Feed aggregator

Article URL: https://www.reuters.com/business/apple-intel-have-reached-preliminary-chip-making-deal-wsj-reports-2026-05-08/

Comments URL: https://news.ycombinator.com/item?id=48066169

Points: 13

# Comments: 0

Article URL: https://cweiske.de/tagebuch/ssh-dyndns2.htm

Comments URL: https://news.ycombinator.com/item?id=48066164

Points: 1

# Comments: 0

Article URL: https://www.whec.com/top-news/news10nbc-investigates-widower-cant-renew-drivers-license-because-dmv-software-unearthed-speeding-ticket-from-47-years-ago/

Comments URL: https://news.ycombinator.com/item?id=48066163

Points: 1

# Comments: 0

May is typically the worst month for allergies. To prepare, I consulted allergists to find out how we can allergy-proof our homes.

In this article

1. Why Dirty Frag matters
2. Technical overview
3. Exploitation scenarios
4. Mitigation guidance
5. Post-mitigation integrity verification
6. References

A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking and memory-fragment handling components, including esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500). Public reporting and proof-of-concept activity indicate the exploit is designed to provide more reliable privilege escalation than traditional race-condition-dependent Linux local privilege escalation techniques.

Dirty Frag may be leveraged after initial compromise through SSH access, web-shell execution, container escape, or compromise of a low-privileged account. Affected environments may include Ubuntu, RHEL, CentOS Stream, AlmaLinux, Fedora, openSUSE, and OpenShift deployments. Microsoft Defender is actively monitoring related activity and investigating additional detections and protections.

This article details an ongoing investigation into active campaign. We will update this report as new details emerge.

Why Dirty Frag matters

Local privilege escalation vulnerabilities are frequently used by threat actors after initial access to expand control over a compromised environment. Once root access is obtained, attackers can disable security tooling, access sensitive credentials, tamper with logs, pivot laterally, and establish persistent access.

Dirty Frag is notable because it introduces multiple kernel attack paths involving rxrpc and esp/xfrm networking components to improve exploitation reliability. Rather than relying on narrow timing windows or unstable corruption conditions often associated with Linux local privilege escalation exploits, Dirty Frag appears designed to increase consistency across vulnerable environments.

This increases operational risk in environments where threat actors already possess limited local execution capability through compromised accounts, vulnerable applications, containers, or exposed administrative interfaces.

Technical overview

Dirty Frag abuses Linux kernel networking and memory-fragment handling behavior involving esp4, esp6, and rxrpc components. Similar to the previously disclosed CopyFail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.

The vulnerability affects systems where vulnerable modules are present and accessible. In many enterprise environments, these components may already be enabled to support IPsec, VPN functionality, or other networking workloads.

Exploitation scenarios

Threat actors may leverage Dirty Frag after obtaining local code execution through several common intrusion paths, including:

• Compromised SSH accounts
• Web-shell access on internet-facing applications
• Container escapes into the host environment
• Abuse of low-privileged service accounts
• Post-exploitation activity following phishing or remote access compromise

Once local access is established, successful exploitation may allow attackers to escalate privileges to root and gain broad control over the affected Linux host.

Mitigation guidance

While comprehensive remediation guidance continues to evolve, organizations should evaluate interim mitigations immediately.

Recommended actions include:

• Disable unused rxrpc kernel modules where operationally possible
• Assess whether esp4, esp6, and related xfrm/IPsec functionality can be temporarily disabled safely
• Restrict unnecessary local shell access
• Harden containerized workloads
• Increase monitoring for abnormal privilege escalation activity
• Prioritize kernel patch deployment once vendor advisories are released

The following example prevents vulnerable modules from loading and unloads active modules where possible:

cat </dev/null

These mitigations should be carefully evaluated before deployment, particularly in environments relying on IPsec VPNs or RxRPC functionality.

Post-mitigation integrity verification

Mitigation alone may not reverse changes already introduced through successful exploitation attempts.

If exploitation occurred prior to mitigation, malicious modifications may persist in memory or cached file content even after vulnerable modules are disabled. Organizations should validate the integrity of critical files and assess whether cache clearing is appropriate for their environment.

echo 3 | sudo tee /proc/sys/vm/drop_caches

Cache clearing can temporarily increase disk I/O and impact production performance and should be evaluated carefully before deployment.

Microsoft Defender coverage

Microsoft Defender provides detection coverage for possible Dirty Frag exploitation activity, including:

Microsoft Defender Antivirus

• Exploit:Linux/DirtyFrag.A
• Exploit:Linux/DirtyFrag.B
• Trojan:Linux/DirtyFrag.Z!MTB
• Trojan:Linux/DirtyFrag.ZA!MTB
• Trojan:Linux/DirtyFrag.ZC!MTB
• Trojan:Linux/DirtyFrag.DA!MTB

Microsoft Defender for Cloud

• Potential exploitation of dirtyfrag vulnerability detected

Microsoft continues investigating additional detections, telemetry correlations, and posture guidance related to Dirty Frag activity.

Further investigation is being conducted by Microsoft Defender towards providing stronger protection and posture recommendations is in progress.

References

Read about CopyFail (CVE-2026-31431), including mitigation and detection guidance here: https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/. 

The post Active attack: Dirty Frag Linux vulnerability expands post-compromise risk appeared first on Microsoft Security Blog.

If you're tempted by T-Mobile's offers but not sure which plan is best for you, we have recommendations.

The top sports streaming services for you depend on your favorite sports. We've analyzed the options, covering everything from the NBA playoffs and MLB to soccer and UFC.

CNET's gaming experts have deliberated and come up with the top PlayStation 5 games you can play right now, such as Astro Bot, Marathon and Clair Obscur: Expedition 33.

Article URL: https://www.cnbc.com/2026/05/08/anthropic-mythos-ai-cybersecurity-banks.html

Comments URL: https://news.ycombinator.com/item?id=48064675

Points: 1

# Comments: 0

Article URL: https://github.com/eleata/resilient-llm-router

Comments URL: https://news.ycombinator.com/item?id=48064656

Points: 1

# Comments: 0

Article URL: https://www.rte.ie/news/business/2026/0507/1572229-student-enterprise-globall/

Comments URL: https://news.ycombinator.com/item?id=48064647

Points: 1

# Comments: 0

Article URL: https://lovable.dev/

Comments URL: https://news.ycombinator.com/item?id=48064642

Points: 1

# Comments: 0

Article URL: https://www.science.org/content/article/deepfakes-are-everywhere-godfather-digital-forensics-fighting-back

Comments URL: https://news.ycombinator.com/item?id=48064641

Points: 1

# Comments: 0

Article URL: https://www.war.gov/UFO/#65_HS1-834228961_62-HQ-83894_Serial_153

Comments URL: https://news.ycombinator.com/item?id=48064622

Points: 1

# Comments: 0

Article URL: https://github.com/guyfischman/metal-softfloat

Comments URL: https://news.ycombinator.com/item?id=48064592

Points: 1

# Comments: 1

Article URL: https://gizmodo.com/extortion-using-smart-glasses-is-a-thing-now-2000755562

Comments URL: https://news.ycombinator.com/item?id=48064590

Points: 1

# Comments: 0

Article URL: https://github.com/samueltuyizere/oc-go-cc

Comments URL: https://news.ycombinator.com/item?id=48064584

Points: 1

# Comments: 0

Article URL: https://lookoutapp.ai

Comments URL: https://news.ycombinator.com/item?id=48064578

Points: 1

# Comments: 0