grep -rl "privilege-escalation" ./articles
CVE-2026-67401 affects every supported version of cPanel and WHM, and lets an authenticated account holder with mail privileges reach root. There is no CVSS score, no explanation of how SQL injection becomes file creation becomes root, no detail on which privilege is required, and no workaround.
Microsoft patched 974 vulnerabilities in September, a 70% jump over the previous record, with 723 of them in Windows and more than 110 rated critical. Two are being exploited. Both are CVSS 7.8 local privilege escalation, which means the attacker is already on the machine — and that is the whole triage.
PrettyPrague, FalconFlank and GreenSection target Avast's sandbox, CrowdStrike Falcon's macro remediation and NVIDIA's display driver. Gen Digital has patched. CrowdStrike's advice is to turn the affected protection off. NVIDIA is still investigating. And the FalconFlank claim this site called single-source last week now has independent confirmation.
CVE-2026-6471 lets any account holding PostgreSQL's REPLICATION attribute load an arbitrary library as a logical decoding plugin and run code as the postgres user. It has been there since logical decoding shipped in 9.4 in 2014, and REPLICATION is the privilege every CDC pipeline in your estate already has.
CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August, with a three-day deadline. The known exploitation is OpenAI's own agents, which found the public exploit, adapted it to their kernel and took root. No other in-the-wild reports appear to exist. The catalog does not have a category for this.
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
Three outlets counted this Patch Tuesday three different ways, which tells you how little the total matters. CVE-2026-68820 in afd.sys is a use-after-free rated 7.0, Check Point ties it to Lazarus, and the chain starts with a fake job offer.
Presented at DEF CON 34, 'Plug And Pwn' chains Windows' own driver auto-install against itself — emulate a Sierra Wireless modem, then a Sony FeliCa reader, and a DLL lands in System32. There is a Remote Desktop variant too.
Manifold Security found that an authenticated non-admin user of Odysseus could execute OS commands with the process's own privileges. What that account reached is the story: API keys to spend, a mailbox to send from, and SSH keys to the machines Odysseus manages.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.