Loading story…
A security disclosure revealed that PortProtonQt shipped an insecure custom Polkit rule that allowed local users to bypass authorization checks and gain elevated access to NetworkManager and UDisks2 actions. The rule relied on inspecting a process command line with ps to identify the ppqtos program, enabling attackers to spoof or race the check and then modify system network connections or mount and unmount file systems without proper authorization. The issue affects PortProtonQt 1.3.0 and was reportedly present since 0.1.12.
Upstream fixed the flaw in PortProtonQt 1.3.1, replacing the weak authorization logic so only users in an active local session and a dedicated portprotonqt group can use the additional Polkit actions. The vulnerability was disclosed as CVE-2026-59678, although one advisory also referenced CVE-2026-59676; reporting indicates the practical impact is unauthorized changes to networking and storage state, leading primarily to denial of service and system integrity degradation rather than a confirmed full root compromise.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-22, a public security report disclosed the PortProtonQt local privilege escalation and authentication bypass issue and stated that CVE-2026-59678 had been assigned. One source notes a conflicting mention of CVE-2026-59676 in the report text, but the timeline identifies CVE-2026-59678 as the assigned identifier.
Upstream fixed the vulnerable authorization logic in PortProtonQt 1.3.1, including commit f0ab40a2d, by restricting the extra Polkit actions to users in an active local session who belong to a dedicated portprotonqt group.
The insecure custom Polkit rule that trusted process command-line inspection was reportedly introduced in PortProtonQt version 0.1.12, enabling local users to spoof authorization checks for NetworkManager and UDisks2 actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcesecurity.opensuse.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A local privilege escalation flaw in **PackageKit** tracked as `CVE-2026-41651` allows an unprivileged user to exploit a time-of-check/time-of-use race condition and install or remove arbitrary packages with root privileges. The issue, dubbed **Pack2TheRoot**, affects PackageKit versions `1.0.2` through `1.3.4` and was discovered by Deutsche Telekom’s Red Team during research into Linux privilege-escalation paths. Researchers said exploitability was confirmed on default installations using both `apt` and `dnf` backends, including **Ubuntu, Debian, Rocky Linux, and Fedora**, indicating broad exposure across Linux distributions. PackageKit **1.3.5** fixes the vulnerability, and maintainers said Linux distributors were notified in advance so updates could be prepared before public disclosure. A GitHub Security Advisory, Telekom’s technical write-up, an `oss-sec` disclosure, and a Debian security update were released as patches became available, while some technical details were initially withheld to reduce the risk of immediate weaponization. Because the vulnerable code path dates back more than a decade, the flaw may affect a wide installed base on systems where PackageKit is present and unpatched.
Jul 23, 2026
A high-severity vulnerability tracked as **CVE-2026-54727** affected `proot-distro` versions earlier than **5.1.6**, allowing a crafted restore archive to bypass container isolation in Termux. The flaw was in the restore process for TAR hardlinks: the tool verified that links stayed within the broader containers directory, but did not ensure the hardlink source belonged to the same container being restored. As a result, a malicious archive could create links into another installed container's `rootfs` owned by the same user and copy or expose files across otherwise isolated environments. Reports also described a second weakness in `names.py`, where use of the Python regex anchor `$` instead of `\Z` allowed trailing newline characters in container names, creating potential command-injection or filesystem-confusion risks. The issue was classified as **CWE-668** with CVSS v3.1 `AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`, and maintainers fixed it in **proot-distro 5.1.6** by rejecting hardlinks whose source container does not match the restore target and tightening container-name validation.
Jul 30, 2026
Canonical has patched **CVE-2026-11386**, a critical vulnerability in **Ubuntu Pro Client** / `ubuntu-advantage-tools` that can allow **arbitrary code execution as root**. The flaw stems from unsafe handling of contract server response data when the client writes APT source files, using untrusted fields such as `directives.suites[]` and `directives.aptURL` without proper escaping or newline filtering. Researchers reported that an attacker able to spoof or tamper with the contract response could inject malicious APT configuration entries and abuse the unvalidated `additionalPackages[]` field passed to a root-executed package installation process. Canonical addressed the issue in **USN-8555-1**, assigning the bug a **CVSS 3.1 score of 9.0** and releasing fixes for supported Ubuntu LTS versions in `ubuntu-pro-client` versions **37.3 and later**. The exposure is notable because Ubuntu Pro Client is preinstalled on supported Ubuntu Server releases and auto-attaches by default on some cloud-provider Ubuntu Pro images, potentially widening impact across servers and cloud instances. Canonical said Ubuntu 25.10 was not patched because it is end of life, and advised administrators to update immediately, inspect APT source files for unauthorized entries, verify contract response integrity, and disable the client where patching is not possible.
Jul 18, 2026