Loading story…
A new submission tied to CVE-2026-53362 was added to Google's security-research repository through a kernelCTF pull request opened by researcher qwerty-po. The pull request proposes merging a branch named cve-2026-53362 into master and adds 3,525 lines across 31 files, indicating a substantial package of material rather than a minor documentation update.
A corresponding fork and branch maintained by the same researcher shows that default documentation and an exploit were prepared for the CVE, suggesting public proof-of-concept material is being staged for inclusion in the repository. The visible references do not disclose the affected kernel component, exploitation details, or impact, but the submission indicates that exploit code associated with CVE-2026-53362 has been prepared and is awaiting normal repository review steps, including contributor license verification.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A commit in qwerty-po's fork on the cve-2026-53362 branch added default documentation and an exploit. The repository metadata ties this activity to work on CVE-2026-53362.
A pull request titled "kernelCTF: add CVE-2026-53362_lts" was opened in Google's security-research repository by qwerty-po. The PR proposes merging a branch related to CVE-2026-53362 and includes added documentation and an exploit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google's `security-research` repository received kernelCTF-related pull requests tied to Linux kernel vulnerabilities including `CVE-2024-26582`, `CVE-2026-23209`, and a reference to `CVE-2026-23392`. The updates were submitted through GitHub pull requests and include repeated revisions to mitigation material, writeups, and proof-of-concept content, with commit history showing iterative changes such as "final," "update writeup," and "update pocs." One pull request associated with `CVE-2026-23209` also references files named `original.tar.gz` and `exploit.md`, indicating publication of source material and exploit documentation in the repository. The available records do not provide technical specifics on exploitation, affected distributions, or patch guidance, but they show active disclosure and documentation work around kernelCTF targets in Google's public research repository. For defenders, the appearance of exploit notes and PoC-related updates in a widely watched security-research project is a signal to track the cited CVEs closely, validate kernel exposure, and review vendor advisories and mitigation status for impacted Linux environments.
Jun 29, 2026
`CVE-2026-31431` is a Linux kernel flaw classified as **CWE-669: Incorrect Resource Transfer Between Spheres** that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads. Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists **RHEL 8**, **RHEL 9**, **RHEL 10**, and corresponding `kernel-rt` packages as affected, while **RHEL 6** and **RHEL 7** are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the **"Copy Fail"** technical write-up and proof-of-concept repository, which references testing on **Ubuntu 24.04 LTS**, **Amazon Linux 2023**, **RHEL 10.1**, and **SUSE 16**; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Jun 29, 2026
A GitHub repository called **"exploitarium"**, operated by the account **`bikini`**, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to **35 project folders and 204 tracked files**, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including **PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git,** and some **PHP** builds. Researchers identified **`CVE-2026-55200`** in **libssh2** as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in **`ssh2_transport_read()`** affecting libssh2 through **1.11.1**, with an upstream fix referenced as commit **`97acf3d`**. Because libssh2 is embedded transitively in widely used software such as **curl** and **Git**, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.
Jul 22, 2026