CVE-2018-14634Active Exploitation(canonical / big-ip_access_policy_manager)

The CISA has set a deadline of Feb 16 (Monday!) to patch a critical Linux Kernel vulnerability (CVE-2018-14634). Why does this matter for AI? Because 99% of AI infrastructure runs on Linux.From local agents like OpenClaw to massive training clusters, the physical infrastructure is vulnerable to privilege escalation. Stop trusting the machine. Trust the math.DIN’s decentralized architecture means we don't rely on a single central server that can be rooted. Our data validation happens on-chain, cryptographically secured against infrastructure failure. Secure your data supply chain before the weekend starts. 🛡️💻 Source: https://thehackernews.com/2026/01/threatsday-bulletin-new-rces-darknet.html #InfoSec #Linux #CyberSecurity #DIN #Web3 #PatchTuesday

Mutagen Astronomy: From Discovery to CISA Recognition—A Seven-Year Journey: Introduction On January 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2018-14634 to its Known Exploited Vulnerabilities (KEV) catalog. The same… https://blog.qualys.com/vulnerabilities-threat-research/2026/02/02/mutagen-astronomy-discovery-to-kev?utm_source=dlvr.it&utm_medium=twitter https://t.co/KRdO96gbjD

CVE-2018-14634 : MUTAGEN ASTRONOMY LPE ALERT @Linux  A critical Local Privilege Escalation (LPE) vulnerability has been identified in the Linux Kernel, allowing any unprivileged local user to gain complete root access via integer overflow in the ELF binary loader. Risk Severity: Critical (Public exploits available, listed in CISA KEV, active exploitation in multi-tenant environments) Impact:  Immediate elevation to Root privileges Full system compromise & container escape Bypass of user-space security controls (SELinux/AppArmor) Installation of persistent kernel-level rootkits Lateral movement from compromised low-privileged accounts Root Cause:  CWE-190 (Integer Overflow or Wraparound). The create_elf_tables() function in fs/binfmt_elf.c fails to correctly calculate stack size when handling massive environment variables. This overflow leads to memory corruption, overwriting the auxiliary vector and SUID execution paths. Attackers can:  Execute SUID-root binaries with crafted environment variables (approx 2^31 entries) Trigger stack overflow to overwrite execution flow Escalate from standard user to Root instantly Bypass sandboxing and container isolation Establish persistence deep within the kernel Are You Affected?  Vulnerable: Linux kernels 2.6.x, 3.10.x, and 4.14.x Scope: RHEL/CentOS 7, Ubuntu 16.04/18.04, Debian 9, and legacy enterprise infrastructure. Immediate Action Required:  Update: Upgrade to kernel 4.15+, or apply distro-specific security patches (e.g., RHEL 3.10.0-957.27.2.el7) Mitigation: Restrict stack size and process limits via /etc/security/limits.conf Audit: Monitor logs for SUID binary execution with abnormal environment variable counts (envc > 1000) Don't let a low-level shell become a root disaster. Patch your kernels now.🛡️ #linux #security #ostorlabCVE

CISA nimmt nach 7 Jahren ausgenutzte Schwachstelle in KEV auf https://ift.tt/PVCYiS0 Am 26. Januar 2026 war es endlich soweit: Obwohl die Qualys-Experten seit 2018 auf die Schwachstelle CVE-2018-14634 in Red Hat Enterprise Linux und CentO immer wieder hingewiesen haben, land…

