Loading story…
Security guidance and detection content highlighted a Linux privilege-escalation path in which attackers abuse sudo controls and package-management commands to gain root-level execution. MITRE ATT&CK documents how adversaries can exploit cached sudo credentials, permissive sudoers settings such as NOPASSWD, and configuration options including timestamp_timeout and tty_tickets to run privileged commands without re-authenticating; malware has also been observed modifying /etc/sudoers to weaken terminal-specific protections.
Splunk separately published, and later replaced with a broader analytic, a detection for suspicious use of sudo with apt-get, particularly command lines containing APT::Update::Pre-Invoke, which can be abused to execute arbitrary commands as root. The analytic relied on EDR process telemetry and was intended to surface behavior that, if malicious, could provide full root access and lead to broader system compromise, though Splunk noted the possibility of false positives.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection analytic "Linux apt-get Privilege Escalation" from its content library in version 5.24.0 and replaced it with the broader "Linux APT Privilege Escalation" analytic.
MITRE ATT&CK published the Enterprise sub-technique T1548.003 covering abuse of sudo and sudo credential caching for privilege escalation on Linux and macOS.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple public GitHub repositories published proof-of-concept code and lab material for **CVE-2025-32463**, a local privilege-escalation flaw in `sudo` that attackers claim can be abused to gain **root** on vulnerable Linux systems. The repositories describe exploitation paths involving `sudo -R` and `sudo chroot`, with one project explicitly advertising root escalation without requiring `gcc`, lowering the barrier for hands-on abuse and testing. The disclosures revive long-running concerns around `sudo` and shell-related privilege boundaries. Earlier `sudo` hardening addressed environment-variable abuse in Bash-based scripts under **CVE-2004-1051**, where variables such as `PS4` and `SHELLOPTS` could trigger attacker-controlled command execution, while the **Shellshock** era showed how incomplete Bash fixes could leave similar parser-driven attack paths exposed. Together, the references show a recurring pattern: privileged execution paths that interact with shell behavior or environment handling remain high-value targets, and newly published PoCs for `sudo` flaws can quickly turn theoretical local bugs into practical root-compromise risks.
Jun 29, 2026
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Two vulnerabilities in **Sudo**—`CVE-2025-32462` and `CVE-2025-32463`—were disclosed as affecting a wide range of Unix and Unix-like platforms, including **RHEL**, **CentOS**, **AlmaLinux**, **openSUSE**, **Ubuntu**, **Fedora**, **Debian**, **Arch Linux**, **FreeBSD**, **NetBSD**, **Oracle Linux**, and **macOS Sequoia** for one of the issues. The more severe flaw, `CVE-2025-32463`, carries a **CVSS 9.3** rating and can allow local privilege escalation to **root** through Sudo’s `chroot`-related behavior, while `CVE-2025-32462` is a lower-severity issue tied to specific `sudoers` host-matching configurations that can still permit unauthorized command execution as root.
Jul 24, 2026