Loading vulnerability…
CVE-2026-35369 is an argument parsing flaw in the kill utility of uutils coreutils (uu_kill). In affected versions, invoking kill -1 is incorrectly interpreted as a request to send the default signal, SIGTERM, to process ID -1, rather than recognizing -1 as a signal-number argument that still requires a target PID. On POSIX systems, signaling PID -1 causes the kernel to send the signal to all processes visible to the caller, except for implementation-specific exclusions. GNU coreutils correctly treats -1 in this context as a signal specifier and reports a missing PID argument instead. The flaw is therefore a logic/validation error in command-line argument handling that can transform an ambiguous or malformed invocation into a destructive mass-signal operation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
kill -1 may be misparsed. Prefer GNU coreutils kill or a patched uutils release. Operationally, avoid ambiguous kill invocations using bare negative numeric arguments; require explicit signal syntax and explicit PID operands in scripts and administrative procedures. Where feasible, restrict use of the affected utility by privileged accounts until patched.Patch, then assume compromise.
cae94028. Ensure the parser treats -N correctly as a signal-number form and requires an explicit PID operand before any signal is sent.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.