A working exploit has replaced container isolation as a stopping point on affected Ubuntu hosts.
Working code covers two unprivileged kernel races and includes test targets and a Docker harness.
Linux containers on Ubuntu 24.04 and 26.04 hosts sharing the host kernel.
Container escape followed by kernel-level execution and root control of the host
Complete public exploits turn ordinary container-local execution into host-root execution across vulnerable Ubuntu estates.
The two paths begin with unprivileged AF_UNIX/SCM_RIGHTS garbage collection or reuseport cBPF operations. Each produces a kernel use-after-free that the released heap-shaping code converts into a kernel read/write primitive.
From there, the exploit escapes the container and executes as root on the Ubuntu host. Fixes are published and revocation is complete, but pre-fix images remain accepted.
xdg-dbus-proxy, the D-Bus filtering proxy used by Flatpak and some other Linux application sandboxes.
xdg-dbus-proxy accepted a chosen reply serial on a non-reply message, treated it as an allowed reply and permitted the application to invoke a host-session D-Bus service. Release 0.1.9 fixes the filter.
Apache Tomcat, a cross-platform Java Servlet and WebSocket application server.
A network client can make Tomcat interpret an attacker-supplied candidate path as an endpoint template and reach a protected WebSocket endpoint without the configured authentication constraint. Apache has published the correction.
Next.js applications using the Node.js next/og ImageResponse implementation to generate images from attacker-controlled values, on hosted or self-managed Node.js servers.
The path exists only where an application feeds request-controlled values into Node.js ImageResponse. Satori can serialize those values as active SVG or XML structure, allowing XInclude, entity and path data to reach the native rasterization stack and its memory-corruption chain.
A public reproduction executed commands twice on Next.js 16.3.5 and failed against 16.3.6 controls. The fix is published, although pre-fix images remain accepted.
F5 BIG-IP Access Policy Manager, an edge access and authentication appliance, when an OAuth profile is attached to a virtual server.
On a virtual server with both an access policy and OAuth Authorization Server profile, an oversized Authorization header can corrupt a callback pointer. Heap shaping and a ROP chain append a command to the TMM finish script, which executes when TMM crashes.
A fix is published, but pre-fix images remain accepted.
Red Hat Ansible Automation Platform automation-controller on RHEL and OpenShift, which runs stored jobs across managed infrastructure.
With AAP behind its gateway and the proxy allow-list empty, a template viewer can read the provisioning callback key, spoof X-Forwarded-For and launch the stored template against an attacker-selected inventory host using saved credentials. Red Hat has shipped updates.
GitHub Enterprise Server, self-hosted source-code collaboration appliances; unauthenticated exposure applies when private mode is disabled.
Unsafe handling of an explicit URL port permits blind SSRF to co-located services. A timing oracle can recover appliance secrets, which are then used in a separate internal interaction to execute code.
The route is anonymous when private mode is off and otherwise requires an ordinary account. Fixed releases are available, but the affected population reaches end-of-life hardware.
Check Point Security Management, Log Server and Multi-Domain management products that administer enterprise security gateways.
Today's scope update pins the path to the management service on TCP port 19009: a pre-authentication traversal reaches attacker-directed script execution and arbitrary Java class loading. Check Point has published a fix.
DJI Neo, Flip, Air, Avata, Mavic, and Mini consumer aircraft running embedded flight firmware.
Most BLE-exposed DUML commands require no pairing, trusted UUID, credentials or operator interaction. The released console demonstrates Wi-Fi credential changes, radio disruption, reboot, power-off and configuration resets.
The held evidence establishes configuration and disruption authority, not a complete mid-flight takeover or arbitrary flight-command path.
HPE Networking Analytics and Location Engine, an appliance that analyzes clients and location data from Aruba wireless infrastructure.
A network client can present product-wide credentials to reachable ALE CLI, web-management or system-login interfaces without possessing a deployment-specific secret. HPE has published a fixed release.
