Loading story…
Qubes OS 4.3.2 has been released with security fixes involving the Xen hypervisor and the qvm-copy-to-vm file-copy utility, according to OpenNET reports. The utility flaw is described as potentially allowing code execution in Dom0, Qubes’ privileged administrative domain. However, extensive encoding corruption in the reports prevents reliable confirmation of the vulnerability’s mechanism, prerequisites, and precise impact.
The release also reportedly updates Fedora to version 44 and the Linux kernel to 7.2. Qubes isolates applications and system services in Xen-based virtual machines, making the reported hypervisor and Dom0-related fixes particularly relevant to its security model. Administrators should prioritize reviewing the official release notes and security advisories, confirm affected configurations, and apply the applicable updates.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Qubes OS closed issue #11062 as completed after it reported that admin.backup.Info exposed all qube names without permission filtering. The listing does not identify a fixed package version or report exploitation.
Qubes OS 4.3.2 was released with security fixes involving Xen and qvm-copy-to-vm, alongside updates to Fedora 44 and Linux kernel 7.2. Encoding corruption in the source text prevents reliable determination of the qvm-copy-to-vm vulnerability's precise mechanism and impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
opennet.ru
Open sourceopennet.me
Open sourcequbes-os.org
Open sourcegithub.com
Open sourcesemver.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Qubes OS fixed a vulnerability in `qvm-copy-to-vm` that could let an attacker execute arbitrary commands in the privileged **Dom0** administrative domain through a specially crafted file name. Because Dom0 manages the isolated virtual machines, successful exploitation could result in full compromise of the host’s security boundary. The flaw occurred when the file-transfer utility invoked localized `kdialog` or `zenity` dialogs via `system()` and passed attacker-controlled file and VM names into the command line. Validation did not safely handle certain non-ASCII characters, allowing shell metacharacters such as backticks and dollar signs to reach the shell; the fix is included in `qubes-core-dom0-linux` version **4.3.22**.
Sep 8, 2026
German government CERT advisories disclosed multiple **QEMU** vulnerabilities that affect virtualized environments and could let attackers trigger **denial of service**, expose sensitive information, and in one case manipulate data. One advisory describes a flaw leading to service disruption and information disclosure, while a later notice expands the impact to include **data manipulation**, indicating broader risk to guest or host operations depending on deployment and exposure. The advisories identify QEMU as the affected component and warn that organizations relying on the emulator and virtualization stack may face risks to **availability**, **confidentiality**, and **integrity**. Operators of cloud, server, and lab environments using QEMU should review the relevant vendor guidance and apply available updates or mitigations to reduce the chance of exploitation against virtual machines and supporting infrastructure.
Jun 29, 2026
Ubuntu disclosed mitigation guidance for **CVE-2026-53359** ("**Januscape**"), a Linux kernel local privilege escalation flaw affecting nested virtualization in **KVM** on Intel and AMD `x86_64` systems. The issue impacts Ubuntu releases from **14.04 through 26.04**, and a public proof-of-concept shows that a guest can crash the hypervisor host; Ubuntu warned that, in cloud environments with nested virtualization enabled, exploitation could potentially compromise the host or other tenants. The advisory said the required fix must be applied to the **hypervisor kernel**, while **unprivileged containers are not affected**; however, privileged containers and systems exposing `/dev/kvm` to non-privileged users may face elevated risk. Canonical's Ubuntu CVE tracker lists **CVE-2026-53359** among several high-priority Linux kernel vulnerabilities marked as affecting Ubuntu package families including `linux`, `linux-hwe`, `linux-hwe-5.4`, `linux-hwe-5.8`, and `linux-hwe-5.11`, with fixes noted as resolved upstream in the Linux kernel. Separate Linux security update notices also highlighted active kernel patching activity for other serious flaws, including **CVE-2026-46331**, a `pedit` subsystem privilege-escalation bug with a disclosed proof-of-concept reported to exist in the wild, and **CVE-2026-52951**, a `drm/xe/dma-buf` use-after-free issue that can trigger denial of service; organizations were urged to test and deploy distributor patches from vendors such as Ubuntu and Red Hat.
Jul 14, 2026