Summary

In September, more than 5,782 new vulnerabilities were discovered and addressed within the Linux ecosystem, impacting several major distributions such as Debian, Red Hat, OpenSUSE, and Ubuntu. During this period, over 352 vulnerabilities were also highlighted, with corresponding hotfixes or patches released to resolve them. These Linux vulnerabilities span from information disclosure to privilege escalation to code execution.

HiveForce Labs has identified 10 severe vulnerabilities that are exploited or have a high potential of successful exploitation, necessitating immediate attention. To ensure protection, it is essential to upgrade systems to the latest version with the necessary security patches and appropriate security controls.

Threat Distribution

Adversary Tactics

Vulnerability Details

1. #01

   September was a busy month for the Linux ecosystem, with over 5,782 vulnerabilities patched across major distributions and products, ranging from information disclosure bugs to privilege escalation and remote code execution flaws. Out of these, HiveForce Labs flagged 10 critical vulnerabilities that are either already being exploited or likely to be targeted soon, with three confirmed under active attack.

2. #02

   Chrome users face a more serious threat: two V8 zero-days, CVE-2026-85046 (a type confusion bug) and CVE-2026-87491 (an out-of-bounds write flaw), both allow remote code execution inside the sandbox via a malicious webpage. What makes CVE-2026-87491 especially dangerous is that it's used as part of a full exploit chain called BlueMoon, combining it with CVE-2026-85046 and a Windows kernel privilege escalation bug (CVE-2026-85880) to compromise a machine with a single click.

3. #03

   BlueMoon first surfaced on August 28, 2026, used by the China-linked group TA412 (also known as JungleBamboo or APT31), and was quickly picked up by several other espionage-focused actors, UTA0560, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket. Payloads delivered through this chain include the GRIMWEDGE backdoor, the SUPERSTOMP loader (which installs the credential-stealing LONGTALE/GemStone Chrome extension), ShadowPad, and various Rust-based loaders. Targets span NGOs, US aerospace and defense firms, mining and commodity trading companies, Vietnamese manufacturers, and government and financial institutions in Indonesia and Singapore.

4. #04

   CVE-2025-8088 is another zero-day flaw: a path traversal flaw in the Windows version of WinRAR that lets attackers run arbitrary code through specially crafted archive files.

5. #05

   On the Linux kernel side, CVE-2025-39964 fixes a race condition in af_alg sockets where concurrent writes could corrupt internal state, the fix now enforces exclusive write ownership. Separately, CVE-2026-53266 is a memory corruption bug in netfilter's bridge ebtables SNAT target, and CVE-2026-53362 is a buffer overflow in the IPv6 stack that lets an unprivileged local user trigger kernel corruption via crafted UDPv6 traffic.

6. #06

   A few application-layer flaws also stand out. CVE-2025-62593 affects Ray (the AI compute engine), its browser-based defense relies on checking the User-Agent header, which turns out to be trivially spoofable, making it exploitable via DNS rebinding against developers who visit a malicious site. It's fixed in version 2.52.0. CVE-2026-48710 in the Starlette framework stems from unvalidated Host headers, which could let attackers bypass security checks that rely on the reconstructed request URL, patched in 1.0.1.

7. #07

   Rounding it out, CVE-2026-64849 in MLflow allows attackers to bypass webhook URL validation through redirects, potentially exposing internal or cloud metadata services. And CVE-2026-66897 is a critical path traversal bug in Canonical LXD that lets an attacker with container access overwrite host files as root, leading to full host compromise.

8. #08

   With active exploitation confirmed on three fronts, especially the Chrome/BlueMoon chain, patching WinRAR, Chrome, and the affected Linux kernel builds should be treated as a top priority this cycle. Timely patching, strict configuration hardening, and defense-in-depth strategies remain essential to prevent system compromise.

CVEs

Notable CVEs

Recommendations

Proactive Strategies

1. 01
   Patch Actively Exploited Zero-Days First

   Prioritize WinRAR, Chrome (CVE-2026-85046, CVE-2026-87491), and the affected Linux kernel builds ahead of routine patch cycles, since these are already being exploited in the wild.

2. 02
   Enable Auto-Updates on High-Risk Applications

   Configure browsers and frequently targeted software to update automatically, shrinking the window attackers have to exploit newly disclosed zero-days.

3. 03
   Validate Redirects on Webhook Endpoints

   Pin and re-verify the resolved destination after redirects for services like MLflow, so SSRF techniques can't be used to reach internal or cloud metadata services.

4. 04
   Restrict Container and Template Permissions

   Limit who can edit or launch container images in platforms like LXD, reducing the risk of host-level compromise through path traversal flaws.

5. 05
   Isolate Developer Tools from General Browsing

   Keep AI/ML platforms such as Ray on separate networks or machines from everyday browsing to limit exposure to malvertising and DNS rebinding attacks.

6. 06
   Deploy Detection for Multi-Stage Exploit Chains

   Use EDR tooling capable of flagging chained exploitation behavior, since attacks like BlueMoon combine several CVEs to achieve full compromise from a single click.

Reactive Strategies

1. 01
   Isolate Hosts Showing Compromise Indicators

   If payloads like GRIMWEDGE, SUPERSTOMP, or ShadowPad are detected, disconnect the affected endpoint immediately to stop lateral movement.

2. 02
   Rotate Exposed Credentials and Sessions

   After detecting credential-stealing tools like the LONGTALE/GemStone extension, reset all potentially exposed passwords, tokens, and active sessions.

3. 03
   Hunt for Known Threat Actor Indicators

   Proactively search logs and endpoints for IOCs tied to TA412 and related clusters to catch any compromise that evaded initial detection.

MITRE ATT&CK TTPs

Detect, Mitigate & Patch

References & Patch Links

References

• https://lore.kernel.org/linux-cve-announce/
• https://github.com/leonov-av/linux-patch-wednesday
• https://www.debian.org/security/#DSAS
• https://lists.ubuntu.com/archives/ubuntu-security-announce/
• https://access.redhat.com/security/security-updates/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/