Rather than breaking Windows Hello encryption, the technique takes advantage of an already authenticated Windows session. If an attacker gains access to a logged-in device, they may be able to leverage the victim’s existing Windows Hello credentials to request authentication tokens and potentially establish long-term access to Microsoft Entra resources.

The research highlights how attackers can abuse trusted authentication mechanisms once an endpoint has already been compromised.

How the Attack Works

Windows Hello for Business replaces passwords with cryptographic keys that are securely stored on the user’s device, typically inside the Trusted Platform Module (TPM). These keys are designed to remain protected and cannot normally be exported from the device.

However, the research demonstrates that an application running with standard user privileges inside an active Windows session can request cryptographic operations from the Windows Hello key without asking the user to re-enter their PIN or biometric authentication.

Instead of stealing the private key itself, the attacker simply instructs Windows to use it on their behalf. As long as the user remains logged in, Windows considers the authentication request valid.

This effectively allows attackers to “borrow” the trusted Windows Hello credentials without directly compromising them.

Authentication Without Traditional Credentials

Researchers showed that the borrowed Windows Hello key can be used during Microsoft’s WebAuthn authentication process.

Since the authentication challenge is not permanently tied to a specific device or session, attackers can generate the request from their own system while having the victim’s compromised device perform the required cryptographic signing.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

Once the challenge is successfully signed, Microsoft Entra treats the authentication as legitimate and issues cloud authentication tokens.

Unlike earlier attack techniques, this approach removes the need for attackers to control another Microsoft Entra-registered device, making exploitation significantly easier.

Potential Impact

Successful exploitation could provide attackers with access to Microsoft Entra cloud resources while using legitimate authentication mechanisms.

Depending on the organization’s security configuration, attackers may be able to:

• Authenticate to Microsoft Entra services.
• Obtain cloud authentication tokens.
• Register attacker-controlled devices.
• Add new authentication methods.
• Maintain persistent access to cloud identities.
• Expand access across enterprise environments.

Because Windows Hello for Business satisfies multi-factor authentication requirements, attackers may also bypass additional protections designed to secure identity management functions.

Why Organizations Should Pay Attention

The research demonstrates that passwordless authentication is only as secure as the endpoint itself.

Even though Windows Hello protects credentials from theft, an attacker who compromises an active Windows session may still abuse trusted authentication processes without ever knowing the user’s password or PIN.

This reinforces the importance of endpoint security alongside identity protection.

Organizations should not rely solely on passwordless authentication but should also focus on preventing attackers from gaining access to active user sessions.

Detection and Mitigation

Security teams should monitor Microsoft Entra sign-in activity for unusual Windows Hello authentication events, particularly those that do not contain an associated device ID.

Administrators should also investigate unexpected device registrations, monitor changes to authentication methods, strengthen endpoint detection and response capabilities, and regularly review Conditional Access policies to ensure only trusted devices can register new authentication factors.

Monitoring active user sessions and detecting suspicious endpoint activity remain critical for preventing attackers from abusing trusted authentication mechanisms.

Conclusion

Mollema’s research demonstrates that compromising an active Windows session can have serious consequences, even in environments that have adopted passwordless authentication.

While the technique does not break Windows Hello’s cryptographic protections, it shows how trusted authentication workflows can be abused after an endpoint has been compromised.

Organizations using Windows Hello for Business and Microsoft Entra should prioritize endpoint protection, continuous monitoring, and identity security controls to reduce the risk of attackers turning temporary access into persistent cloud compromise.

The post Windows Hello Key Flaw Opens Door to Entra ID Access appeared first on First Hackers News.

The exploit chain was originally discovered by Google Threat Intelligence Group, iVerify, and Lookout. After the complete JavaScript-based toolkit was leaked on GitHub, several unrelated attackers began reusing the same code instead of creating their own versions.

Researchers found that at least seven threat groups are now operating DarkSword infrastructure. The attackers use identical exploit files, matching code hashes, and even the same Russian-language comments found in the leaked source code, confirming they are all relying on the leaked toolkit.

