthenticated RCE with root access. Patch immediately—no workarounds exist. #CyberSecurity #Cisco #ZeroDay #RCE

🔗 https://cyber.netsecops.io/articles/cisco-warns-of-actively-exploited-zero-day-in-secure-email-gateway/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Geopolitical tensions rise: US-Ukraine ties fray over Starlink restrictions and Patriot missile shortages (Oct 16). Tech breakthrough: Microsoft unveils MAI-Base-2, a 2.8T parameter AI model with 12x DeepSeek gain (Oct 15). Cybersecurity critical: Chinese APT exploited BeyondTrust zero-day (CVE-2026-102764). Cisco warns of exploited Secure Email Gateway flaw (CVE-2026-76519).

#Cybersecurity #Geopolitics #AI

📰 CISA Adds Four Actively Exploited Flaws to KEV Catalog

CISA adds 4 actively exploited vulnerabilities to its KEV catalog. Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco SEG (CVE-2026-76519), & AhsayCBS (CVE-2026-105133/4) require immediate patching. #CISA #KEV #Vulnerability

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-exploited-vulnerabilities-to-kev-catalog-october-2026/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Rapid Response | Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) (CVSS 9.2) is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation in the wild has been reported, allowing unauthenticated attackers to execute operating system commands.
Censys currently detects 19,454 Internet-exposed hosts and 103,350 web properties with the app installed. These figures represent detected installations, not confirmed vulnerable instances.

Organizations should upgrade to version 26.4.303 or later, or remove the app. Disabling it is not sufficient.

Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: https://censys.com/advisory/cve-2026-110447/

#CensysARC #Cybersecurity #VulnerabilityManagement #Nextcloud #InfoSec

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

Threat actors are exploiting a critical command execution flaw, tracked as CVE-2026-110447, in the Collabora Online Built-in CODE Server app for Nextcloud. BleepingComputer reports the flaw is being used to backdoor Nextcloud servers. https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

A suspected advanced threat actor has been exploiting a path traversal flaw in Fortinet FortiOS, tracked as CVE-2025-61624, to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The flaw also affects FortiPAM, FortiProxy, and FortiSwitchManager, according to The Hacker News. https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html

Placeholder link https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog

• CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
• CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability

#CISA #KEV #Beyondtrust #fortinet

Unit 42 says attackers gained access to a managed telecom services provider in September 2024 by exploiting FortiManager’s FortiJump flaw (CVE-2024-47575).

They obtained a file with data on more than 500 managed FortiGate firewalls, including configurations, network maps, credentials, certificates and private keys.

The attackers later used a separate flaw, CVE-2025-61624, to install PEERSTITCH, which changes how For…

https://en.hacks.gr/paraviasi-se-parocho-tilepikoinonion-exethese-stoicheia-gia-500-systimata-asfaleias/

#FortiManager #FortiGate #PEERSTITCH #CVE2025_61624

This one slipped through the cracks this past Patch Tuesday because the CVE started with 2025: CVE-2025-61624 (5.4 medium) path traversal > aribtrary write/delete
https://fortiguard.fortinet.com/psirt/FG-IR-26-122

Unit 42's blog post states it was exploited in the wild: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

The attackers exploited another vulnerability, CVE-2025-61624, via FortiOS auto-script path traversal. This exploit facilitated the deployment of PEERSTITCH, a novel, memory-resident ARM64 malware.

#threatintel #eitw #CVE #fortinet #ioc

Publicado exploit PoC para vulnerabilidad RCE crítica de GitLab (CVE-2026-97229)

https://blog.elhacker.net/2026/10/publicado-exploit-poc-para.html

GitLab CVE-2026-97229: The CVSS 10.0 RCE Vulnerability Exposing 26,000+ CI/CD Pipelines to Attack

https://thecybersecguru.com/exploits/gitlab-cve-2026-97229-rce/

PAN-OS CVE-2026-0322 (CVSS 4.0 8.6): RCE come root dalla management interface di PA/VM-Series e Panorama. Sfruttamento "molto limitato" per Palo Alto, in CISA KEV (deadline FCEB 17/10). Serve auth + accesso di rete alla mgmt. Nessun workaround: patch per branch; intanto mgmt solo da IP interni/jump box. IP collegati: 66.42.72[.]14, 208.83.239[.]114, 149.248.47[.]234. Nessuna attribuzione. https://security.paloaltonetworks.com/CVE-2026-0322 #cybersecurity #infosec #threatintel