We do not know which account yields complete appliance control because the advisory does not map the accounts to their shells, permissions or privilege levels.
IBM Financial Transaction Manager for Red Hat OpenShift, a containerized financial-transaction processing platform with an AI-agent component.
The runbook-upsert path accepts attacker-authored content without authentication and stores it in the agent's trusted retrieval corpus. A later matching task can retrieve the poisoned runbook and steer MCP calls toward unauthorized payment actions or payment-data exfiltration.
We do not know whether the agent server is enabled by default or whether sensitive tool calls encounter a later approval gate. IBM has published a fix, but pre-fix images remain accepted.
DJI Neo, Flip, Air, Avata, Mavic, and Mini consumer aircraft using DJI Fly and QuickTransfer.
A nearby listener can capture an ordinary connection or QuickTransfer exchange without transmitting or pairing, then use the public parser to recover the aircraft's SSID, persistent PSK and trusted-client UUID.
Those values support joining the aircraft's internal Wi-Fi and presenting an already trusted identity, but they do not alone establish arbitrary flight control.
HeyCyan-compatible low-cost camera and AI smart glasses and their companion-phone ecosystem, sold under multiple retailer brands.
Commissioned testing of two retail pairs found that an unpaired phone could connect without a password while the owner's phone was disconnected, retrieve media and create photos or recordings.
The exact models, firmware versions and full population of affected rebrands were not published.
Softaculous Virtualizor, a Linux-hosted VPS and hypervisor control panel whose administrative web process runs as root.
The path requires exposed administrative ports, in-house billing and an eligible suspended account. MySQL coerces the numeric prefix of a shell-bearing uid while the original string survives into a command executed by the root PHP-FPM pool.
A public exploit module exists, and a researcher retested the vendor fixes on September 20. The fix was not read for this brief, so the item cannot lead.
SolarWinds Observability Self-Hosted, an on-premises monitoring and observability platform running on Windows Server.
SolarWinds attributes the result to insufficient integrity checking on an undisclosed remotely reachable input path. The required configuration, endpoint, accepted object and execution context remain unidentified.
A fix is published, but it was not read for this brief, so the item cannot lead.
D-Link DAP-1360 wireless access points running embedded router firmware.
The formSystemCheck handler places the ipv4_ping parameter into a shell command without neutralizing separators. The public request-level proof of concept produced uid 0 on an emulated extracted firmware image.
D-Link classifies the line as end-of-life and recommends replacement rather than providing a patch.
Manic, an Android banking-malware and spyware family targeting financial, identity, government, messaging, and authentication applications.
The source phone must already run the implant with Accessibility and notification access, and a nearby infected handset must provide a route. Manic moves AES-GCM-encrypted queues over Wi-Fi Direct, Bluetooth RFCOMM or BLE through as many as four infected peers until one reaches the command server.
ThreatFabric identified the malware as actively distributed. The new capability defeats direct-network isolation of an already infected phone; it does not remove the initial compromise requirement.
D-Link DIR-822A, a dual-band Wi-Fi router running embedded firmware.
An unauthenticated DHCP packet from the LAN can corrupt the stack of the D-Link DIR-822A DHCP daemon. An overlong TR-111 Option 125 suboption reaches an unbounded strcpy into a bounded stack buffer in udhcpcd.
The held evidence does not demonstrate controlled instruction flow, command execution or the daemon's privilege context.
No additional findings today.
No new signed-component revocation or bootloader capability change surfaced; current material added hashes, affected boards and remediation to the existing Secure Boot bypass.
The two DJI PoCs expose distinct nearby positions: active unauthenticated configuration control and passive recovery of persistent trust material.
The material changes were GitLab incoming-email token scope, IBM payments-agent corpus poisoning and the now-specific Check Point pre-authentication execution path.
The same brief, every morning. One email a day, nothing else.
fullchain.sh follows the day’s disclosures from bug to shell — what each one enables, what it links to, and where the fix left the primitive in place.
Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.