CISA confirmed that ransomware groups are now exploiting a Windows Task Host privilege-escalation flaw that has been flagged as actively exploited since April. Tracked as CVE-2025-60710 and scored 7.8, it is a link-following weakness in the component that runs background scheduled tasks as SYSTEM: a local attacker with only basic user rights can use a junction on a user-writable path to make a SYSTEM-level task act on files it should not, escalating to full control. Microsoft patched it in November 2025, and it affects Windows 11 and Server 2025. Privilege escalation like this is exactly what ransomware operators need to disable defenses and spread after gaining an initial foothold.
Red Hat disclosed a critical flaw in its Advanced Cluster Management for Kubernetes that lets a user with only namespace-level edit rights escalate to full cluster administrator. Tracked as CVE-2026-10090 and scored 9.9, the bug is in the application subscription controller: a low-privileged user can create a channel pointing to a Helm repository they control, then a subscription referencing it, and the controller deploys the chart using its own elevated permissions without checking the requester's authorization. It is a confused-deputy problem that crosses the namespace-to-cluster boundary. Because namespace edit access is often granted broadly to developers, many multi-tenant clusters could be exposed, and no fix was available at disclosure.
Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.
A researcher disclosed OVSwrap, a Linux kernel flaw in the Open vSwitch datapath that lets an ordinary local user gain root, and published a working exploit covering roughly 800 builds. Tracked as CVE-2026-64531, it is an integer wraparound in how Open vSwitch handles internally generated network action streams, giving a deterministic memory-corruption path. The attacker needs no existing switch, no running daemon, and no special privileges: where unprivileged user namespaces are enabled, they create a private namespace, gain network capabilities inside it, and reach the vulnerable code. The module can even auto-load on demand, so an empty module list does not mean safety. Default configurations of most major distributions tested as exploitable.
cPanel patched a critical flaw that lets an ordinary hosting customer escalate to full database administrator access, running SQL as the database root user. Tracked as CVE-2026-58048 with a score of 9.4, the bug is significant on shared hosting, where many customers use one database server: administrator access there can expose or alter other tenants' data, and depending on the operating system and database configuration, cPanel warns it may extend to operating-system-level compromise. cPanel is one of the most widely deployed web hosting control panels, so the flaw affects a large number of shared and reseller hosting environments. Fixes shipped across several release tiers.
Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an ordinary local user overwrite protected files and take root. Tracked as CVE-2026-64600, it triggers when two concurrent direct writes target the same reflinked file: the kernel briefly drops its inode lock, and a second writer can make the first write land on a stale block. The overwrite happens at the block layer, so ownership, permissions, timestamps, and the setuid bit stay untouched and no kernel log entry appears. Qualys reports it works with SELinux enforcing and estimates over 16 million affected systems.
Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.
Less than an hour after Microsoft's July Patch Tuesday, the researcher known as Nightmare Eclipse published a proof-of-concept for LegacyHive, a Windows privilege-escalation flaw that works on fully updated systems. It abuses the Windows User Profile Service to let a standard user load another user's registry hive, including an administrator's, into their own profile, a useful stepping stone for an attacker who already has a foothold. There is no CVE, advisory, or patch. The public proof-of-concept was deliberately stripped down, needing extra credentials, but the researcher says the original had no such limits. Given this researcher's flaws have been weaponized quickly before, defenders should not wait for a fix.
Researchers at Nebula Security disclosed GhostLock, a Linux kernel flaw that lets any logged-in user gain full root on an unpatched machine, and it also escapes containers. Tracked as CVE-2026-43499, the bug has shipped by default in essentially every mainstream distribution since 2011 and needs no special permissions or network access; ordinary threading calls from any local program are enough. Nebula built a working exploit it says is 97 percent reliable and published the code, though no in-the-wild use is known yet. There is no full workaround, patch availability is uneven across distributions, and one earlier fix introduced a separate crash bug, so confirm the fixed package version.
Microsoft has patched RoguePlanet, a Microsoft Defender flaw that a public proof-of-concept had been exploiting since June to gain SYSTEM privileges on fully updated Windows machines. Tracked as CVE-2026-50656, the bug is a race condition in Defender's scanning engine: a low-privileged attacker who already has code running on a host can win a timing window to spawn a command shell as SYSTEM, and the public exploit worked whether or not real-time protection was enabled. It does not provide initial access, but it turns any foothold into full local control, useful for disabling defenses, stealing credentials, and moving laterally. It is the fourth Defender flaw disclosed by the same researcher this year.
TrustStrike Labs