One of the newest operators appears to be a Chinese-speaking threat actor managing more than 100 malicious websites across Hong Kong, Japan, the United States, and several European countries. Earlier campaigns mainly used fake AWS login pages, but researchers have now identified Apple ID phishing pages hosted on the same servers that deliver the DarkSword exploit.

How the DarkSword Campaign Works

Researchers tracked the attackers by comparing file hashes and exploit pages instead of relying only on domains or IP addresses, which change frequently. This method helped identify additional DarkSword infrastructure that traditional detection methods had missed.

According to Censys, the campaign continues to grow as attackers regularly move their infrastructure to new hosting providers and domains.

Researchers identified several key characteristics of the operation:

• Multiple DarkSword administration panels hosted in Hong Kong, Japan, and the United States.
• Chinese-language login panels running on ports such as 3000, 8443, and 8888.
• Fake Apple ID login pages hosted on the same servers as the exploit chain.
• Identical exploit files and malware modules reused across different operators.
• Infrastructure spread across multiple hosting providers to avoid easy detection.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

What Happens After an iPhone Is Compromised?

One of the most dangerous changes in this campaign is the combination of Apple ID phishing pages with DarkSword’s exploit delivery. Victims believe they are signing in to a legitimate Apple account, while hidden exploit code is loaded in the background through Safari.

Security researchers say DarkSword chains multiple iOS vulnerabilities affecting WebKit, the GPU, the dynamic linker, and the kernel to gain deep access to vulnerable devices.

After a successful compromise, the malware can:

• Steal Apple Keychain passwords and saved credentials.
• Extract iCloud account information.
• Collect saved Wi-Fi passwords.
• Download files stored on the device.
• Send stolen data to attacker-controlled command-and-control (C2) servers.

Researchers also found that most DarkSword deployments use identical malware files, showing attackers are directly reusing the leaked toolkit instead of developing new versions. Although many servers are hosted in Hong Kong, the infrastructure is distributed across several internet providers, making IP-based blocking less effective.

Additional evidence, including Chinese-language control panels, references to an “Asia-Pacific Group,” and a Telegram contact, suggests the latest infrastructure is operated by a Chinese-speaking threat actor. However, researchers say there is not yet enough evidence to confidently attribute the campaign to a specific group.

The post Threat Analysis: DarkSword Framework Leverages iOS Exploits for Apple ID Harvesting appeared first on First Hackers News.

The vulnerability has been assigned a CVSS v4.0 score of 8.7, highlighting the importance of applying the latest firmware updates as soon as possible.

Buffer Overflow Vulnerability Identified

The issue is caused by a stack-based buffer overflow in the router’s Real-Time Streaming Protocol (RTSP) connection-tracking component.

The vulnerability can be triggered when a device connected to the local network communicates with a malicious RTSP server. If the server responds with specially crafted data, it can cause improper memory handling inside the router, leading to a system crash or remote code execution.

Unlike many router vulnerabilities, this flaw does not require attackers to authenticate with the device under its default configuration.

However, exploitation requires some user interaction. A user must first access a malicious RTSP stream, such as opening a harmful media link or connecting to an attacker-controlled streaming service.

Potential Security Risks

If successfully exploited, attackers could:

• Execute malicious code on the router.
• Modify network or security settings.
• Monitor or intercept network traffic.
• Install persistent malware.
• Use the compromised router to launch attacks against other devices on the network.

Because routers act as the gateway between users and the internet, compromising one can expose every connected device to additional risks.

Affected Versions and Fixes

The vulnerability only impacts TP-Link TL-WR940N hardware version v6.

TP-Link has released firmware updates that address the issue for regional versions, including:

• (EN)_V6_260528
• (US)_V6_260528
• (JP)_V6_260527

Users should download and install the appropriate firmware from TP-Link’s official support website as soon as possible.

