🕵️ RESEARCH & DEEP DIVES
Public Exploit Released for Unpatched Ubuntu AF_UNIX Container Escape Flaw CVE-2026-80521
CVE-2026-80521
A public exploit has been released for an unpatched Ubuntu Linux kernel flaw that enables container escape to host root.- Affects Ubuntu 26.04, 24.04, and 22.04 LTS (including AWS, Azure, GCP kernels); no fix has shipped on any affected release
- CVE-2026-80521 (CVSS 7.8) is a use-after-free in the kernel's AF_UNIX socket garbage collector, introduced in kernel 6.10 and backported to 6.1 and 6.6
- Exploit uses ordinary system calls allowed in Docker/Kubernetes seccomp profiles, bypassing namespace isolation, cgroup limits, and seccomp filtering
- Fixed upstream August 6 in mainline kernel 7.2 and stable 7.1.10; DepthFirst released working exploit code targeting Ubuntu 26.04
- Flaw found by DepthFirst's AI model dfs-large1; independently reported by an OpenAI researcher; no confirmed in-the-wild attacks
Corp MDM Android spyware targeting logistics firms distributed via fake Google Play pages
Researchers detailed Corp MDM, an Android spyware implant distributed to logistics companies through fake Google Play pages that steals SMS messages and diverts calls.- Targets logistics sector, with lures branded as CEVA and TKW Logistics; part of a wider campaign including credential phishing and Windows malware with Armenian and Russian links
- The implant, package com.corp.mdm disguised as 'System Service', exfiltrates newly received SMS content and enables call forwarding via USSD; it lacks broader surveillance features and contains bugs
- Delivered via fake Google Play replica pages on playgoogle[.]logisticstkwcargo[.]com and playgoogle[.]ceva-app[.]help, prompting users to sideload an APK and grant SMS/phone permissions behind a fake setup screen
- Hides from launcher and recents, persists via START_STICKY service and boot receiver, and communicates over cleartext HTTP to hardcoded C2 IP 69.55.61[.]82 (TCP port 3456 operator panel)
- APK SHA-256: 61954bab16df91e7a1c940a2bdd5a5cf3c61b529a7c75a5ff21ac78f15c61a86; signing cert fingerprint 29f0f6c51fda728b91aaa299cf14758f01d7d83e941a549e26b8fbf2eb70fc42
Fake Wavel crypto wallet site delivers new PamStealer variant targeting Mac passwords
A fake multichain crypto wallet download is spreading a new PamStealer variant that steals Mac login passwords and browser credentials.- Targets Mac users via a fake 'Wavel' multichain crypto wallet website (wavel[.]app) offering a malicious disk image (Wavel.dmg).
- Steals the Mac login password via a fake password prompt, Keychain items, and credential databases from 17 browsers, plus system details and shell history.
- Disk image contains a compiled script with a hidden extension that runs in Script Editor; a background script fetches a decryption tool and live server key exchange to unpack the encrypted payload, hindering offline analysis.
- New Swift-based stealer (third PamStealer variant) installs as 'Finder.app' with LaunchAgent persistence (com.apple.finder.agent) and repair mechanisms; IOCs include wavel.apple03cloudstore[.]com and script hash ed980f2fa0642b1a5ba0bca65f5b3baee8a7b3f5d149bf295aa4ac7a70b92cec.
Sources 📄 Source: jamf.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Fake CAPTCHA lures rotate domains but share one Seychelles-registered hosting network (AS202412)
ActiveSOC traced four fake-CAPTCHA malware chains over five months to a shared Seychelles-registered hosting network whose lure domains keep changing.- ActiveSOC analysts reviewing ~150 alerts across monitored environments found four attack chains reaching command execution; most contacts stopped at the lure page.
- Outcomes varied: one chain installed a reboot-persistent stealer, another a Node.js implant active for nearly two days, and one contacted a cloud storage bucket with no confirmed second stage.
- Victims mostly reached fake CAPTCHA pages via online ads (one via emailed short link); the page copied a command to the clipboard and told users to paste it into the Windows Run box.
