Linux

New security evaluations show that cyber-capable autonomous agents can bypass traditional VM boundaries using complex exploit chains. The study suggests that standard virtualization is insufficient against intelligent software capable of rapid zero-day discovery.

Cybersecurity researchers have identified a sophisticated campaign where Sandworm-linked actors exploit Cisco FMC vulnerabilities to deploy Cyclops Blink malware. This updated malware variant features enhanced reconnaissance capabilities and targets 64-bit Linux-based network appliances.

This article details the dynamic analysis of the RedTail Linux malware, focusing on its ability to masquerade as legitimate system processes. The researcher demonstrates how the malware attempts to evade detection by killing monitoring tools and using DNS-over-TLS for network activity.

An autonomous AI agent was used to facilitate a sophisticated espionage campaign against the Thai Ministry of Finance. The attack utilized advanced post-exploitation tools and targeted big data infrastructure, though it was ultimately detected due to exposed attacker directories.

Perplexity has introduced SPACE, a new sandbox platform optimized for the stateful requirements of long-duration AI agents. By leveraging Firecracker and Btrfs, the platform enables high-performance session persistence, snapshots, and forking.

The Whisper_Bully tool demonstrates a sophisticated three-stage attack against Bluetooth Fast Pair devices. It leverages a specific vulnerability to bypass privacy randomization, followed by L2CAP flooding and connection hijacking.

Researcher Hyunwoo Kim discovered a high-severity use-after-free vulnerability in the Linux KVM subsystem called Januscape. This flaw enables untrusted guest VMs to break out of their isolation and potentially take control of the host operating system.

A new side-channel attack named FROST allows websites to bypass browser sandboxing by analyzing SSD latency. By using deep learning to process I/O traces, attackers can fingerprint the applications and websites running on a user's device.

Hyunwoo Kim has announced Dirty Frag, a zero-day local privilege escalation vulnerability that enables root access on all major Linux distributions. The disclosure includes functional exploit code and a script to mitigate the threat by removing vulnerable modules.