Rust Supply-Chain Attack Compromises Popular arrayref Crate
Rust’s security team has disclosed a supply-chain attack involving a malicious arrayref 0.3.10 release and several related crates on crates.io.
vulnerability
18-Year-Old Linux Kernel Vulnerability Enables Root Access and Container Escape
The SCTPhantom vulnerability, CVE-2026-64564, affects Linux SCTP code and can be exploited for root access and container escape.
15-Year-Old Linux Kernel GhostLock Flaw Lets Local Users Gain Root
CVE-2026-43499, dubbed GhostLock by Nebula Security, exposes a long-standing Linux kernel futex bug that can lead to local root access.
GNU Guix Package Manager Hit by Four Security Flaws
The Guix team urges users to upgrade after vulnerabilities were found in its substitute handling and channel update mechanisms.
Linux Tops 2026 CVE Charts, Greg KH Says That’s a Good Thing
Greg Kroah-Hartman says Linux leads CVE counts for the first half of 2026, arguing the numbers reflect responsible reporting, not poor security.
Canonical Confirms Ubuntu Fixes for DirtyClone Linux Kernel Flaw
Canonical says Ubuntu kernel updates are available for DirtyClone, a high-severity Linux local privilege escalation flaw tracked as CVE-2026-43503.
Linux Foundation Launches Akrites to Improve Open Source Vulnerability Response
AWS, Anthropic, Google, Microsoft/GitHub, Red Hat, NVIDIA, and others are backing a new effort to coordinate OSS security response.
Linux Gets Dirty Again: DirtyClone Kernel Flaw Can Lead to Local Root Access
After DirtyFrag, DirtyClone exposes another Linux kernel flaw that may let local attackers gain root access on vulnerable systems.
New HTTP/2 Bomb DoS Attack Hits Nginx, Apache, IIS, Envoy, and Pingora
A new HTTP/2 Bomb DoS attack can exhaust memory on major web servers, causing denial-of-service in seconds.
CIFSwitch Vulnerability Exposes Some Linux Distros to Local Root Access
The flaw affects the boundary between the Linux CIFS client and cifs-utils, allowing local root access on some systems.