Exploitation ongoing with high activity in latest observed window (1 mentions)
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the
quoted inner IPv6 packet, and then passes the clone to icmpv6_send().
The clone still carries the outer packet's inet6_skb_parm in skb->cb.
If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao
remains non-zero after skb_pull(). icmpv6_send() later calls
mip6_addr_swap(), which uses that stale dsthao offset against the quoted
inner packet. A malformed inner destination-options header can then make
the HAO lookup and address swap run past the end of the quoted packet
and corrupt skb_shared_info.
Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the
reply path does not reuse metadata left by the outer IPv6 stack.
🔴 CVE-2026-74597: Linux kernel'in IPv6 tunnel hata işleme mekanizmasında bulunan out-of-bounds write açığı, özel hazırlanmış IPv6/ICMPv6 paketleriyle kernel memory corruption oluşturabiliyor. CVSS: 9.8 Critical.
Açık için NebuSec tarafından CentOS 10 / Linux 6.12.0-264 üzerinde test edilmiş public PoC/exploit yayınlandı.
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-74597-Centos-10-6.12.0-264
Post summary
NebuSec released a public proof‑of‑concept/exploit for CVE‑2026‑74597 that triggers an out‑of‑bounds write leading to kernel memory corruption on CentOS 10 / Linux 6.12.0‑264; the vulnerability scores 9.8 (critical) but no evidence of live exploitation or a patch is reported.
#Analytics#Threat_Research
An analytical review of the main cybersecurity events (Sep 05-12, 2026)
1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
// CVE-2026-15409
2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack
3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md
// Microsoft has failed to properly patch ShieldBreak CVE-2026-69414..
4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln
// CVE-2026-84388
5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1
// CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274
6⃣ Netscaler ADC Exploit
7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
8⃣ GRAYRABBIT One-click backdoor
// One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou
9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks
🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/
// An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
The post catalogs several recent CVEs with accompanying PoC links and evidence of active exploitation, emphasizing the availability of exploit code but lacking details on patches or technical depth.
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs.
- An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled.
- The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100.
- The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available.
VULNERABILITY
CVE-2026-23274
CVE-2026-31659
CVE-2026-31678
CVE-2026-43042
CVE-2026-43074
CVE-2026-43501
CVE-2026-43502
CVE-2026-52912
CVE-2026-52923
CVE-2026-52924
CVE-2026-52929
CVE-2026-52933
CVE-2026-63834
CVE-2026-64560
CVE-2026-68162
CVE-2026-68376
CVE-2026-72137
CVE-2026-72255
CVE-2026-74480
CVE-2026-74581
CVE-2026-74597
CVE-2026-80714
Post summary
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege‑escalation flaw in the RDS zerocopy send path, and noted that public exploits are available while a fix has been committed.
