Loading story…
Pi-hole released v6.4.3 to fix CVE-2026-50130, a high-severity local privilege escalation flaw affecting versions 6.0.0 through 6.4.2. The bug allowed an attacker who already had code execution as the unprivileged pihole user to gain root privileges by replacing /etc/pihole/logrotate, which was later re-owned by root and processed by a root-executed cron workflow. The issue is tracked as CWE-282 and carries a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
The fix moves Pi-hole's logrotate configuration from /etc/pihole/logrotate to /etc/logrotate.d/pihole and updates related scripts, cron jobs, installer logic, debugging routines, and uninstall cleanup to use the new path. Pi-hole said the release also removes use of copytruncate in log rotation and includes additional non-security fixes and dependency updates. The vulnerability was reported by supperhellokitty20 and is referenced in GHSA-h8w9-qx2v-wrww.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-50130 was publicly documented as a local privilege escalation vulnerability affecting Pi-hole versions 6.0.0 through 6.4.2. The entry describes how a user with code execution as the unprivileged pihole user could replace /etc/pihole/logrotate and later gain root privileges through a root-executed cron workflow.
Pi-hole released version 6.4.3 as a security update fixing a high-severity local privilege escalation vulnerability that allowed escalation from the pihole user to root via /etc/pihole/logrotate. The release notes say the issue was reported by supperhellokitty20 and reference GitHub Security Advisory GHSA-h8w9-qx2v-wrww.
A Pi-hole GitHub commit changed the logrotate configuration path from /etc/pihole/logrotate to /etc/logrotate.d/pihole and updated related scripts, cron entries, installer behavior, and cleanup logic. This code change is the fix associated with the later-disclosed privilege escalation issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pi-hole disclosed two high-severity remote code execution vulnerabilities in its FTLDNS component, tracked as **CVE-2026-35518** and **CVE-2026-35520**, affecting `pihole-FTL` versions **6.0 through before 6.6**. The flaws let an authenticated attacker inject arbitrary `dnsmasq` configuration directives through newline characters in the `dns.cnameRecords` and `dhcp.leaseTime` configuration parameters, which can result in command execution on the underlying system. Both issues carry a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating low-complexity network exploitation with high impact to confidentiality, integrity, and availability once authenticated access is obtained. The vulnerabilities are mapped to **CWE-78** and **CWE-93**, and Pi-hole fixed both in **version 6.6**; one related advisory is published as **GHSA-28g5-gg88-wh5m**.
Jun 29, 2026
HP has fixed two serious vulnerabilities in **HP Linux Imaging and Printing Software (HPLIP)** affecting versions earlier than **`3.26.4`**, including a critical flaw that could enable remote arbitrary code execution and a high-severity issue that could lead to local privilege escalation. HP published the advisory **`HPSBPI04118`** and released **HPLIP `3.26.4`** as the patched version. The most severe issue, **`CVE-2026-8631`**, is an integer buffer overflow in the **`hpcups`** print request processing path that can be exploited remotely and without authentication using specially crafted print data. A second flaw, **`CVE-2026-8632`**, stems from improper neutralization and could be abused by a local low-privileged user through a crafted print request to execute arbitrary commands on the host operating system. Organizations using HPLIP on Linux systems should upgrade to **`3.26.4`** or later immediately.
Jul 24, 2026
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026