#threatreport #MediumCompleteness January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day | 24-02-2026 Source: https://www.recordedfuture.com/blog/january-2026-cve-landscape Key details below ↓ 🧑‍💻Actors/Campaigns: Fancy_bear Neusploit 💀Threats: Nuclei_tool, Minidoor, Pixynetloader, Covenant_c2_tool, Grunt, Com_hijacking_technique, Supply_chain_technique, 🎯Victims: Enterprise communication platforms, Enterprise management platforms, Government users, Business users, Wordpress sites, Email systems 🏭Industry: Government 🌐Geo: Russian 🔓CVEs: CVE-2026-23760 \[[Vulners](https://vulners.com/cve/CVE-2026-23760)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9511) CVE-2025-34026 \[[Vulners](https://vulners.com/cve/CVE-2025-34026)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - versa-networks concerto (<12.1.2, 12.2.0) CVE-2009-0556 \[[Vulners](https://vulners.com/cve/CVE-2009-0556)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - microsoft office_powerpoint (2004) - microsoft powerpoint (2000, 2002, 2003) CVE-2025-8110 \[[Vulners](https://vulners.com/cve/CVE-2025-8110)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - gogs (le0.13.3) CVE-2026-24423 \[[Vulners](https://vulners.com/cve/CVE-2026-24423)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9511) CVE-2025-68645 \[[Vulners](https://vulners.com/cve/CVE-2025-68645)] - CVSS V3.1: *8.8*, - Vulners: Exploitation: True Soft: - synacor zimbra_collaboration_suite (<10.0.18, <10.1.13) CVE-2018-14634 \[[Vulners](https://vulners.com/cve/CVE-2018-14634)] - CVSS V3.1: *7.8*, - Vulners: Exploitation: True Soft: - paloaltonetworks pan-os (<7.1.23, <8.0.16, <8.1.7) CVE-2026-21509 \[[Vulners](https://vulners.com/cve/CVE-2026-21509)] - CVSS V3.1: *7.8*, - Vulners: Exploitation: True Soft: - microsoft 365_apps (-) - microsoft office (2016, 2019) - microsoft office_long_term_servicing_channel (2021, 2024) CVE-2025-37164 \[[Vulners](https://vulners.com/cve/CVE-2025-37164)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: True Soft: - hpe oneview (le10.20.00) CVE-2026-1340 \[[Vulners](https://vulners.com/cve/CVE-2026-1340)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - ivanti endpoint_manager_mobile (le12.7.0.0) CVE-2026-1281 \[[Vulners](https://vulners.com/cve/CVE-2026-1281)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - ivanti endpoint_manager_mobile (le12.5.0.0, 12.5.1.0, 12.6.0.0, 12.6.1.0, 12.7.0.0) CVE-2026-20045 \[[Vulners](https://vulners.com/cve/CVE-2026-20045)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - cisco unified_communications_manager (<14su5, le15su3a) - cisco unified_communications_manager_im_and_presence_service (<14su5, le15su3a) - cisco unity_connection (<14su5, le15su3) CVE-2026-20931 \[[Vulners](https://vulners.com/cve/CVE-2026-20931)] - CVSS V3.1: *8.0*, - Vulners: Exploitation: Unknown Soft: - microsoft windows_10_1607 (<10.0.14393.8783) - microsoft windows_10_1809 (<10.0.17763.8276) - microsoft windows_10_21h2 (<10.0.19044.6809) - microsoft windows_10_22h2 (<10.0.19045.6809) ... CVE-2026-20805 \[[Vulners](https://vulners.com/cve/CVE-2026-20805)] - CVSS V3.1: *5.5*, - Vulners: Exploitation: True Soft: - microsoft windows_10_1607 (<10.0.14393.8783) - microsoft windows_10_1809 (<10.0.17763.8276) - microsoft windows_10_21h2 (<10.0.19044.6809) - microsoft windows_10_22h2 (<10.0.19045.6809) ... CVE-2025-52691 \[[Vulners](https://vulners.com/cve/CVE-2025-52691)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: True Soft: - smartertools smartermail (<100.0.9413) CVE-2025-31125 \[[Vulners](https://vulners.com/cve/CVE-2025-31125)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - vitejs vite (<4.5.11, <5.4.16, <6.0.13, <6.1.3, <6.2.4) CVE-2026-24858 \[[Vulners](https://vulners.com/cve/CVE-2026-24858)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - fortinet fortianalyzer (le7.0.15, le7.2.11, <7.4.10, <7.6.6) - fortinet fortimanager (le7.0.15, le7.2.11, <7.4.10, <7.6.6) - fortinet fortiproxy (le7.0.22, le7.2.15, le7.4.12, le7.6.4) - fortinet fortiweb (le7.4.11, le7.6.6, le8.0.3) ... CVE-2025-54313 \[[Vulners](https://vulners.com/cve/CVE-2025-54313)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: True Soft: - prettier eslint-config-prettier (8.10.1, 9.1.1, 10.1.6, 10.1.7) CVE-2025-40551 \[[Vulners](https://vulners.com/cve/CVE-2025-40551)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - solarwinds web_help_desk (<2026.1) CVE-2026-20029 \[[Vulners](https://vulners.com/cve/CVE-2026-20029)] - CVSS V3.1: *4.9*, - Vulners: Exploitation: Unknown CVE-2026-23550 \[[Vulners](https://vulners.com/cve/CVE-2026-23550)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: Unknown CVE-2026-23800 \[[Vulners](https://vulners.com/cve/CVE-2026-23800)] - CVSS V3.1: *10.0*, - Vulners: Exploitation: Unknown CVE-2024-37079 \[[Vulners](https://vulners.com/cve/CVE-2024-37079)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - vmware cloud_foundation (<5.2) CVE-2026-24061 \[[Vulners](https://vulners.com/cve/CVE-2026-24061)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - gnu inetutils (le2.7) 🤖LLM extracted TTPs:` T1005, T1027, T1053.005, T1071.001, T1078, T1090, T1098, T1112, T1114.003, T1133, ... 🧨IOCs: - Path: 2 - Registry: 1 - IP: 6 - Email: 4 - File: 2 💽Software: Microsoft Office, Ivanti, Linux, Zimbra Collaboration Suite, WordPress, Outlook, Ivanti EPMM 🔢Algorithms: xor 📜Programming Languages: php #threatreport: In January 2026, there was a noted 5% increase in critical vulnerabilities, with 23 high-impact issues identified. Among these, the exploitation of a significant Microsoft Office zero-day vulnerability (CVE-2026-21509) by Russian state-sponsored group APT28 highlighted ongoing threats to enterprise technologies. This vulnerability, which relates to the reliance on untrusted inputs in security decisions, enabled APT28 to utilize weaponized Rich Text Format (RTF) files to deliver various malicious implants, including MiniDoor, PixyNetLoader, and Covenant Grunt. The exploitation chain initiated with an RTF file that bypassed Office OLE mitigations. The attackers deployed MiniDoor as an Outlook VBA script for email collection, while PixyNetLoader, which created a mutex for persistence, allowed further attacks. A notable aspect of this operation was the use of geography-based evasion to limit the delivery of the malicious payloads, demonstrating the sophistication of the APT28 attacks. In addition to Microsoft, other vendors such as SmarterTools and Ivanti were significantly affected, with SmarterTools reporting multiple critical vulnerabilities allowing authentication bypass and remote code execution (RCE). Specifically, CVE-2026-23760 identified a privilege escalation flaw in SmarterMail, permitting unauthenticated users to reset passwords, demonstrating serious flaws in expected security protocols. Furthermore, the Modular DS WordPress plugin was found to have multiple vulnerabilities, CVE-2026-23550 and CVE-2026-23800, that allowed attackers to gain administrator access without authentication. These vulnerabilities emphasize the risk of widespread exploitation due to the centralized management of multiple WordPress sites.

