CuraSec

tag: Ubuntu · 2 items

Act archived Public PoC Released for Unpatched Ubuntu Container Escape (CVE-2026-80521)
2026-09-23 · The Hacker News · source ↗ #container-escape#linux-kernel#ubuntu
  • Engineer — Act: Public PoC exists for a container-to-host-root escape on Ubuntu 22.04/24.04/26.04 LTS — all still unpatched. Apply the upstream kernel fix manually or enforce strict seccomp/AppArmor profiles on all container workloads immediately, and track Ubuntu’s security backport channel for the official LTS patch.
  • SOC/IR — Plan: No evidence of active exploitation yet (EPSS 0.00, not on KEV), but a public PoC makes this a near-term detection priority; build or tune rules for anomalous privilege escalation originating from container processes and AF_UNIX socket abuse before exploitation begins.
  • Leader — Skip
  • Signals: CVE-2026-80521 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
Act archived Ubuntu snap-confine LPE Flaw Gives Local Users Root (CVE-2026-8933)
2026-07-23 · The Hacker News · source ↗ #local-privilege-escalation#ubuntu#linux
  • Engineer — Act: Public PoC on GitHub makes this practical for any attacker with local access on Ubuntu Desktop 24.04, 25.10, or 26.04; patch snap-confine immediately on affected desktop systems and audit cloud VMs or developer workstations running Ubuntu Desktop builds.
  • SOC/IR — Learn: No active exploitation campaign or IOCs reported; file as a post-exploitation step an attacker with foothold could use, but there is no detection hunt to run today without observed in-the-wild activity.
  • Leader — Skip
  • Signals: CVE-2026-8933 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub