Saturday 8 August 2026

An 18-Year-Old Linux Bug Let Attackers Escape Containers and Own the Host — It's Fixed Now, But Patch Fast

A 18-year-old Linux kernel bug that lets attackers escape containers and gain root has finally been patched — and it coincides with a flood of novel research from Black Hat 2026.

Lead story

An 18-Year-Old Linux Bug Let Attackers Escape Containers and Own the Host — It's Fixed Now, But Patch Fast

A use-after-free vulnerability hiding in the Linux kernel's SCTP networking stack since 2008 has been confirmed exploitable — and Tencent researchers have now demonstrated a working exploit that escapes a container and lands root access on the underlying host. The flaw, disclosed this week, is the kind of "it's been there the whole time" bug that makes anyone running containerised workloads quietly reconsider their weekend plans.

What is SCTP and why does this matter?

SCTP (Stream Control Transmission Protocol) is an alternative to TCP primarily used in telecoms, some cloud-native workloads, and high-availability networking. It's not as ubiquitous as TCP, but it's enabled by default in many Linux distributions — meaning a lot of systems have the vulnerable code loaded even if they're not actively using the protocol.

The use-after-free bug allows an attacker who can reach the SCTP stack to corrupt kernel memory. Tencent's researchers went further than disclosing the primitive: they turned it into a container escape, meaning code running inside a Docker or similar container can break out and execute with full root privileges on the host machine. In cloud and Kubernetes environments — including the managed container platforms widely used by Australian enterprises and government agencies — that's a worst-case scenario.

The fix is out, but the window is real

Stable kernel releases 7.1.6, 6.18.42, 6.12.101, and 6.6.148 (all shipped on 3 August) contain the patch. If you're running a kernel older than those on a system where SCTP is reachable — from within a container, from the network, or from an unprivileged local user — you're exposed. The good news is that most major Linux distributions have already pushed updated packages; the bad news is that patching kernel versions in production, especially in Kubernetes clusters, requires care and often a maintenance window.

Who should act now

If you run containerised workloads on Linux and haven't applied the August kernel updates, that's the immediate action item. Security teams operating under Australia's SOCI Act — particularly those in critical infrastructure sectors using containerised environments — should treat this as a high-priority patch given the container-escape demonstration. For everyone else: check whether your cloud provider's managed Kubernetes offering has applied the fix automatically, but don't assume.

The bigger picture

This lands in the middle of Black Hat USA 2026 week, which has produced an unusually dense cluster of novel research — the NatJack NAT-hijacking attack, MIT's TONTOU bypass of Spectre mitigations, and PortSwigger's AI-assisted HTTP desync work all dropped in the same 48 hours. Defenders are being asked to absorb a lot at once.

The 18-year lifespan of this flaw is a reminder that complex kernel code accumulates risk quietly. SCTP in particular has had a chequered security history. It won't be the last old bug to surface — but it's now one fewer to worry about, provided you patch.

What to watch: whether cloud providers issue explicit advisories about their managed Kubernetes kernel update status, and whether this surfaces as an active exploitation indicator in the coming weeks.

Also today

NatJack: The Attack That Hijacks Your TCP Sessions by Corrupting NAT Tables

Researcher Malcolm Stagg presented NatJack at Black Hat USA 2026 — a new attack class that manipulates how NAT devices track connection state to hijack active TCP sessions, spoof DNS responses, expose ports, and exhaust NAT tables entirely. The technique works across independently developed NAT implementations, including Windows and others, suggesting it's a structural weakness in how NAT state is managed rather than a quirk of any single vendor. It's the kind of foundational networking research that takes time to fully digest, but the cross-platform nature means the blast radius is unusually wide. Network defenders should watch for vendor advisories in the coming days.

The Hacker News ↗

MIT's TONTOU Attack Slips Past Spectre Defences on Intel and AMD

MIT researchers have disclosed TONTOU, a new speculative execution attack that reopens the branch predictor poisoning window used by Spectre by exploiting timer interrupts — effectively sliding an attack into the gap between when a defence check runs and when the speculative execution actually happens. The team demonstrated a working exploit on AMD Zen 2 hardware. Current Spectre mitigations don't block it. This is the kind of result that forces CPU vendors and OS kernel teams back to the drawing board on timing-based defences, and it arrived — like much else this week — during Black Hat season when vendor response queues are already full. Intel and AMD responses are pending.

The Register ↗

N-able's 'God Mode' Flaw: Attackers Got Through to Customer Networks Before the Second Hotfix

N-able has confirmed that attackers exploited a critical privilege-escalation flaw in N-central — a remote monitoring and management platform used by managed service providers — before a second hotfix could be deployed. The vulnerability gave attackers what researchers called 'god mode' admin access, which they turned into a pivot point to reach downstream customer networks. MSPs are high-value targets precisely because one compromised platform provides access to many clients simultaneously. Australian MSPs using N-central should verify they've applied both hotfixes and audit downstream client access logs for anomalous activity. N-able has told customers to patch again.

The Register ↗

WordPress Pre-Auth XSS Can Chain Into Full Server Code Execution — Patch Immediately

Every version of WordPress contains a pre-authentication reflected XSS vulnerability in the login screen, tracked as CVE-2026-64638 with a CVSS score of 8.9. Researchers at pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when an authenticated administrator visits an attacker-controlled page — no credentials needed to set the trap. With WordPress powering a substantial slice of the Australian web, including media, government, and small business sites, this is an urgent patch. WordPress has shipped a fix; hosting providers with managed WordPress offerings should be auto-applying it, but self-hosted installs need manual action now.

The Hacker News ↗

UNC6671 Vishes Its Way Into SaaS Accounts — and It's Been Rebranding as It Goes

A data extortion group tracked as UNC6671 is conducting a wave of voice phishing attacks against financial services, private equity, and professional services firms, impersonating IT help desk staff to trick employees into handing over SaaS credentials. The twist: attackers are calling personal mobile phones, not corporate lines, bypassing enterprise call-filtering controls. SecurityWeek separately reports the group has been cycling through brand names — BlackFile, Redact, Pink, Helix, Falcon — as law enforcement attention increases, suggesting a mature, well-resourced operation. The vishing-to-SaaS-compromise playbook has proven effective against Australian professional services firms in similar campaigns.

The Hacker News ↗

AI-Generated Security Patches Fail More Than Half the Time — and Can Introduce New Bugs

A study examining more than 6,000 AI-generated security patches found that fewer than half fully resolve the vulnerability they're meant to fix. The failures aren't just incomplete patches — many introduce new bugs, break adjacent functionality, or leave the original flaw open to bypass via a slightly different attack path. This matters because AI-assisted patching is quietly being integrated into developer workflows and vulnerability management tools, often with limited human review. The research suggests that AI patch generation needs a mandatory human validation layer, not as a nice-to-have but as a basic safety requirement before any patch ships to production.

CyberScoop ↗

AI-Assisted Tool Finds Novel HTTP Desync Techniques and an Apache Zero-Day

PortSwigger researcher James Kettle built an AI-assisted system called HTTP Terminator that explored 30,000 candidate HTTP desynchronisation vectors, generating and validating new attack techniques that human researchers hadn't identified before. The system also uncovered a zero-day in Apache Traffic Server through a separate human-guided discovery process. HTTP desync attacks — which exploit disagreements between how a front-end proxy and back-end server parse HTTP requests — have historically required deep manual expertise to find. Using AI to brute-force the search space is a meaningful methodological shift, and the Apache zero-day is a concrete proof that it works.

The Hacker News ↗

ByteDance Is Training a 10-Trillion-Parameter Model to Take On Anthropic

ByteDance, the company behind TikTok, is training an AI model with 10 trillion parameters — an order of magnitude larger than most publicly disclosed frontier models. The stated ambition is to compete directly with Anthropic at the frontier. Ten trillion parameters is a significant compute and infrastructure commitment, and it signals that Chinese AI labs are not ceding the frontier model race to US players. Australian organisations evaluating AI vendors should note that ByteDance's dual role as both a consumer platform and frontier AI developer raises distinct data governance and sovereignty considerations under Australia's Privacy Act.

Ars Technica ↗

Cloudflare's Kitesurf Is a Browser Built for AI Agents, Not People

Cloudflare has launched Kitesurf, a cloud-hosted browser purpose-built for AI agents performing web-based automation tasks. Unlike Chromium-based headless browsers, Kitesurf is designed from the ground up to minimise compute overhead for the kind of repetitive, structured tasks agents perform — clicking, form-filling, scraping — rather than the full rendering pipeline a human user needs. As AI agent frameworks proliferate, the infrastructure layer underneath them is quietly becoming its own market. Cloudflare's move positions it as a foundational provider for agentic AI workloads, sitting between agent orchestration platforms and the open web.

TechCrunch AI ↗

Cyberattack Hits All Three North Carolina Ports, Disrupting Gate Systems

A cyberattack disrupted gate systems at all three North Carolina ports simultaneously, with the US Coast Guard confirming it is monitoring the situation as investigators work to establish the scope and origin of the breach. Port gate systems control truck entry, container tracking, and cargo verification — disrupting them can halt logistics flows even without touching operational technology directly. The incident follows a week of heightened attention on critical infrastructure cyber risk after the Iranian water utility attacks. Port logistics infrastructure in Australia — particularly across the east coast container terminals — operates under SOCI Act obligations requiring cyber incident reporting and resilience planning.

CyberScoop ↗

New Mexico Court Orders Meta to Pay $567 Million Over Youth Mental Health Harms

A New Mexico judge has ruled that Meta created a 'public nuisance' through its social media platforms and ordered the company to pay $567 million into a remediation fund — $420 million of which is earmarked specifically for mental health treatment for young people harmed by the platforms. It's one of the largest judicial findings of direct liability for platform-driven harm to minors in US history. The ruling will be watched closely by Australian regulators: the Online Safety Act gives the eSafety Commissioner powers to pursue platform accountability for harms to minors, and the government has flagged further legislative action following ongoing parliamentary inquiries into social media's effect on young Australians.

The Record ↗

Sources consulted