Tracking Threats, Incidents, and Vulnerabilities
Tracking Threats, Incidents, and Vulnerabilities
Some Ubuntu services experienced outages for nearly a full day following a sustained Distributed Denial of Service (DDoS) attack that disrupted installs, updates, and Canonical’s web infrastructure. The attack was claimed by an Iraqi hacktivist group called The Islamic Cyber Resistance in Iraq 313 Team, which reportedly used a booter service named Beamed to launch the attack.
The Apache Software Foundation released version 2.4.67 of Apache HTTP Server to patch five vulnerabilities, including a critical double-free flaw (CVE-2026-23918) in version 2.4.66 that enables remote code execution via HTTP/2. Users are strongly urged to upgrade immediately to mitigate this high-severity risk affecting millions of servers worldwide.
A critical local privilege escalation vulnerability in the Linux kernel, named CopyFail (CVE-2026-31431), has been publicly disclosed with exploit code that easily grants root access across virtually all Linux distributions. The flaw affects multi-tenant servers, Kubernetes containers, and CI/CD workflows, posing a severe threat as attackers can escalate privileges quickly on vulnerable systems before widespread patches are applied. Security experts warn this is one of the most serious Linux vulnerabilities in years, urging immediate investigation and mitigation by Linux users and vendors.
A critical zero-day vulnerability named “Copy Fail” (CVE-2026-31431) in the Linux kernel, affecting every major distribution since 2017, allows any unprivileged local user to gain root access by exploiting a flaw in the kernel's cryptographic template via the AF_ALG socket and splice() system call. The vulnerability, discovered by Theori and exploited by Xint Code Research Team, enables file page cache corruption undetectable by integrity tools, and also facilitates Kubernetes container escapes; a patch has been released and administrators are urged to update immediately.
Nicholas Carlini, a research scientist at Anthropic, used the AI tool Claude Code to discover multiple remotely exploitable security vulnerabilities in the Linux kernel, including a particularly significant bug in the NFS driver that had remained unnoticed for 23 years. This breakthrough highlights the remarkable capabilities of advanced language models to identify complex security flaws, potentially leading to a surge in vulnerability discoveries as such AI tools continue to improve.
The Pay2Key ransomware group, linked to Iranian threat actors, has developed a Linux-targeted ransomware variant that actively attacks organizational servers, virtualization hosts, and cloud environments. This Linux-specific malware requires root privileges, disables key Linux security frameworks, and uses the ChaCha20 encryption algorithm to cause significant disruption to critical infrastructure, signaling a major shift in ransomware targeting strategy.
https://cybersecuritynews.com/linux-ransomware-pay2key-attacking-organizations-ervers/
WSL (Windows Subsystem for Linux) enables running a Linux environment on Windows, allowing developers and cybersecurity workflows to leverage Linux tools. It poses security risks, as malware can exploit WSL by checking for its presence and executing commands. An infostealer trojan, “ottercookie-socketScript-module-3.js,” utilizes WSL to access the Windows filesystem and obtain user information.
Extreme TLDR: VoidLink is a modular, cloud-native Linux malware framework designed for stealth and long-term access, featuring over 30 plugins, adaptable OPSEC techniques, and developed by possibly Chinese affiliates for commercial use. It targets cloud environments, adapts behavior based on detected security measures, and includes capabilities for credential harvesting and persistence.
https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/
New Curing rootkit exploits io_uring in Linux, bypassing traditional security tools by avoiding monitored system calls. This vulnerability poses significant risks, especially for cloud-native businesses. ARMO's solution can mitigate this threat by managing system calls. Users relying solely on classic monitoring may be vulnerable.
https://betanews.com/2025/04/24/hackers-bypass-linux-security-with-armo-curing-rootkit/
