privilege escalation

CVE-2026-46300 Fragnesia Linux Kernel KEV Due Oct 31 (PHP2Shell Chain)

Fragnesia Is on KEV, and It Is the Root Half of the PHP2Shell Chain

Cybersecsloth Editorial5 days ago04 mins

Shared-frag marker lost during skb coalescing, ESP decrypts into the page cache, root via PAM. CISA due date is today. PHP patched is not kernel patched.

Read Full News

noPac Lab: CVE-2021-42278 + CVE-2021-42287 Domain Admin Walkthrough

noPac Never Died: Domain User to Domain Admin in Four Commands (CVE-2021-42278 + CVE-2021-42287)

Cybersecsloth Editorial2 weeks ago05 mins

A plain domain user mints a computer account, renames it to a DC, and walks out with krbtgt. The bugs are from 2021 and still anchor 2026 ransomware. Lab repro plus detection.

Read Full News

LXD and MicroCloud CVSS 10: Your Public Certificate Is Now a Password (CVE-2026-112816)

Two Senators Asked Meta Who Watches the Footage From Its Glasses. Answers Due by Thanksgiving

FBI Pins Binance’s $6.43B Theft on TraderTraitor, and the Private Keys Were Never the Problem

Polymarket’s Performance Monitor Became a Wallet Drainer, and the CSP Waved It Through

Hunting the Cursor Marketplace Claude Code Backdoor: svc-telemetry, .smt and a Reverse Tunnel

CVE-2026-98432: A 2015 IPv4 TCP Bug Got a Remote Root Exploit, and Go Turned MPTCP On for You

Cisco ASA and FTD SSL VPN Can Be Remotely Rebooted, and CISA Put the DoS on KEV

GitLab’s CI Regex Compiler Is a CVSS 10.0 RCE, and CISA Just Put It on KEV

Fragnesia Is on KEV, and It Is the Root Half of the PHP2Shell Chain

A CVSS 2.7 ESX Logging Bug Just Landed on CISA KEV Because Spies Used It as a Zero-Day

Fragnesia Is on KEV, and It Is the Root Half of the PHP2Shell Chain

noPac Never Died: Domain User to Domain Admin in Four Commands (CVE-2021-42278 + CVE-2021-42287)