Recommended Security Measures

Until systems are updated, users and organizations should:

• Install the latest TP-Link firmware.
• Avoid connecting to untrusted RTSP streaming services.
• Secure the router’s administration interface with a strong, unique password.
• Monitor network activity for unusual behavior.
• Regularly review router firmware for new security updates.

Conclusion

The discovery of CVE-2026-12935 highlights the importance of keeping networking devices up to date. Since routers are a critical part of any home or enterprise network, timely firmware updates and good security practices remain essential to protecting against remote attacks and maintaining a secure network environment.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

The post Critical TP-Link Router Flaw Enables Remote Code Execution appeared first on First Hackers News.

To help reduce the risk of attacks before users install the update, Google is temporarily limiting technical details about many of the vulnerabilities until the rollout is complete.

370 Security Flaws Addressed

This release includes fixes for vulnerabilities affecting several core Chrome components, including graphics, networking, browser rendering, and platform-specific features.

Many of these issues were discovered by Google’s internal security teams using automated testing tools designed to detect memory errors and other software weaknesses before they could be exploited.

Seven Critical Vulnerabilities Fixed

Chrome 151 resolves seven critical vulnerabilities, tracked as CVE-2026-17650 through CVE-2026-17656.

Several of these are use-after-free memory vulnerabilities found in components such as Compositing, Views, Skia, and Ozone. If successfully exploited, these flaws could allow attackers to execute malicious code through specially crafted web content.

The update also fixes:

• Insufficient input validation in the Dawn and ANGLE graphics libraries.
• A race condition in Chrome’s Updater that could lead to unexpected behavior during software updates.

These vulnerabilities could potentially be used to bypass security protections, escalate privileges, or compromise browser stability.

Additional High-Severity Fixes

Beyond the critical issues, Chrome 151 addresses numerous high-severity vulnerabilities affecting components such as:

• V8 JavaScript Engine
• Navigation
• QUIC
• Audio and Media
• WebGL
• Downloads

Many of these flaws involve memory corruption issues, including out-of-bounds reads and writes, integer overflows, and type confusion vulnerabilities, all of which could increase the risk of remote code execution.

Medium and Low-Severity Improvements

The update also includes fixes for medium-severity vulnerabilities affecting features such as Autofill, DevTools, Extensions, Password Manager, WebXR, WebView, and ANGLE.

In addition, Google resolved several lower-severity issues impacting Enterprise features, Bluetooth, NFC, Google Lens, Settings, Picture-in-Picture, and AI-related functionality. While these vulnerabilities are less severe individually, addressing them helps strengthen Chrome’s overall security.

Update Chrome as Soon as Possible

Google credited both its internal security teams and external researchers for identifying many of the vulnerabilities before they could be exploited.

With 370 security fixes, including seven critical vulnerabilities, this release highlights the importance of keeping web browsers up to date. Users and organizations should install Chrome 151 as soon as it becomes available to reduce the risk of attacks targeting known security flaws.

The post Google Chrome 151 Patches Critical Vulnerabilities appeared first on First Hackers News.

The vulnerability, tracked as CVE-2026-20316, impacts Cisco’s centralized firewall management solution, which enables administrators to manage firewall policies, monitor security events, and control intrusion prevention systems across enterprise environments. Because FMC plays a central role in network security management, a successful attack could have significant operational and security consequences related to the cisa-cisco-secure-firewall-vulnerability.

Hard-Coded Credentials Enable Unauthorized Access

According to Cisco, the vulnerability is caused by the presence of hard-coded credentials within the software. Since these embedded credentials cannot be modified by administrators, an attacker can exploit the flaw to authenticate to a vulnerable FMC instance without valid user credentials.

Successful exploitation allows an unauthenticated attacker to gain access with low-level privileges, creating an initial foothold inside the firewall management environment.

Why the Vulnerability Matters

Although the access obtained is limited, compromising a centralized management platform can provide attackers with valuable intelligence about an organization’s security infrastructure.

