Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: linux

CVE-2026-46300: Linux Kernel Privilege Escalation via Shared Fragment Handling

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-46300 is a high-severity vulnerability in the Linux kernel affecting how shared fragments are handled during socket buffer coalescing. This flaw can lead to unintended modification of page-cache-backed data, specifically allowing ESP input processing to decrypt shared fragments in place. When chained with other vulnerabilities, this can enable privilege escalation, the implantation of PHP webshells, and arbitrary command execution as root, posing a significant threat to Linux-based systems, including IoT devices.

Technical Analysis

The vulnerability stems from a missing initialization of a variable within the skb_try_coalesce() function. When skb_try_coalesce() transfers paged fragments from one socket buffer (@from) to another (@to), it fails to preserve the SKBFL_SHARED_FRAG marker if @from had it set. This breaks an invariant relied upon by later in-place writers, particularly ESP input processing. Consequently, ESP input checks skb_has_shared_frag() and, if the marker is missing, incorrectly determines that an uncloned nonlinear skb can skip skb_cow_data(), leading to in-place decryption over page-cache backed fragments.

This unintended modification of page-cache-backed data can be leveraged for privilege escalation. The NVD record explicitly states that this vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and execute commands as root.

  • CVSS 3.1 Score: 7.8 (High)
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Weaknesses: CWE-787 (Out-of-bounds Write), CWE-456 (Missing Initialization of a Variable), CWE-123 (Write-what-where Condition)
  • Affected Versions:
    • Linux kernel versions >= 3.9 and <= 5.10.257
    • Linux kernel versions >= 5.11 and < 5.15.208
    • Linux kernel versions >= 5.16 and < 6.1.174
    • Linux kernel versions >= 6.2 and < 6.6.141
    • Linux kernel versions >= 6.7 and < 6.12.91
    • Linux kernel versions >= 6.13 and < 6.18.33
    • Linux kernel versions >= 6.19 and < 7.0.10
    • Linux kernel version 7.1

Detection

Direct detection of the kernel vulnerability exploitation itself can be challenging from user-space logs. However, the post-exploitation activities described (webshells, root command execution) provide clear detection opportunities.

  • Suspicious File Writes: Monitor web server directories (/var/www/, /srv/www/, /usr/share/nginx/html/, etc.) for the creation or modification of .php files by unusual processes or with suspicious content (e.g., base64 encoded strings, eval() functions). Utilize auditd logs for PATH events related to file creation/modification.
  • Privileged Process Execution: Look for sh, bash, php, python, or perl being executed with root privileges (UID 0) by unexpected parent processes or in unusual contexts. This is particularly relevant if the parent process is a network service or a process that should not typically spawn shells. Monitor auditd logs for SYSCALL events related to execve.
  • Network Activity: Monitor for unusual outbound connections from compromised systems, especially those indicative of botnet activity (e.g., DDoS attacks, C2 communications) if linked to malware families like KATARU or Mirai.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Linux Webshell Creation in Web Directories

title: Linux Webshell Creation in Web Directories
id: 752a1b3e-f1c3-4d0a-b8e7-2c9f0e1d4a3b
status: experimental
description: Detects the creation or modification of .php files in common web server directories, indicative of webshell deployment after exploitation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
    # Common web server root directories
    directory|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/html/'
      - '/var/www/html/'
      - '/var/www/htdocs/'
  condition: selection
level: high

Linux Suspicious Root Command Execution

title: Linux Suspicious Root Command Execution
id: 9e0c3f1a-5b6d-4e7c-8a2b-1d0f2e3c4b5a
status: experimental
description: Detects execution of common shell or scripting interpreters with root privileges, which could indicate successful privilege escalation.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    a0|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/php'
      - '/usr/bin/python'
      - '/usr/bin/perl'
    uid: '0' # Root user
  condition: selection
level: high

Mitigations

  1. Apply Kernel Patches: Immediately update Linux kernel to a version that includes the fix for CVE-2026-46300. Refer to the provided kernel Git references for specific patch details.
  2. Regular System Updates: Ensure all Linux-based systems, including IoT devices, are kept up-to-date with the latest security patches from their respective distributions.
  3. Principle of Least Privilege: Restrict user and process privileges to the absolute minimum required to perform their functions.
  4. Network Segmentation: Isolate critical systems and IoT devices on separate network segments to limit lateral movement in case of compromise.
  5. Web Server Hardening: Implement strong web server security configurations, including disabling unnecessary PHP functions, restricting write access to web directories, and using Web Application Firewalls (WAFs).

