Tag
安全研究公司 Calif 披露了一个存在于 OpenBSD 中、可追溯至 37 年前原始 BSD 源码的内核漏洞：共享内存附加计数器（shm_nattch）为有符号 16 位 short，通过反复 fork 可导致整数溢出，结合竞争条件引发的 use-after-free 和一处越界写，最终在启用 KARL/SMAP/SMEP 的情况下实现本地提权至 root。相关补丁已通过 OpenBSD errata 026 和 018 修复。
作者发现自家 TP-Link EAP770 Wi-Fi 7 存在点会静默损坏大文件下载，而 TP-Link 在开箱前就已将该设备 EOL 且不再提供固件更新。由于官方限制无法通过 shell 写入修复，作者最终自己编写了一个内核漏洞利用来获取自己路由器的 root 权限。
A GitHub project provides a web exploit chain for PS5 consoles running firmware 7.00 to 13.60, intended for educational and security research purposes.
Proof of concept for a Linux local privilege escalation and container/jail escape via an IPv6 fragmentation bug in the kernel, targeting CentOS/RHEL 10.
A single faulty character in the Linux kernel introduced a use-after-free vulnerability (CVE-2026-53111) allowing unprivileged users to escalate privileges to root on Debian and Ubuntu systems; the bug has been fixed and backported.
Hanno Böck discusses recent kernel exploits affecting the ESP (IPSEC) module and suggests disabling IPSEC-related kernel config options to reduce attack surface, highlighting how many unused kernel modules are loaded by default.
YellowKey is a proof-of-concept exploit that bypasses BitLocker encryption on Windows 11 by leveraging a vulnerability in the Windows Recovery Environment, allowing unrestricted access to protected volumes.
CVE-2026-31431 (Copy Fail) is a local privilege escalation vulnerability in the Linux kernel affecting all major distributions since 2017, allowing unprivileged users to gain root shell access through a deterministic 4-byte write to any readable file's page cache via the AF_ALG crypto subsystem.