An attacker may be able to:

• View firewall configurations and security policies
• Access security event logs and system information
• Gather network intelligence for follow-on attacks
• Modify security configurations to weaken existing defenses

Because Cisco FMC acts as the central management console for enterprise firewall deployments, unauthorized access can significantly increase the likelihood of lateral movement and additional compromise within the network.

CISA Advises Immediate Remediation

CISA has added CVE-2026-20316 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that the vulnerability is being actively exploited in real-world attacks.

Organizations should prioritize remediation by:

• Applying Cisco’s latest security updates without delay
• Identifying and securing internet-accessible FMC deployments
• Restricting management interface access to trusted administrative networks
• Following the remediation timelines outlined in Binding Operational Directive (BOD) 26-04

Where patches or effective mitigations cannot be implemented immediately, organizations should evaluate temporarily removing affected systems from service until they can be secured.

Review Systems for Indicators of Compromise

Security teams should also assess affected environments for signs of unauthorized activity. Recommended actions include reviewing authentication logs, monitoring administrative access, validating configuration changes, and preserving forensic evidence if compromise is suspected.

Organizations operating cloud-hosted or hybrid deployments should ensure the same security controls and remediation measures are consistently applied across all FMC instances.

Conclusion

The active exploitation of CVE-2026-20316 demonstrates how vulnerabilities involving hard-coded credentials continue to present a serious risk to enterprise environments. Since Cisco Secure Firewall Management Center is responsible for managing critical network security controls, organizations should treat this vulnerability as a high-priority issue.

Prompt patching, restricted administrative access, continuous monitoring, and thorough log analysis remain essential to reducing the risk of unauthorized access and protecting enterprise networks.

The post Active Exploitation of Cisco Secure Firewall Zero-Day Prompts CISA Alert appeared first on First Hackers News.

The issue impacts applications that use Active Storage with the libvips image-processing library. According to the Rails maintainers, applications that allow image uploads from untrusted users are at the highest risk. To give organizations time to update their systems, technical details of the exploit have been temporarily withheld until August 28, 2026.

How the Vulnerability Works

The flaw is caused by the way Active Storage interacts with the libvips image-processing library during image variant generation. Active Storage failed to block certain unsafe image-processing operations, allowing a specially crafted image upload to trigger unintended behavior.

As a result, an attacker may be able to read files that are accessible to the Rails application. These files can contain valuable information, including:

• Application secret_key_base
• Database usernames and passwords
• Cloud storage access keys
• Third-party API tokens
• Environment variables and deployment secrets

If attackers obtain these credentials, they could potentially forge application sessions, access cloud resources, compromise databases, or move further inside an organization’s infrastructure.

Affected Versions and Protection

Applications are vulnerable if they:

• Use Active Storage with libvips (config.active_storage.variant_processor = :vips)
• Accept image uploads from untrusted users
• Run affected versions of Active Storage

The vulnerability affects:

• Active Storage versions earlier than 7.2.3
• Versions 8.0.0 to 8.0.4
• Versions 8.1.0 to 8.1.2

Rails has released security updates to fix the issue and recommends using libvips 8.13.8 or later, which blocks unsafe image-processing operations. Organizations that cannot immediately upgrade Rails can enable additional protection by setting the VIPS_BLOCK_UNTRUSTED environment variable when using a supported version of libvips.

Recommended Actions

Organizations should act quickly to reduce the risk of exploitation by:

• Updating Rails Active Storage to the latest patched version.
• Upgrading libvips to 8.13.8 or newer.
• Reviewing applications that accept image uploads.
• Rotating sensitive credentials, including database passwords, cloud keys, API tokens, and secret_key_base.
• Monitoring systems for suspicious file access or unauthorized activity.

Changing the secret_key_base will invalidate existing user sessions, signed cookies, and Active Storage URLs, requiring users to log in again.

Conclusion

CVE-2026-66066 highlights how vulnerabilities in image-processing components can expose critical application secrets and potentially lead to full server compromise. Organizations using Ruby on Rails should install the latest security updates immediately, review uploaded file handling, and rotate any sensitive credentials that may have been exposed before applying the patch.

