It's been a crazy couple of weeks in the world of security. With the GitHub compromise, npm supply chain incidents, and Linux Kernel Privilege escalations falling out of the sky, it's hard to keep up with what's going on!
That's why I'm here ;)
Let's break down some of the big topics in exploit news!
GitHub Intrusion
On May 20, 2026, GitHub confirmed that attackers exfiltrated roughly 3,800 internal repositories after a poisoned VS Code extension ran on an employee's machine. The threat group TeamPCP claimed responsibility and is reportedly asking more than $50,000 for the stolen dataset. The strongest publicly identified candidate for the malicious extension is a trojanized version of Nx Console, published to the VS Code Marketplace on May 18, 2026 that was live for roughly 11 minutes before being pulled. The payload was a multi-stage credential stealer that harvested GitHub, npm, AWS, and 1Password material from any workspace the developer opened. Oof.
The incident also follows the April 28 disclosure of CVE-2026-3854, a critical GitHub vulnerability that allowed authenticated users to execute arbitrary commands on GitHub servers and exposed millions of public and private repositories, though GitHub has not linked the two events.
Linux LPE
Two related Linux kernel local privilege escalation vulnerabilities were disclosed within eight days of each other.
Copy Fail (CVE-2026-31431, CVSS 7.8) was disclosed on April 29, 2026 and stems from a 2017 in-place optimization in algif_aead, where AEAD operations set source and destination buffers to the same memory.
When a readable file is spliced into an AF_ALG socket, the kernel passes references to the file's page cache pages rather than making copies, enabling a controlled 4-byte write into the page cache of any readable file. This is used to corrupt setuid binaries and gain root.
Dirty Frag (CVE-2026-43284 and CVE-2026-43500), disclosed May 8, 2026 by researcher Hyunwoo Kim, who was forced to publish ahead of patches after a third party broke embargo, applies the same in-place optimization pattern to IPsec ESP receive and RxRPC.
The two vulnerabilities are chained, with xfrm-ESP providing a 4-byte STORE primitive and RxRPC providing the privilege to create the namespace. Notably, Dirty Frag works even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) has been applied, and in container deployments running arbitrary third-party workloads, the vulnerability may facilitate container escape in addition to host privilege escalation.
A follow-on vulnerability, CVE-2026-46300 (Fragnesia), was accidentally introduced by the patch fixing CVE-2026-43284, and a further variant called DirtyDecrypt has since been patched. Administrators should update kernels immediately and, where patching lags, blacklist algif_aead, esp4, esp6, and rxrpc modules.
NGINX Exploit
CVE-2026-42945, also called NGINX Rift, is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0 with a CVSS score of 9.2. The vulnerability was introduced in 2008 and permits an unauthenticated attacker to crash worker processes or execute remote code with crafted HTTP requests, though code execution is only possible on devices where ASLR is disabled.
The flaw stems from inconsistent state handling in NGINX's internal script engine, which processes rewrites in two passes: one to calculate the amount of memory to allocate, and one to copy the actual data.
An is_args flag remains set after a rewrite containing ?, causing NGINX to calculate buffer size using unescaped URI lengths but later write larger escaped data like + and &, leading to a heap buffer overflow.
Exploitation requires the rewrite directive to be followed by a rewrite, if, or set directive and an unnamed PCRE capture (such as $1, $2) with a replacement string that includes a question mark.
VulnCheck's Censys query surfaced roughly 5.7 million internet-exposed NGINX servers running a potentially vulnerable version, though the truly exploitable population is a much smaller subset, and active exploitation in the wild has been observed.
Fixes are available in NGINX Open Source 1.31.0 and 1.30.1, NGINX Plus R36 P4, and NGINX Plus R32 P6, and as a workaround F5 recommends replacing unnamed PCRE capture groups in vulnerable rewrite rules with named captures.
Tata!
Well that's it for now! Hope these newsletters are helpful in boiling down some of the fluff around recently attacks.
Reminder that if you want to learn how to code, lowlevel.academy has courses on programming at the lowest level, and stacksmash.io is a great place to learn to hack.
Happy Hacking!
Low Level
P.S. OMG YOU READ THE WHOLE THING. TOP SECRET PODCAST STARTS SOON DONT TELL ANYONE
