Loading story…
Multiple public GitHub repositories published proof-of-concept code and lab material for CVE-2025-32463, a local privilege-escalation flaw in sudo that attackers claim can be abused to gain root on vulnerable Linux systems. The repositories describe exploitation paths involving sudo -R and sudo chroot, with one project explicitly advertising root escalation without requiring gcc, lowering the barrier for hands-on abuse and testing.
The disclosures revive long-running concerns around sudo and shell-related privilege boundaries. Earlier sudo hardening addressed environment-variable abuse in Bash-based scripts under CVE-2004-1051, where variables such as PS4 and SHELLOPTS could trigger attacker-controlled command execution, while the Shellshock era showed how incomplete Bash fixes could leave similar parser-driven attack paths exposed. Together, the references show a recurring pattern: privileged execution paths that interact with shell behavior or environment handling remain high-value targets, and newly published PoCs for sudo flaws can quickly turn theoretical local bugs into practical root-compromise risks.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
GitHub repositories publishing proof-of-concept or lab material for CVE-2025-32463, a local privilege-escalation issue involving sudo, began appearing publicly. Multiple repositories published exploit or lab content around the start of July 2025, indicating technical details had become broadly available.
By late September 2014, researchers reported that initial fixes for the Bash Shellshock vulnerability were incomplete and could be bypassed. David A. Wheeler warned that deeper parser changes were likely needed, and Norihiro Tanaka demonstrated a bypass using specially named environment variables.
The sudo project disclosed that versions prior to 1.6.8p10 were vulnerable and released a fix in sudo 1.6.8p10. It also advised administrators to remove PS4 and SHELLOPTS in sudoers or enable env_reset as mitigations.
Tavis Ormandy discovered that sudo's environment sanitization could be bypassed when users ran Bash-based shell scripts via sudo, allowing arbitrary command execution through variables such as PS4 and SHELLOPTS. The issue was assigned CVE-2004-1051.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcearstechnica.com
Open sourcesudo.ws
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two vulnerabilities in **Sudo**—`CVE-2025-32462` and `CVE-2025-32463`—were disclosed as affecting a wide range of Unix and Unix-like platforms, including **RHEL**, **CentOS**, **AlmaLinux**, **openSUSE**, **Ubuntu**, **Fedora**, **Debian**, **Arch Linux**, **FreeBSD**, **NetBSD**, **Oracle Linux**, and **macOS Sequoia** for one of the issues. The more severe flaw, `CVE-2025-32463`, carries a **CVSS 9.3** rating and can allow local privilege escalation to **root** through Sudo’s `chroot`-related behavior, while `CVE-2025-32462` is a lower-severity issue tied to specific `sudoers` host-matching configurations that can still permit unauthorized command execution as root.
Jul 24, 2026
A critical security vulnerability, tracked as CVE-2025-32463, has been identified in the Sudo command-line utility used across Linux and Unix-like operating systems. This flaw, which carries a CVSS score of 9.3, allows local attackers to execute arbitrary commands as the root user by exploiting the -R (--chroot) option, even if they are not listed in the sudoers file. The vulnerability affects Sudo versions 1.9.14 through 1.9.17, and was officially disclosed by Stratascale researcher Rich Mirch in June 2025. The issue has existed since the release of Sudo version 1.9.14 in June 2023, and impacts the default configuration, meaning no special sudoers rules are required for exploitation. On July 4, 2025, a proof-of-concept exploit was released by Mirch, and additional exploit code has since circulated publicly, increasing the risk of widespread attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-32463 to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of active exploitation in the wild. CISA has mandated that federal agencies apply official mitigations or discontinue the use of vulnerable Sudo versions by October 20, 2025. The vulnerability is described as an 'inclusion of functionality from an untrusted control sphere,' which can be leveraged for privilege escalation. Sudo is a critical utility that allows system administrators to delegate root-level privileges to unprivileged users while maintaining an audit trail, making this flaw particularly dangerous. The specific exploitation method involves using the -R option to bypass sudoers restrictions and gain root access. While CISA has not detailed the specific incidents or threat actors involved, the active exploitation and public availability of exploit code have heightened the urgency for remediation. Organizations worldwide are urged to update to Sudo version 1.9.17p1 or later to mitigate the risk. The vulnerability's impact is significant due to the widespread use of Sudo in enterprise and government environments. Security advisories emphasize the need for immediate action to prevent unauthorized privilege escalation and potential compromise of critical systems. The disclosure and subsequent exploitation of this flaw underscore the importance of timely patch management and monitoring for unusual privilege escalation attempts on Linux and Unix systems.
Jun 29, 2026
Security guidance and detection content highlighted a Linux privilege-escalation path in which attackers abuse **`sudo`** controls and package-management commands to gain root-level execution. MITRE ATT&CK documents how adversaries can exploit cached `sudo` credentials, permissive `sudoers` settings such as **`NOPASSWD`**, and configuration options including **`timestamp_timeout`** and **`tty_tickets`** to run privileged commands without re-authenticating; malware has also been observed modifying `/etc/sudoers` to weaken terminal-specific protections. Splunk separately published, and later replaced with a broader analytic, a detection for suspicious use of **`sudo`** with **`apt-get`**, particularly command lines containing **`APT::Update::Pre-Invoke`**, which can be abused to execute arbitrary commands as root. The analytic relied on EDR process telemetry and was intended to surface behavior that, if malicious, could provide full root access and lead to broader system compromise, though Splunk noted the possibility of false positives.
Aug 12, 2026