The post Critical Rails Vulnerability Exposes Sensitive Data appeared first on First Hackers News.

The updates are available for iPhone 11 and newer models, along with supported iPads. While Apple has not reported any active exploitation of these vulnerabilities, the nature of the flaws makes this update a high priority for all users.

Critical Vulnerabilities Patched

One of the most serious issues, tracked as CVE-2026-64747, affects the AVEVideoEncoder component. The vulnerability could allow a malicious application to execute arbitrary code with kernel-level privileges through a buffer overflow. Apple resolved the issue by improving input size validation.

The update also fixes several vulnerabilities in the iOS kernel. These flaws could lead to system crashes, kernel memory corruption, sensitive information disclosure, or unauthorized memory access. Apple addressed these issues by strengthening memory handling, improving bounds checking, and resolving race conditions.

Some of the key security fixes include:

• CVE-2026-64747 – Kernel code execution vulnerability in AVEVideoEncoder.
• CVE-2026-28931 – Kernel memory corruption when connecting to a malicious NFS server.
• CVE-2026-43810 – Remote vulnerability that could trigger system crashes or corrupt kernel memory.
• CVE-2026-43723 – Root privilege escalation flaw in MediaRemote.
• CVE-2026-64740 – Sandbox escape vulnerability in Game Center.
• CVE-2026-28973 – Sandbox escape issue in libc caused by an integer overflow.

Additional Security Improvements

Apple also patched several code execution vulnerabilities affecting AppleDouble, ImageIO, and SceneKit. These flaws could be exploited through specially crafted files, images, textures, or 3D content delivered via websites, downloads, email attachments, or malicious applications.

The company also strengthened WebKit, the browser engine used by Safari and many iOS apps. The update fixes issues related to memory disclosure, browser crashes, UI spoofing, iframe sandbox enforcement, and unauthorized file access outside the intended sandbox.

The combination of kernel vulnerabilities, root privilege escalation, code execution, and sandbox escape flaws makes iOS 26.6 one of Apple’s most significant security releases in recent months. Although there is no evidence that these vulnerabilities have been exploited in the wild, installing the update is strongly recommended to keep devices protected.

Users can install the latest update by navigating to Settings → General → Software Update on their iPhone or iPad.

The post Apple iOS 26.6 Fixes Critical Security Flaws appeared first on First Hackers News.

The achievement highlights how artificial intelligence is changing vulnerability research by reducing the time needed to discover complex software flaws.

How Kimi K3 Found the Vulnerabilities

The AI was given a simple task: search for memory-related security issues such as buffer overflows and use-after-free bugs in the Redis source code.

To complete the task, Kimi K3 automatically:

• Cloned the Redis source code.
• Performed fuzz testing to trigger unexpected behavior.
• Analyzed application crashes.
• Used debugging tools to identify the root cause.
• Generated proof-of-concept (PoC) exploits in a controlled testing environment.

The entire process was completed without manual intervention, showing how AI can automate complex security research.

Redis Versions Affected

The reported vulnerabilities were found in the following Redis versions:

• Redis 6.2.22
• Redis 7.4.9
• Redis 8.6.4
• Redis 8.8.0

Researchers shared the proof-of-concept findings publicly for validation and further analysis.

Key Vulnerabilities Identified

The AI agent reportedly discovered multiple critical issues, including:

• A double-free vulnerability related to Redis stream consumer groups (CVE-2026-25589).
• A heap overflow vulnerability in the RedisBloom module.

These types of memory corruption vulnerabilities can allow attackers to manipulate application memory and may eventually lead to remote code execution if successfully exploited.

Why This Matters

Finding serious vulnerabilities has traditionally required experienced researchers spending days or even weeks reviewing source code and performing extensive testing.

AI-powered tools are now changing that process by:

• Reducing vulnerability discovery time.
• Automating repetitive security testing.
• Identifying bugs across large codebases much faster.
• Helping security teams strengthen software before attacks occur.

