LinuxSecurity.com

Seccomp limits which Linux system calls a process can make.

Privilege escalation in a container does not always begin with a new exploit.

Linux containers can be paused, checkpointed, and rebuilt later with CRIU.

A container normally starts under the security rules of the system receiving it.

Kubernetes groups one or more containers into a pod, the basic unit it deploys.

A live Linux distribution runs from removable media, usually a USB drive, without requiring a permanent installation.

CISA has added CVE-2025-39964, a flaw in the Linux kernel’s built-in cryptography interface, to its list of vulnerabilities being used in real attacks.

Security researchers have shown how hidden instructions in an AWS AgentCore support ticket could push an AI agent into running commands as root and exposing a service credential.

The crun container runtime has changed how GPU-enabled workloads launch a key graphics helper.

Linux developers have fixed two memory-safety bugs in the subsystem that lets hardware move data without constant help from the CPU.

Linux developers have fixed two input-system bugs that could expose small pieces of leftover kernel memory to a local program.

Linux developers have fixed an SELinux flaw that could allow a program to make a mapped file executable after SELinux had blocked direct execution.

CISA has added CVE-2026-53266, a Linux kernel flaw in the ebtables bridge firewall, to its list of vulnerabilities known to be exploited.

Most administrators do not think about BIND, browser engines, or cloud kernels until one of them fails.

Linux packet metadata could keep pointing to network headers after the underlying packet had been rebuilt without them.

A Linux eBPF security flaw could cause the kernel to approve a program using an incorrect understanding of the values it would process.

Security researcher Sai Teja Erukude disclosed four alarming Python security flaws between June and August 2026 after combining specialized AI models with automated scanning and manual code review.

Attackers are exploiting a critical Cisco ISE flaw that can open the product’s web management interface without a valid login. Cisco disclosed CVE-2026-76460 on September 16 and traced the problem to the way an ISE API handles authentication. A remote attacker does not need credentials or help from a user. A crafted request is enough to reach the vulnerable interface.

A PowerPC KVM use-after-free could leave the Linux host kernel accessing a nested-guest object after another virtual CPU caused that object to be removed and freed. The upstream Linux correction adds a missing reference that keeps the object alive while KVM invalidates cached address translations.

As of September 17, Red Hat had documented a flaw in a Red Hat Quay build workflow that could expose container registry credentials to code retrieved from a mutable GitHub Action branch. Tracked as CVE-2026-85469, the issue created a software supply chain risk in the workflow used to publish Quay builder images.