LinuxSecurity.com

Most administrators do not think about BIND, browser engines, or cloud kernels until one of them fails.

Linux packet metadata could keep pointing to network headers after the underlying packet had been rebuilt without them.

A Linux eBPF security flaw could cause the kernel to approve a program using an incorrect understanding of the values it would process.

Security researcher Sai Teja Erukude disclosed four alarming Python security flaws between June and August 2026 after combining specialized AI models with automated scanning and manual code review.

Attackers are exploiting a critical Cisco ISE flaw that can open the product’s web management interface without a valid login. Cisco disclosed CVE-2026-76460 on September 16 and traced the problem to the way an ISE API handles authentication. A remote attacker does not need credentials or help from a user. A crafted request is enough to reach the vulnerable interface.

A PowerPC KVM use-after-free could leave the Linux host kernel accessing a nested-guest object after another virtual CPU caused that object to be removed and freed. The upstream Linux correction adds a missing reference that keeps the object alive while KVM invalidates cached address translations.

As of September 17, Red Hat had documented a flaw in a Red Hat Quay build workflow that could expose container registry credentials to code retrieved from a mutable GitHub Action branch. Tracked as CVE-2026-85469, the issue created a software supply chain risk in the workflow used to publish Quay builder images.

A Linux path can be valid when a program checks it and point somewhere else when the program uses it. That gap creates a time-of-check to time-of-use, or TOCTOU race condition, whenever an untrusted process can change part of the directory tree between two separate lookups.

Linux file permissions are usually introduced as a way to decide who may read, write, or execute a file. On a production server, they do something more important: they help decide which lower-privilege users can influence work later performed by root or another privileged service.

Docker has fixed a high-severity Docker Sandboxes vulnerability that allowed a malicious guest to redirect a host-side relay toward Unix sockets outside its authorized workspace. The flaw, CVE-2026-79994, broke a guest-to-host trust boundary even though the sandbox itself ran inside a separate microVM.

Acronis has fixed a high-severity vulnerability in its Linux hosting backup integrations after detecting exploitation in limited, targeted attacks. The Acronis backup flaw, tracked as CVE-2026-87886, lets a low-privileged local user increase privileges on a vulnerable server because of insecure file permissions.

Container security can fail before a workload fully enters its root filesystem, the private file tree the container is meant to see.

SMB, or Server Message Block, lets Linux systems access files shared over a network.

Transparent huge pages let Linux manage memory in larger blocks for better performance.

eBPF lets verified programs run inside the Linux kernel. Linux eBPF security depends on supporting data remaining available for as long as those programs can use it.

On September 10, 2026, Wiz Research reported that multiple attackers had chained two Artifactory vulnerabilities against self-hosted repositories. One flaw gave an unauthenticated caller an internal anonymous token. The other let that caller exchange the limited token for administrator rights. Wiz observed the resulting access being used to create persistent administrators, load hostile Groovy plugins, place web shells, and install Rust backdoors.

Linux virtualization lets a physical host run guest virtual machines. A fix in vhost, the Linux component that helps those guests exchange data with virtual devices, limits memory consumed by repeated requests for a missing memory mapping.

Confidential computing can protect a virtual machine’s memory from the host that runs it. A remote client still needs to check that its connection reaches the protected machine. Transport Layer Security, or TLS, encrypts the connection and checks the service’s identity, but does not by itself verify the machine’s software environment.

A file descriptor is the numbered handle a running program uses to access an open file or similar resource. Linux can mark it to close automatically when the program replaces itself through exec(). That cleanup can involve waiting for a filesystem, which makes its timing important.

A Linux sandbox restricts which files a program can access. Landlock, a kernel facility that lets programs apply those restrictions to themselves, had a bug in the code checking file locations. A concurrent directory move could leave the check reading memory that had already been released.