- The common link was hosting network AS202412, registered in the Seychelles, with at least seven entry IPs across six ranges; one IP hosted 12 lure domains observed in telemetry plus 11 more in public scan data.
- Some lures used compromised retail/restaurant sites with injected scripts; one implant resolved its command server via blockchain lookup; IOCs include 178.16.52[.]101, 158.94.208[.]213, 193.202.84[.]17, and domains like auth-id-browser[.]info and enter-code-cdn[.]info.
Android 17 enables certificate transparency by default, breaking custom CA traffic interception
Android 17 now requires certificate transparency for system-trusted certificates, breaking custom CA-based traffic interception.- Applies to apps targeting Android API 37 running on Android 17 devices; API 37 targeting becomes mandatory on Play Store by August 2027.
- System-store CA certificates without certificate transparency (SCTs) will no longer be trusted by default, breaking MitM proxies, AdGuard, and security research tooling that rely on custom CAs.
- Interception requires generating a CA certificate and adding it to the system trust store via root access; CT enforcement means locally generated certs fail validation unless they include valid CT proofs.
- Android 17 rolled out from June 2026 (Pixel first, Samsung Galaxy Z shipped with it in August, other OEMs from early September).
- Continues a trend of tightening certificate configuration since Android 7 (user CAs untrusted by default), Android 11 (no install prompts), and Android 14 (certs moved to immutable APEX module).
📋 ADVISORIES
- UPDATE: cPanel Flaws Let Hosting Account Holders Run Code as Root and Modify Other Accounts' Databases
cPanel has patched three flaws, including one letting any logged-in hosting account run code as root.- Affects cPanel & WHM version 120 and later (CalDAV/CardDAV flaws) and WP Toolkit 6.11.2-10794 and older (database flaw) on shared hosting servers.
- CVE-2026-87899 lets any logged-in account holder execute code as root and take full server control; CVE-2026-68490 lets a local user read other accounts' calendar events and contacts.
- CVE-2026-87900 in WP Toolkit's database creation handling lets a logged-in cPanel user modify databases belonging to other accounts.
- Fixed in cPanel builds 11.134.0.57, 11.136.0.41, 11.138.0.8, WP Squared 11.138.1.11, and WP Toolkit 6.11.3; no workaround is offered.
- Flaws were reported by researcher Ali Mustafa (rz1027); no exploitation reported and not in CISA's KEV catalog as of September 23.
🔓 CVEs & KEV
CVE-2026-19599 — Zohocorp ManageEngine OpManager — CVSS 9.9 — Remote Code Execution vulnerabilityZohoCorp ManageEngine OpManager MSP versio...
CVE-2026-75825 — Zohocorp ManageEngine OpManager — CVSS 8.8 — Authentication Bypass vulnerabilityZohoCorp ManageEngine OpManager versions 1...
CVE-2026-76978 — Zohocorp ManageEngine OpManager — CVSS 8.8 — Command Injection vulnerabilityZohoCorp ManageEngine OpManager and Firewall A...
CVE-2026-75791 — Zohocorp ManageEngine ADSelfService Plus — CVSS 8.6 — Authentication bypass vulnerabilityZohocorp ManageEngine ADSelfService Plus v...
CVE-2026-84787 — Zohocorp ManageEngine OpManager — CVSS 8.1 — Privilege Escalation vulnerabilityZohoCorp ManageEngine OpManager and Firewal...
CVE-2026-76979 — Zohocorp ManageEngine OpManager — CVSS 7.7 — XML Injection vulnerabilityZohoCorp ManageEngine OpManager and Firewall Analy...
CVE-2026-15358 — Zohocorp ManageEngine OpManager — CVSS 7.5 — Path Traversal VulnerabilityZohoCorp ManageEngine OpManager and Network Confi...
CVE-2026-95676 — WatchGuard AuthPoint Authentication Gateway — CVSS 7.4 — AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Au...
CVE-2026-76980 — Zohocorp