Loading story…
Canonical has patched CVE-2026-11386, a critical vulnerability in Ubuntu Pro Client / ubuntu-advantage-tools that can allow arbitrary code execution as root. The flaw stems from unsafe handling of contract server response data when the client writes APT source files, using untrusted fields such as directives.suites[] and directives.aptURL without proper escaping or newline filtering. Researchers reported that an attacker able to spoof or tamper with the contract response could inject malicious APT configuration entries and abuse the unvalidated additionalPackages[] field passed to a root-executed package installation process.
Canonical addressed the issue in USN-8555-1, assigning the bug a CVSS 3.1 score of 9.0 and releasing fixes for supported Ubuntu LTS versions in ubuntu-pro-client versions 37.3 and later. The exposure is notable because Ubuntu Pro Client is preinstalled on supported Ubuntu Server releases and auto-attaches by default on some cloud-provider Ubuntu Pro images, potentially widening impact across servers and cloud instances. Canonical said Ubuntu 25.10 was not patched because it is end of life, and advised administrators to update immediately, inspect APT source files for unauthorized entries, verify contract response integrity, and disable the client where patching is not possible.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Canonical released fixes in USN-8555-1 on July 16, 2026 for CVE-2026-11386, a critical Ubuntu Pro Client / ubuntu-advantage-tools vulnerability that could allow arbitrary code execution as root via malicious APT directive and package injection. The fixes covered supported Ubuntu LTS releases, while Ubuntu 25.10 was not patched because it was end of life.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Bishop Fox** confirmed that multiple flaws in **Ubiquiti UniFi OS Server** can be chained into **unauthenticated remote code execution** that yields full **root** access on exposed systems. The attack combines an authentication bypass and path traversal in the Nginx/`unifi-core` request flow—tracked as `CVE-2026-34908` and `CVE-2026-34909`—with a command injection bug in the `package-update` service, `CVE-2026-34910`, and can be triggered through a reachable web request against internet-facing management interfaces. Researchers said the chain was validated end-to-end and can also leverage overly permissive sudo rights to complete privilege escalation. Successful exploitation can expose stored secrets, enable forged administrative sessions that may persist after patching, and create downstream risk for managed network gear, door-access systems, and surveillance cameras connected through the platform. Ubiquiti said fixes were released in patched UniFi OS Server versions, including protections such as URI normalization, stricter package-name validation, removal of shell-based backend behavior, and reduced passwordless sudo permissions. Defenders are being urged to patch immediately, rotate credentials and secrets, review systems for signs of prior compromise, and limit or remove public exposure of UniFi management interfaces.
Jun 29, 2026
Multiple critical vulnerabilities in **Ubiquiti UniFi OS** can be chained to give an unauthenticated attacker **remote code execution as root** on exposed devices. Fortinet reported active in-the-wild exploitation of an exploit chain involving `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, combining authentication bypass, path traversal, access to protected resources, and arbitrary command execution. Researchers have publicly demonstrated the chain, raising the risk for organizations that use UniFi OS to manage gateways, network controllers, video surveillance, and access control systems. `CVE-2026-34909` is described as a **CVSS 10.0** path traversal flaw that can expose sensitive files and enable account compromise, while `CVE-2026-34910` is a **CVSS 10.0** command injection bug affecting a wide range of UniFi hardware and the software-only **UniFi OS Server**. Ubiquiti addressed the issues in **Security Advisory Bulletin 064** with firmware updates across product families, including **UniFi OS 5.1.12** for many devices and other fixed releases for NAS, UDM Beast, and UniFi OS Server platforms. Defenders are being urged to patch immediately, limit management interfaces to trusted networks, review internet-exposed systems for compromise, and perform integrity checks because persistence may remain after remediation.
Aug 15, 2026
A local privilege escalation flaw in **PackageKit** tracked as `CVE-2026-41651` allows an unprivileged user to exploit a time-of-check/time-of-use race condition and install or remove arbitrary packages with root privileges. The issue, dubbed **Pack2TheRoot**, affects PackageKit versions `1.0.2` through `1.3.4` and was discovered by Deutsche Telekom’s Red Team during research into Linux privilege-escalation paths. Researchers said exploitability was confirmed on default installations using both `apt` and `dnf` backends, including **Ubuntu, Debian, Rocky Linux, and Fedora**, indicating broad exposure across Linux distributions. PackageKit **1.3.5** fixes the vulnerability, and maintainers said Linux distributors were notified in advance so updates could be prepared before public disclosure. A GitHub Security Advisory, Telekom’s technical write-up, an `oss-sec` disclosure, and a Debian security update were released as patches became available, while some technical details were initially withheld to reduce the risk of immediate weaponization. Because the vulnerable code path dates back more than a decade, the flaw may affect a wide installed base on systems where PackageKit is present and unpatched.
Jul 23, 2026