📰 CISA Adds Four Actively Exploited Flaws to KEV Catalog

CISA adds 4 actively exploited vulnerabilities to its KEV catalog. Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco SEG (CVE-2026-76519), & AhsayCBS (CVE-2026-105133/4) require immediate patching. #CISA #KEV #Vulnerability

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-exploited-vulnerabilities-to-kev-catalog-october-2026/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

En las últimas 24 horas se han revelado vulnerabilidades críticas que afectan desde el kernel Linux y OpenBSD hasta entornos virtualizados KVM y software común como WinRAR, facilitando desde escapes de máquinas virtuales hasta acceso root y espionaje vía anuncios, demostrando la urgencia de reforzar auditorías y protección integral a infraestructuras digitales. Descubre estos y más detalles en el siguiente listado de noticias sobre seguridad informática:

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 16/10/26 📆 |====

🔓 PWNESCAPE: ESCAPE GUEST-TO-HOST EN KVM (CVE-2026-99999)

Un desafío de sandbox valorado en 1 millón de dólares reveló una grave vulnerabilidad en el kernel Linux que afecta hipervisores KVM estándares. Esta falla permite mutar encabezados IPv4, provocar divulgación de memoria y, lo más crítico, escapar de máquinas virtuales invitadas hacia el host, comprometiendo la seguridad completa del sistema. Esta vulnerabilidad CVE-2026-99999 abre la puerta a ataques sofisticados que explotan la confianza en checksums parciales. Profundiza en esta amenaza y sus implicaciones para la seguridad en entornos virtualizados 👉 https://djar.co/EwCBx

🕵️‍♂️ EXPOSICIÓN DE ADFECTION: PUBLICAN EL PRIMER CASO DE SPYWARE DE CLIC CERO VIA ANUNCIOS DIRIGIDOS

Investigadores de The Citizen Lab han confirmado la existencia de AdFection, un spyware mercenario de “clic cero” distribuido a través de anuncios segmentados. Este método fue usado para infectar dispositivos vinculados a Al Jazeera con spyware de Candiru, evidenciando cómo plataformas como Discover-Tech habilitan la vigilancia y hackeo global a través de publicidad dirigida sin interacción del usuario. Conoce cómo esta sofisticada técnica redefine las amenazas en la publicidad digital 👉 https://djar.co/qh5AK

🐟 EXPLOTAN BUG DE 37 AÑOS EN EL KERNEL DE OPENBSD PARA OBTENER ACCESO ROOT

Un fallo crítico que ha permanecido en el kernel de OpenBSD por más de tres décadas fue finalmente explotado para conseguir privilegios root y abrir una shell con control total. Esta vulnerabilidad histórica pone en alerta sobre la importancia de auditorías continuas en sistemas considerados altamente seguros. Descubre los detalles técnicos y el impacto de esta explotación en sistemas protegidos 👉 https://djar.co/VVj6k

🛡️ VULNERABILIDAD CRÍTICA EN LINUX PERMITE A MÁQUINAS VIRTUALES LEER MEMORIA DEL HOST

Se identificó una vulnerabilidad grave en el kernel de Linux que permite a las máquinas virtuales invitadas leer la memoria del sistema host en entornos sandbox activos. Aunque por ahora no se han reportado ataques en producción, pruebas de laboratorio demostraron la posibilidad de ejecutar código en el host, lo que plantea un alto riesgo en la virtualización y aislamiento de sistemas. Infórmate sobre esta amenaza y cómo proteger tus infraestructuras virtualizadas 👉 https://djar.co/WHCw

🦊 SILENT LYNX EXPLOTA FALLA EN WINRAR PARA IMPLANTAR REVERSE SHELL EN ATAQUES A GOBIERNOS CIS

El grupo de ciberamenazas Silent Lynx está utilizando la vulnerabilidad CVE-2025-8088 en WinRAR para desplegar reverse shells en las carpetas de inicio de sistemas Windows. Estas acciones forman parte de campañas dirigidas a gobiernos de la Comunidad de Estados Independientes (CIS), permitiendo acceso remoto y control persistente a los atacantes. Conoce cómo esta técnica aprovecha software común para comprometer entornos gubernamentales 👉 https://djar.co/oCw4V