#CISA added CVE-2018-14634 (“#MutagenAstronomy”) to its Known Exploited Vulnerabilities (#KEV) catalog, marking the seventh Qualys #ThreatResearchUnit (TRU) discovery to join the list. This mandates federal action on the Local Privilege Escalation flaw. https://sprou.tt/1PoEKTVHtud

🚨 “Mutagen Astronomy” Linux LPE (CVE-2018-14634) Added to CISA KEV After 7-Year Trail Qualys explains how CVE-2018-14634 (a Linux local privilege escalation via integer overflow in create_elf_tables() when processing excessive args/env strings) was added to CISA’s KEV on Jan 26, 2026, confirming real-world exploitation. Prioritize patching multi-user and internet-facing systems with authenticated access, and update base images/templates/containers to prevent reintroducing the vulnerable build. 🎯 Target: Global/Linux (Enterprise distros incl. RHEL/CentOS) #️⃣ Category: #Vulnerability #BlueTeam #CyberIntel 🔗 URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/02/02/mutagen-astronomy-discovery-to-kev

CISA adds Mutagen Astronomy (CVE-2018-14634) to the KEV Catalog—validating a Qualys TRU discovery &amp; mandating federal action on this Linux privilege escalation flaw. Proof that old vulns still drive real risk. Details at https://bit.ly/3ZebKDa #CISA #KEV #ThreatResearch #TRU https://t.co/vwn6YqNbpv

🚨 CISA Adds Exploited Microsoft Office, Linux Kernel, Telnetd, and SmarterMail Flaws to KEV — Feb 16 Patch Deadline CISA added five vulnerabilities (CVE-2026-21509, CVE-2018-14634, CVE-2026-24061, CVE-2025-52691, CVE-2026-23760) to the KEV catalog, requiring U.S. federal agencies to remediate by Feb 16, 2026—raising urgency for everyone because these bugs include actively exploited Office bypass, Linux privesc, telnetd argument injection, and unauth SmarterMail file-upload RCE. 🎯 Target: USA/Federal + Global (Microsoft Office, Linux, SmarterMail operators) #️⃣ Category: #Vulnerability #CyberLaw #BlueTeam 🔗 URL: https://www.scworld.com/brief/cisa-adds-critical-microsoft-office-linux-kernel-and-smartermail-vulnerabilities-to-kev-catalog