At the Corner of Wit's End and Shady

  TL;DR: LPE scores low in vulnerability management because it requires local access to exploit. That's the wrong frame once an attacker already has a foothold: LPE invalidates your security architecture and compresses lateral movement time to near zero. Here's something you might not think about: Building codes save more lives from fire than firefighters do. When you look at the sheetrock in a modern home, you don't stop to consider that someone did fire resistance testing. The code works because it's invisible, unglamorous, and does its job before the fire starts. Security architecture works the same way. When a network is built right, attacks can't spread quickly. Incidents get mitigated down to inconveniences. Nobody notices. Most security programs never evaluate what happens when flammable materials end up somewhere they weren't designed to be stored. Cluttered garages degrade fire resistance. A building's fire resistance rating is calibrated fo...

TL;DR: The past week was an AI-empowered security disruption that was built on capabilities already surpassed. Reflect on your Copy Fail and Dirty Frag response while it's fresh. Flag every extraordinary effort, every gap. Design tomorrow's response like you'll need to do this every day. You will. Copy Fail (CVE-2026-31431) is a Linux kernel local privilege escalation: an unprivileged local user to root, immediate, on all major distributions. CISA added it to their Known Exploited Vulnerabilities (KEV) catalog two days after disclosure, the agency's clearest signal that a vulnerability is being actively exploited and needs immediate attention, with a May 15 federal remediation deadline. Before that deadline closed, Dirty Frag dropped: a chained exploit (CVE-2026-43284, CVE-2026-43500) extending the same bug class, bypassing the Copy Fail mitigation entirely, public PoC, no patch at disclosure. Same capability. Not on the KEV catalog. Both were found using AI-assisted r...

  TL;DR: Your logging probably misses this one. Here's what to hunt and why getting to a real alert is harder than it should be. What the exploit actually does Copy Fail (CVE-2026-31431) is a logic flaw in authencesn , a kernel AEAD wrapper used by IPsec. The exploit binds an AF_ALG socket (the kernel's userspace crypto interface) to authencesn(hmac(sha256),cbc(aes)) , uses splice() (a syscall that moves file data between descriptors without copying) to feed the kernel's in-memory copy of a setuid binary into the crypto scatterlist, and triggers a decryption operation. Setuid binaries run as root regardless of who calls them. su and sudo are the common targets. A bug in authencesn writes 4 attacker-controlled bytes past the intended output boundary, landing in those in-memory pages. recvmsg() returns an error because the HMAC fails, but the write already happened. The exploit repeats this for each chunk of shellcode, then calls execve("/usr/bin/su") . T...