Opportunities and Risks

While AI offers significant advantages for defenders, it also introduces new concerns.

Potential benefits include:

• Faster vulnerability detection.
• Improved software security.
• More efficient penetration testing.
• Better support for security researchers.

However, the same technology could also be used by attackers to accelerate exploit discovery, making timely patching and responsible disclosure more important than ever.

The Future of AI in Cybersecurity

The Kimi K3 demonstration shows that AI is becoming an important tool in modern cybersecurity. As large language models continue to improve, they are expected to assist with vulnerability research, code analysis, and automated security testing at a much larger scale.

Organizations should prepare by:

• Applying security updates quickly.
• Continuously monitoring critical systems.
• Using AI-assisted security tools alongside traditional defenses.
• Strengthening vulnerability management programs.

Conclusion

Although these findings are still being reviewed by the security community, they demonstrate how quickly AI-powered security research is evolving. Kimi K3’s ability to discover complex Redis vulnerabilities in minutes signals a major shift in how software security testing may be performed in the future, making AI an increasingly valuable asset for both cybersecurity researchers and defenders.

The post Kimi K3 AI Discovers Redis RCE Flaws appeared first on First Hackers News.

The issue has sparked discussions about how even privacy-focused technologies can be affected by weaknesses outside their core design.

How Hide My Email Protects Users

As part of Apple’s ongoing efforts to enhance security, the Apple Hide My Email feature continues to evolve, providing users with innovative ways to maintain their privacy online.

As part of Apple’s ongoing efforts to enhance security, the Apple Hide My Email feature continues to evolve, providing users with innovative ways to maintain their privacy online.

Hide My Email allows users to create unique email aliases whenever they sign up for websites or online services. Messages sent to these aliases are automatically forwarded to the user’s real inbox, while the actual email address remains hidden.

This approach helps users reduce spam, limit online tracking, and avoid exposing their primary email address if a service experiences a data breach.

What Went Wrong?

Although the feature successfully generated anonymous email aliases, researchers found that the email delivery process itself could unintentionally reveal the original email address.

Instead of breaking the alias directly, the weakness appeared during the way certain emails were processed. Under specific conditions, backend email handling systems could expose information that linked the alias to the user’s real address.

This meant attackers didn’t have to compromise an Apple account—they only needed to exploit the email processing workflow.

Why This Matters

Privacy tools are designed to separate a user’s identity from the services they use.

If someone can trace an anonymous email alias back to its owner, it becomes much easier to build user profiles, launch targeted phishing campaigns, or connect accounts across multiple platforms.

While the vulnerability did not expose passwords or give attackers access to Apple accounts, it weakened an important layer of privacy that many users relied on.

Apple Responds

After the issue was reported through responsible disclosure, Apple investigated the vulnerability and later released a security update to address it.

The fix prevents the conditions that allowed email aliases to be linked with real email addresses, strengthening the privacy protections offered by Hide My Email.

The update highlights Apple’s continued efforts to improve security across its ecosystem as new vulnerabilities are identified.

Can Older Aliases Still Be a Concern?

Although the vulnerability has now been patched, security experts note that information exposed before the update cannot always be erased.

Some email providers and enterprise mail systems store message logs for operational and security purposes. If an email address was previously revealed during processing, that information may still exist in archived records.

Because of this, users who created aliases before the fix may wish to review important accounts that rely on older aliases.

This incident demonstrates that protecting privacy is about more than building secure features.

Modern email systems involve multiple technologies, including spam filtering, message routing, logging services, and third-party infrastructure. Even when the main application is secure, weaknesses elsewhere in the communication process can introduce unexpected privacy risks.

Organizations developing privacy-focused services must evaluate the entire ecosystem rather than only the application itself.

Best Practices for Users

While Apple has resolved the vulnerability, users should continue following good security practices:

• Keep Apple devices updated with the latest security releases.
• Review important online accounts that use older email aliases.
• Enable Multi-Factor Authentication (MFA) wherever available.
• Be cautious of unexpected emails requesting personal information.
• Regularly monitor important accounts for suspicious activity.

