Loading story…
Raspberry Pi has changed the default privilege model in Raspberry Pi OS 6.2, disabling passwordless sudo for new installations of the Debian Trixie-based release. Users must now enter their current account password when running administrative actions in the terminal or through certain desktop workflows, a move the company said is intended to reduce the risk that someone with physical or local access to a device could gain administrative control without authentication. After a successful prompt, sudo access remains cached for five minutes.
The update does not retroactively change existing systems: devices already running Raspberry Pi OS will continue to have passwordless sudo enabled unless users modify the setting themselves. Raspberry Pi said the behavior can still be reverted on new installs through the Control Centre by turning off the Admin Password option, preserving an easier workflow for users who prefer the previous default.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Coverage of the update noted that the passwordless sudo change does not modify existing Raspberry Pi OS installations, where passwordless sudo remains enabled unless users manually change it. This clarified the scope and impact of the security update following Raspberry Pi's announcement.
Raspberry Pi said Raspberry Pi OS 6.2, based on Debian Trixie, disables passwordless sudo by default on new installations to reduce the risk of unauthorized administrative actions by anyone with device access. Under the new behavior, users must enter their account password for sudo, with authentication cached for five minutes, and the setting can be reverted through Control Centre.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public GitHub repositories published proof-of-concept code and lab material for **CVE-2025-32463**, a local privilege-escalation flaw in `sudo` that attackers claim can be abused to gain **root** on vulnerable Linux systems. The repositories describe exploitation paths involving `sudo -R` and `sudo chroot`, with one project explicitly advertising root escalation without requiring `gcc`, lowering the barrier for hands-on abuse and testing. The disclosures revive long-running concerns around `sudo` and shell-related privilege boundaries. Earlier `sudo` hardening addressed environment-variable abuse in Bash-based scripts under **CVE-2004-1051**, where variables such as `PS4` and `SHELLOPTS` could trigger attacker-controlled command execution, while the **Shellshock** era showed how incomplete Bash fixes could leave similar parser-driven attack paths exposed. Together, the references show a recurring pattern: privileged execution paths that interact with shell behavior or environment handling remain high-value targets, and newly published PoCs for `sudo` flaws can quickly turn theoretical local bugs into practical root-compromise risks.
Jun 29, 2026
Pi-hole released **v6.4.3** to fix **CVE-2026-50130**, a high-severity local privilege escalation flaw affecting versions **6.0.0 through 6.4.2**. The bug allowed an attacker who already had code execution as the unprivileged `pihole` user to gain **root** privileges by replacing `/etc/pihole/logrotate`, which was later re-owned by root and processed by a root-executed cron workflow. The issue is tracked as **CWE-282** and carries a **CVSS v3.1** vector of `AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`. The fix moves Pi-hole's logrotate configuration from `/etc/pihole/logrotate` to `/etc/logrotate.d/pihole` and updates related scripts, cron jobs, installer logic, debugging routines, and uninstall cleanup to use the new path. Pi-hole said the release also removes use of `copytruncate` in log rotation and includes additional non-security fixes and dependency updates. The vulnerability was reported by **supperhellokitty20** and is referenced in **GHSA-h8w9-qx2v-wrww**.
Jul 15, 2026
A critical security vulnerability, tracked as CVE-2025-32463, has been identified in the Sudo command-line utility used across Linux and Unix-like operating systems. This flaw, which carries a CVSS score of 9.3, allows local attackers to execute arbitrary commands as the root user by exploiting the -R (--chroot) option, even if they are not listed in the sudoers file. The vulnerability affects Sudo versions 1.9.14 through 1.9.17, and was officially disclosed by Stratascale researcher Rich Mirch in June 2025. The issue has existed since the release of Sudo version 1.9.14 in June 2023, and impacts the default configuration, meaning no special sudoers rules are required for exploitation. On July 4, 2025, a proof-of-concept exploit was released by Mirch, and additional exploit code has since circulated publicly, increasing the risk of widespread attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-32463 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has mandated that federal agencies apply official mitigations or discontinue the use of vulnerable Sudo versions by October 20, 2025. The vulnerability is described as an 'inclusion of functionality from an untrusted control sphere,' which can be leveraged for privilege escalation. Sudo is a critical utility that allows system administrators to delegate root-level privileges to unprivileged users while maintaining an audit trail, making this flaw particularly dangerous. The specific exploitation method involves using the -R option to bypass sudoers restrictions and gain root access. While CISA has not detailed the specific incidents or threat actors involved, the active exploitation and public availability of exploit code have heightened the urgency for remediation. Organizations worldwide are urged to update to Sudo version 1.9.17p1 or later to mitigate the risk. The vulnerability's impact is significant due to the widespread use of Sudo in enterprise and government environments. Security advisories emphasize the need for immediate action to prevent unauthorized privilege escalation and potential compromise of critical systems. The disclosure and subsequent exploitation of this flaw underscore the importance of timely patch management and monitoring for unusual privilege escalation attempts on Linux and Unix systems.
Jun 29, 2026