CuraSec

tag: Virtualization · 2 items

Act archived CVE-2026-89775: Linux KVM ARM64 Guest-Escape via Use-After-Free
2026-09-22 · The Hacker News · source ↗ #linux-kernel#virtualization#guest-escape
  • Engineer — Act: A public PoC on GitHub for a guest-to-host escape on ARM64 KVM hosts with nested virtualization enabled demands immediate attention: patch the Linux kernel to the fixed version and, where nested virtualization is not required, disable it now to remove the attack surface.
  • SOC/IR — Learn: No active exploitation is reported and EPSS is effectively zero, so there is no detection action to take today; however, understanding the KVM guest-escape technique is worth filing for future hunt hypothesis development should exploitation emerge.
  • Leader — Skip
  • Signals: CVE-2026-89775 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
Plan archived Active Scanning Targets EOL Proxmox VE 7 Vulnerability
2026-09-10 · SANS ISC · source ↗ #virtualization#vulnerability#scanning
  • Engineer — Plan: If your environment includes any Proxmox VE 7 instances, treat them as actively targeted and prioritize upgrading to a supported version; v7 has been EOL for years and will receive no patches for this or future issues.
  • SOC/IR — Learn: Opportunistic scanning is occurring against Proxmox VE 7 hosts, but no IOCs or specific exploit TTPs are published yet — worth noting for asset-aware alerting if Proxmox is in scope, but no detection action warranted now.
  • Leader — Skip