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  • https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
  • https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
  • https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111
  • https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a
  • https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
  • https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0
  • https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
  • https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3
  • https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 payload hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
SHA256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 KATARU loader hash (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
IP Address 160.191.242.92 KATARU Telnet brute force and C2 IP (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)
Domain bins.sh Domain for fetching per-architecture payloads (via https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits)

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
  • T1505.003 — Web Shell
  • T1059 — Command and Scripting Interpreter
  • T1110.001 — Password Guessing
  • T1498.001 — Direct Network Flood
  • T1053.003 — Cron
  • T1082 — System Information Discovery
  • T1499.002 — Service Exhaustion Flood
  • T1106 — Native API
  • T1016 — System Network Configuration Discovery
  • T1059.004 — Unix Shell
  • T1562.001 — Disable or Modify Tools
  • T1027 — Obfuscated Files or Information
  • T1573.002 — Asymmetric Cryptography
  • T1095 — Non-Application Layer Protocol
  • T1037.004 — RC Scripts
  • T1543.002 — Systemd Service
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,776 input / 2,315 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged high, iot, kataru, kernel, linux, mirai, privilege-escalation, vulnerability, webshellLeave a comment

CVE-2026-110447: Collabora Online Built-in CODE Server OS Command Injection

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-110447 is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server, specifically when deployed as a Nextcloud app. This flaw enables remote code execution, allowing attackers to execute arbitrary commands on the underlying system. It is currently being exploited in the wild, making immediate patching crucial for affected Nextcloud instances.

Technical Analysis

The vulnerability, CWE-78 (Improper Neutralization of Special Elements used in an OS Command), resides in the proxy.php component of the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app.
* It affects versions prior to 26.4.303.
* Exploitation occurs when the CODE server is not actively running, such as immediately after a system restart or if the service has crashed.
* Attackers can inject arbitrary OS commands, leading to remote code execution (RCE) on the host system.
* This vulnerability specifically impacts Nextcloud deployments utilizing the Built-in CODE Server and does not affect standalone Collabora Online servers.
* Active exploitation has been observed in the wild, with XMRIG malware linked to post-exploitation activities.

Detection

  • Monitor web server access logs for requests to /index.php/apps/richdocumentscode/proxy.php containing suspicious command injection patterns (e.g., |, &, ;, $(...), ` followed by OS commands).
  • Look for unusual process spawns originating from the web server process (e.g., apache, nginx, php-fpm) that execute shell commands (sh, bash, cmd.exe, powershell.exe) or known malware binaries like XMRIG.
  • Monitor for unexpected outbound network connections from the web server to known C2 infrastructure or cryptocurrency mining pools.
  • Review system logs for errors related to the CODE server not running, which could indicate a vulnerable state.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Collabora Online CODE Server RCE Process Spawn

title: Collabora Online CODE Server RCE Process Spawn
id: c8f1e2d3-b4a5-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects suspicious process creation by web server processes, indicative of successful OS command injection in Collabora Online Built-in CODE Server (CVE-2026-110447).
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith:
      - '/usr/sbin/apache2'
      - '/usr/sbin/httpd'
      - '/usr/bin/php-fpm'
      - '/usr/bin/nginx'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/wget'
      - '/usr/bin/curl'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/local/bin/xmrig'
  condition: selection
level: critical

Collabora Online CODE Server Command Injection Attempt

title: Collabora Online CODE Server Command Injection Attempt
id: f0e1d2c3-a4b5-6d7e-8f9a-0b1c2d3e4f50
status: experimental
description: Detects patterns in web access logs indicative of OS command injection attempts against Collabora Online Built-in CODE Server (CVE-2026-110447).
logsource:
  category: webserver
  service: ['apache', 'nginx']
detection:
  selection:
    c-uri|contains:
      - '/index.php/apps/richdocumentscode/proxy.php'
      - '|'
      - '&'
      - ';'
      - '$('
      - '`'
      - 'cat /etc/passwd'
      - 'id'
      - 'whoami'
      - 'wget'
      - 'curl'
      - 'nc -e'
      - 'bash -i'
      - 'php -r'
  condition: selection
level: high

Mitigations

  1. Immediately update the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app to version 26.4.303 or later.
  2. Ensure the CODE server service is configured for automatic restart and is actively running to reduce the window of vulnerability.
  3. Implement strict egress filtering to prevent unauthorized outbound connections from web servers, especially to cryptocurrency mining pools or unknown IP addresses.
  4. Apply the principle of least privilege to the web server user and associated processes to limit the impact of successful exploitation.
  5. Regularly back up critical data and test restoration procedures.

