GoKawiil
Tech News
OpenAI reportedly used an AI-based analysis tool to scan the Linux kernel and identified 948 possible local privilege escalation vulnerabilities, according to Phoronix founder Michael Larabel. The findings point to weaknesses that could let a local user gain elevated system access if left unaddressed.
Dream researchers say they uncovered artifacts from an AI-assisted campaign that combined a custom PHP2Shell exploit chain with a kernel privilege-escalation flaw to compromise firewall devices. The campaign reportedly rooted 25 servers across the US, Japan, Taiwan and South Korea, with three machines in a US government-affiliated network singled out for further attacks on Active Directory, including credential theft and directory enumeration.
Tailscale says its security and engineering teams, aided by outside specialists, have found multiple vulnerabilities in Tailscale SSH, most involving privilege escalation that could let an already-authorized user act beyond their configured permissions. The company has fixed most issues and is targeting a patched client release by the end of Tuesday, October 27, while continuing to assess remaining findings.
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
Security firm Calif reported a decades-old integer overflow bug in OpenBSD's shared memory attachment counter, tracing back to original BSD source code. Combined with a separate out-of-bounds write flaw, attackers could exploit a race condition to achieve local root access even with protections like KARL, SMAP, and SMEP enabled. OpenBSD has since patched both issues through errata 026 and 018.
TeamViewer issued an advisory urging all users to update to version 15.82 after fixing five high-severity vulnerabilities, including an access control bypass that could enable remote code execution and other flaws allowing privilege escalation to SYSTEM or root. The company says it has no evidence of public exploit code or active exploitation of the issues.
Google disclosed that a vulnerability in Pixel phones' modem software, tracked as CVE-2026-58704, was exploited in a limited number of targeted attacks before being patched this week. The flaw allowed attackers to escalate privileges from the isolated modem component into the phone's broader system without any user interaction, a so-called zero-click exploit. Google has not identified who carried out the attacks.
Google's September 2026 security bulletin fixes 110 vulnerabilities in Pixel devices, including a high-severity flaw (CVE-2026-58704) in the Cellular Modem component that is being exploited in limited, targeted attacks. The bug stems from a logic error that lets an attacker on an adjacent network bypass permissions and escalate privileges without user interaction. The update, rolling out at patch level 2026-09-05, also addresses 12 critical remote code execution bugs and 89 privilege escalation issues.
Acronis has patched a high-severity local privilege escalation flaw, tracked as CVE-2026-87886, in its backup add-ons for cPanel/WHM and Plesk. The company says it has seen limited, targeted exploitation attempts against affected deployments, based on a report from one potentially affected customer. Fixed versions are 1.9.3 HF3 for cPanel/WHM and 1.8.11 for Plesk.
A researcher going by 'Nightmare Eclipse' released a privilege-escalation exploit dubbed FalconFlank that abuses CrowdStrike Falcon's malicious macro remediation feature to gain SYSTEM-level command prompt access on fully patched Windows 11 25H2 and Windows Server 2025 machines. The flaw has no CVE yet, and CrowdStrike says it is investigating while telling customers to disable the Office File Suspicious Macro Removal policy setting as a workaround.
ServiceNow issued fixes for three critical vulnerabilities in its AI Platform that could let unauthenticated attackers run arbitrary code, escalate privileges, or manipulate data via SQL injection, all without user interaction. The company also patched a separate high-severity sandbox escape bug that could allow low-privileged users to achieve remote code execution. ServiceNow says it has no evidence of active exploitation but is urging customers to apply the updates immediately.