grep -rl "linux" ./articles
CVE-2026-109518 gives an on-path attacker root on Debian and Ubuntu machines. It needs a retry setting that has been the default since Debian 12, which means the older releases are the safe ones.
CVE-2026-98432 is a use-after-free in the IPv4 TCP path, reachable with a SYN packet carrying an IP option almost nobody uses. The only score on the record is the kernel's own, and it comes with a justification for every metric.
Rapid7 found a Linux implant built into the HAProxy binaries of two South Korean organisations, intercepting traffic and erasing its own requests from the proxy's own logs. Every headline calls it an HAProxy backdoor. Installing it requires already owning the host, which makes patching HAProxy the one response that changes nothing.
TrendAI found 14 npm packages posing as calendar utilities and carrying RedC2 4.0, a Linux implant sold on Hack Forums. There is no install hook: the payload launches when the module loads, so one transitive import runs it. The framework's Red Agent turns natural-language prompts into intrusion command sequences.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.