References

  • https://github.com/CollaboraOnline/richdocumentscode/issues/354
  • https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-110447

Indicators of Compromise

Type Value Description
SHA256 19cd1fe4e501fbdf6e52a7249a7bd375ea3039feed596f56691fb7f353acc23f XMRIG · confidence 100% · first seen 2026-10-23
SHA256 2a6e2516b103c2f313d280e2e5954db9111515e401e603ebb6d4b47a65b086fb XMRIG · confidence 100% · first seen 2026-10-23
SHA256 4230d003e25b12be26130c9d941ef0b809dc7da2a25ecbf8d15a0c369730ebd0 XMRIG · confidence 100% · first seen 2026-10-23
SHA256 5220cce8158699825c206529746ad1cbb20d930eff244017f8c3f913b83a3d86 XMRIG · confidence 100% · first seen 2026-10-23
SHA256 9aade612521dab5600f59b0660e19fb8392a42570408673e824f3bbd2532c85b XMRIG · confidence 100% · first seen 2026-10-23
SHA256 c5bd9b66d5535c2dffa253cb6dd665d20208db58793fd176d4773093546f50df XMRIG · confidence 100% · first seen 2026-10-23
SHA256 e15d2363b9e4552250f230c62188cb299ff2570c9ba9589fbc3e190df84768ba XMRIG · confidence 100% · first seen 2026-10-23
IP Address 103.194.186.118 XMRIG · confidence 95% · first seen 2026-10-23
IP Address 212.83.185.19 XMRIG · confidence 95% · first seen 2026-10-23
URL http://212.83.185.19/bottom-xe.png XMRIG · confidence 100% · first seen 2026-10-23
URL http://212.83.185.19/footerd.png XMRIG · confidence 100% · first seen 2026-10-23
URL http://cqzbr8a4.requestrepo.com XMRIG · confidence 90% · first seen 2026-10-23

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059.004 — Unix Shell
  • T1496 — Resource Hijacking
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,000 input / 1,471 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged collabora, command-injection, critical, linux, nextcloud, rce, vulnerability, webappLeave a comment

CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Posted on October 2, 2026 by Kyle

Overview

Zammad, a widely used open-source helpdesk system, is affected by CVE-2026-102490, an improper privilege management vulnerability. This flaw enables a local zammad user to escalate privileges to root, presenting a critical security risk to the underlying operating system and hosted data. This vulnerability is currently undergoing analysis and is slated for publication on 2026-09-30.

Technical Analysis

  • Vulnerability Type: Improper Privilege Management (CWE-269).
  • Affected Versions: All versions of Zammad, including the latest alpha, are vulnerable.
  • Attack Vector: Local privilege escalation. Exploitation requires a local zammad user account on the system hosting Zammad.
  • Impact: Successful exploitation grants the local zammad user root privileges on the affected system.
  • Chaining: This vulnerability can be chained with CVE-2026-102489, though specific details of that chain are not publicly available at this time.

Detection

Detection efforts should focus on monitoring for unusual process execution or system modifications originating from the zammad user account.
* Monitor Linux auditd logs for zammad user processes spawning unexpected shells (e.g., bash, sh, zsh) or executing sudo.
* Look for zammad user processes executing system modification utilities (e.g., chown, chmod, cp, mv, install) targeting sensitive system directories like /etc/, /root/, or /usr/local/bin/.
* Monitor for any unexpected file writes or modifications by the zammad user in system-critical directories.
* Review system logs for zammad user attempts to create new users, modify existing user permissions, or alter sudoers configurations.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Zammad User Suspicious Shell or Sudo Execution

title: Zammad User Suspicious Shell or Sudo Execution
id: <UUID_PLACEHOLDER_1>
status: experimental
description: Detects the local 'zammad' user spawning a shell or executing 'sudo', which could indicate a privilege escalation attempt via CVE-2026-102490.
logsource:
  product: linux
  service: auditd
detection:
  selection_user:
    auid: 'zammad'
  selection_exe:
    exe|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/zsh'
      - '/usr/bin/sudo'
  condition: selection_user and selection_exe
level: high

Zammad User Executing System Modification Tools

title: Zammad User Executing System Modification Tools
id: <UUID_PLACEHOLDER_2>
status: experimental
description: Detects the local 'zammad' user executing system modification tools (e.g., chown, chmod, cp to sensitive locations) which could indicate post-privilege escalation activity via CVE-2026-102490.
logsource:
  product: linux
  service: auditd
detection:
  selection_user:
    auid: 'zammad'
  selection_tools:
    exe|endswith:
      - '/usr/bin/chown'
      - '/usr/bin/chmod'
      - '/usr/bin/cp'
      - '/usr/bin/mv'
      - '/usr/bin/install'
  selection_target_sensitive:
    a1|contains:
      - '/etc/'
      - '/root/'
      - '/usr/local/bin/'
      - '/usr/bin/'
  condition: selection_user and selection_tools and selection_target_sensitive
level: high

Mitigations

  1. Apply vendor patches immediately once they become available. As of this report, the vulnerability is undergoing analysis, and no patch has been released.
  2. Restrict local access to Zammad instances and the underlying operating system to only essential administrative personnel.
  3. Implement and enforce the principle of least privilege for the zammad user account, ensuring it has only the minimum necessary permissions to function.
  4. Regularly audit system configurations and user privileges to detect unauthorized changes.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-102490
  • https://csirt.divd.nl/CVE-2026-102490
  • https://csirt.divd.nl/DIVD-2026-00015

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1068 — Exploitation for Privilege Escalation
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,636 input / 1,297 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged critical, linux, privilege-escalation, vulnerability, zammadLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.