Researchers disclosed and published exploit code for the Linux kernel vulnerability “Bad Epoll” (CVE-2026-46242), which enables local attackers to escalate to full root access on affected Linux and Android systems. The flaw in the epoll subsystem underscores how high-impact kernel issues can be missed despite growing vulnerability discovery. Organizations should prioritize patching, restrict local untrusted access, and review exposure for systems running vulnerable kernels and container hosts.
Source: SecurityWeek
16-year-old Linux KVM flaw “Januscape” enables VM escape and potential host compromise
A newly detailed vulnerability in the Linux KVM hypervisor, dubbed Januscape, can allow guest virtual machines to escape and potentially execute code on the underlying host. Tracked as CVE-2026-53359, the issue is described as a use-after-free condition affecting KVM shadow MMU state across Intel and AMD systems. Cloud operators and virtualization administrators should treat this as urgent: update kernels, tighten tenant isolation assumptions, and monitor for suspicious host-kernel behavior.
Source: Security Affairs
Threat actors weaponize “hidden web prompts” to trick AI agents into making money transfers
Security researchers report active campaigns that use indirect prompt injection—hidden instructions embedded in web pages—to manipulate autonomous AI agents into taking financial actions. Instead of targeting human users directly, the attacks focus on what agents “see” in the browsing context, potentially causing them to trust malicious sites or execute payment workflows. The key takeaway for defenders: treat web content as an untrusted control plane for AI agents and add guardrails around outbound actions and tool usage.
Source: Security Affairs
Armored Likho APT adopts AI-generated malware in campaigns targeting power and government entities
Kaspersky researchers documented a previously unknown APT cluster dubbed Armored Likho (also tracked as Eagle Werewolf) targeting governments and electric power-related organizations across multiple regions. The group runs two parallel tracks—financially motivated intrusions and cyber espionage—leveraging modular RATs and stealer tooling. Their use of AI-generated malware highlights the continuing shift toward faster, more adaptable tooling in targeted attacks.
Source: Security Week
France to stop certifying non–post-quantum-safe encryption (from 2027)
France’s cybersecurity agency ANSSI says it will halt certification of security products that lack quantum-resistant encryption, with the change taking effect from 2027 and strong guidance toward only quantum-safe purchases by 2030. Because ANSSI approval is required for many government and critical infrastructure contexts, the policy effectively forces an accelerated migration away from older cryptographic systems. Organizations supplying or operating in French critical sectors should verify post-quantum readiness and start inventorying where “not-yet-ready” cryptography may block compliance.
Source: Schneier Blog
Microsoft Windows Installer privilege escalation lets low-privileged users delete arbitrary folders (logic flaw)
A newly reported logic vulnerability in the COM interface exposed from msi.dll allows low-privileged users to induce the MSI service to delete arbitrary folders they can access. The technique involves scheduling deletion paths via the TempPackages registry key while noting that the service does not sufficiently validate folder deletion targets. While this is framed as an arbitrary deletion issue, it can still be leveraged for disruption and potentially as a stepping stone in broader compromise chains—making remediation and permission hardening important.
Source: Exodus Intelligence
You May Also Be Interested In...
Canada’s spy agency reports offensive cyber operations against ransomware, extremists, and drug traffickers
Cloud VM escape coverage: Januscape details and mitigation guidance
OpenSSH 10.4 released with multiple security fixes and a post-quantum signature option