ShieldBreak is a newly disclosed Windows Defender zero‑day that bypasses the RoguePlanet patch, grants local SYSTEM privilege with 100% success, has been independently verified by researchers, and comes with detection queries and mitigation recommendations.
Security researchers disclosed CVE‑2026‑68138, a race‑condition flaw in the Linux kernel’s qdisc rate‑table code that lets an unprivileged user gain a root shell within seconds; it affects Linux 5.1‑7.1.5, has a publicly available PoC, and can be mitigated by applying upstream patches or disabling unprivileged namespaces.
OVSwrap (CVE‑2026‑64531) is a memory‑corruption bug in the Open vSwitch kernel data‑path that has lingered for 13 years; a low‑privilege local user can trigger a length‑wrap overflow to leak pointers, read kernel memory, and decrement fsuid/fsgid to gain root across dozens of major Linux distributions, with a publicly released PoC covering ~800 x86‑64 kernel versions and detailed mitigation steps.
The article dissects DirtyClone, a new DirtyFrag variant (CVE‑2026‑43503) that leverages the XFRM/IPsec path to achieve local privilege escalation on Linux, outlines its impact, timeline, technical exploitation steps, and provides mitigation recommendations for affected distributions.
On June 9, 2026, security researcher Nightmare Eclipse released the RoguePlanet zero‑day exploit that leverages a race condition in Microsoft Defender to spawn a SYSTEM‑level command prompt on Windows 10/11 machines fully patched with the June updates, while also hinting at a possible BitLocker bypass.
CVE‑2026‑40369 is an arbitrary kernel‑address write bug in ntoskrnl.exe that lets a low‑privilege attacker invoke NtQuerySystemInformation from the Chrome sandbox to gain SYSTEM rights on vulnerable Windows 11 and Server 2025 builds, with a fully functional PoC released on GitHub.
The article details the ssh-keysign-pwn vulnerability (CVE‑2026‑46333), explaining its exit‑mm/exit‑files race condition, how ordinary users can steal SSH host keys and /etc/shadow via pidfd_getfd, the affected Linux distributions, exploit steps, mitigation measures, and the broader context of May 2026 kernel security disclosures.
Dirty Frag is a newly disclosed Linux kernel page‑cache write bug that combines xfrm‑ESP and RxRPC primitives to deterministically corrupt struct sk_buff‑frag, allowing an unprivileged local user to gain root without race conditions, works across major distributions, and can be mitigated by disabling the affected modules.
The RedSun proof‑of‑concept demonstrates that when Windows Defender detects a malicious file marked with a cloud‑based detection tag, it may rewrite the file to its original location instead of isolating it, allowing an attacker to replace system files and obtain administrator privileges.