Privacy tools like Hide My Email remain valuable for reducing online tracking and limiting data exposure. However, they work best when combined with strong account security and regular software updates to provide multiple layers of protection.

The post Apple Strengthens Hide My Email Privacy with New Security Fix appeared first on First Hackers News.

The vulnerability affects the copy-on-write (CoW) feature of XFS. It is caused by a race condition that occurs when two O_DIRECT write operations access the same reflink-enabled file at nearly the same time.

How the Vulnerability Works

Normally, when a shared file is modified, XFS creates a new private copy of the data before writing changes. However, during this process, the kernel briefly releases an internal lock while waiting for transaction log space.

If another write request arrives during this short window, it can change the file mapping before the first operation finishes. As a result, the first write uses outdated information and writes data directly to the original disk block instead of a new one.

Since O_DIRECT bypasses the page cache, the corrupted data is written straight to disk, allowing attackers to overwrite protected system files.

Why It Is Dangerous

Qualys demonstrated that a normal local user could exploit the flaw on a default RHEL 10.2 system and remove the root account’s password protection within seconds. After the attack, the system granted passwordless root access.

The attack is difficult to detect because:

• No kernel log entries are generated.
• The changes remain after a reboot.
• Even systems protected by SELinux are vulnerable.
• Existing Linux security protections do not block the attack.

Researchers believe the vulnerability has existed since Linux kernel version 4.11, released in 2017, potentially affecting more than 16 million systems worldwide.

Who Is Affected?

A system is vulnerable if it has:

• Linux kernel 4.11 or later without the security patch.
• An XFS filesystem with reflink=1 enabled.
• A directory writable by an unprivileged user.
• A valuable target file such as a SUID binary or protected system file.

Confirmed affected distributions include:

• RHEL 8, 9 and 10
• CentOS Stream 8, 9 and 10
• Oracle Linux 8, 9 and 10
• Rocky Linux 8, 9 and 10
• AlmaLinux 8, 9 and 10
• CloudLinux 8, 9 and 10
• Amazon Linux 2 and Amazon Linux 2023
• Fedora Server 31 and later

Lower-risk distributions

• Debian
• Ubuntu
• SUSE

These distributions are mainly affected only if XFS with reflink support has been manually configured.

Existing Security Features Cannot Stop It

One of the biggest concerns is that common Linux security protections do not prevent this attack. Technologies such as SELinux, KASLR, SMEP, SMAP, kernel lockdown, and container isolation operate at different layers and cannot stop exploitation of this filesystem flaw.

At present, there is no temporary workaround that completely mitigates the vulnerability. Installing the security update is the only effective solution.

AI Helped Discover the Flaw

The vulnerability was identified through a collaboration between Qualys and Anthropic. Researchers used Anthropic’s Claude Mythos Preview AI model to search for race-condition vulnerabilities similar to the well-known Dirty COW bug.

After identifying the issue, Qualys engineers independently verified the findings, created a proof-of-concept, and responsibly disclosed the vulnerability to Linux maintainers.

Part of a Growing Trend

RefluXFS is one of several major Linux privilege escalation vulnerabilities disclosed during 2026. Other recent discoveries include:

• Copy Fail (CVE-2026-31431)
• Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
• DirtyClone (CVE-2026-43503)

These vulnerabilities highlight a growing trend of attackers exploiting flaws that allow protected files or memory to be modified, ultimately leading to privilege escalation.

What Organizations Should Do

Organizations should patch affected systems as soon as possible, especially internet-facing servers, multi-tenant environments, and shared systems.

Security updates are already available for major enterprise Linux distributions, including RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora. After installing the update, administrators should perform a full system reboot to ensure the patched kernel is running.

Since there is currently no reliable mitigation other than patching, keeping systems updated is the best defense against the RefluXFS vulnerability.

The post Critical RefluXFS Flaw Threatens Linux Systems appeared first on First Hackers News.