New Linux Kernel Vulnerability "RefluXFS" Grants Root Access via XFS Race Condition A critical Linux kernel vulnerability, CVE-2026-64600 (dubbed RefluXFS), has been disclosed by Qualys Threat Research Unit (TRU), allowing unprivileged local users to overwrite protected system files and escalate to root privileges even on systems with SELinux in Enforcing mode. The flaw stems from a race condition in the XFS filesystem’s copy-on-write (CoW) path, triggered when two concurrent O_DIRECT writes target the same reflinked file. ### How the Exploit Works XFS normally handles reflinked file writes by allocating new blocks, but the kernel briefly drops its inode lock while waiting for transaction log space. During this window, a second write operation can remap the file and drop the reference count, causing the first write to corrupt the original block using a stale reference. Since O_DIRECT bypasses the page cache, the malicious write persists on disk without leaving kernel logs, making detection nearly impossible. Qualys demonstrated a proof-of-concept on a default RHEL 10.2 deployment, silently removing the root account’s password protection in seconds, granting passwordless root access that survives reboots. ### Scope & Impact - Affected Systems: Linux kernels 4.11+ (since 2017), including RHEL 8/9/10, CentOS Stream, Oracle Linux, Rocky/AlmaLinux, Amazon Linux 2023, and Fedora 31+. - Lower-Risk Distros: Debian, Ubuntu, and SUSE are only vulnerable if XFS is manually configured with `reflink=1`. - Conditions for Exploitation: - Kernel 4.11+ without the patch. - XFS filesystem with `reflink=1` enabled. - A writable directory for an unprivileged user and a high-value target (e.g., SUID-root binary). - Estimated Impact: Over 16.4 million systems worldwide, per Qualys’ analysis. ### Security Bypass & No Workarounds The flaw operates below conventional kernel hardening mechanisms, evading protections like: - KASLR, SMEP, SMAP (memory protections). - Kernel lockdown (no restriction on O_DIRECT/FICLONE). - SELinux (does not block the vulnerable code path). - Container isolation (user-namespace restrictions and capability limits fail to mitigate). No reliable workaround exists patching is the only solution. ### AI-Assisted Discovery & Broader Trend The vulnerability was identified through a joint research initiative between Qualys and Anthropic, using Claude Mythos Preview to hunt for Dirty COW-style race conditions. After iterative prompting, the AI model pinpointed the XFS flaw and generated a working PoC, later verified by Qualys engineers. This follows a 2026 trend of high-impact Linux privilege-escalation bugs, including: - CVE-2026-46333 (nine-year-old ptrace flaw). - CrackArmor (AppArmor-based root-access chain, affecting 12M+ systems). - DirtyClone, DirtyFrag, and Copy Fail (page-cache corruption bugs). ### Vendor Response & Patching Fixed kernels are already available for RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora, with backports in progress. Organizations are advised to apply updates and reboot affected systems, particularly internet-facing and multi-tenant environments, as no interim mitigation exists.

GhostApproval Vulnerability Exposes Critical Flaw in Major AI Coding Assistants A newly identified vulnerability, dubbed GhostApproval, has revealed a systemic security flaw in six widely used AI coding assistants Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf allowing attackers to bypass human-in-the-loop (HITL) safety controls and potentially achieve remote code execution on developers' machines. Discovered by Wiz researchers, the exploit leverages symbolic link following (CWE-61), a technique historically used in Docker escapes and privilege escalation attacks but now repurposed to target AI coding tools. The attack is deceptively simple: an attacker crafts a malicious repository containing a symlink (e.g., project_settings.json → ~/.ssh/authorized_keys). When a developer clones the repo and instructs their AI assistant to "set up the workspace," the agent follows the symlink, writing the attacker’s SSH public key directly to the victim’s authorized_keys file, granting persistent, password-less access. What makes GhostApproval particularly insidious is its UI misrepresentation layer (CWE-451). In testing, Anthropic’s Claude Code demonstrated this flaw: while the agent’s internal reasoning correctly identified the symlink’s true target (e.g., a zsh configuration file), the user-facing prompt merely asked, "Make this edit to project_settings.json?" This discrepancy turns HITL safeguards into a false sense of security, as users unknowingly approve malicious actions. ### Vendor Responses & Patches Three vendors issued fixes: - Amazon Web Services (AWS) patched the issue in language server v1.69.0 (May 27, 2026, CVE-2026-12958). - Cursor released a fix in v3.0 (June 5, 2026, CVE-2026-50549). - Google (Antigravity) deployed a fix on May 22, 2026, though it has not yet assigned a CVE. Augment and Windsurf acknowledged the reports but had not fully addressed the issue at the time of disclosure. Windsurf’s pre-authorization variant was especially dangerous, as the agent wrote files to disk before displaying the confirmation dialog, effectively making the prompt an "undo" rather than a security gate. Anthropic initially rejected the report, arguing that user-trusted directories and approved prompts shifted responsibility to the end user. However, after further review, versions 2.1.173+ now resolve symlinks and warn users before writing to sensitive files a change that had been implemented in v2.1.32 (February 5, 2026) as part of internal security hardening. ### Mitigation Recommendations Wiz researchers outlined three key defenses for AI coding tool vendors: 1. Resolve symlinks before displaying prompts always show the canonical target path. 2. Warn explicitly when resolved paths exit the workspace writes to ~/.ssh/authorized_keys should be visibly distinct from those to ./config.json. 3. Never write to disk before explicit user authorization confirmation dialogs must act as security gates, not undo mechanisms. The vulnerability was first discovered on February 10, 2026, with vendor reports submitted between February 12 and March 5, 2026. Public disclosure occurred on July 8, 2026, following a 90+ day coordinated disclosure window. GhostApproval highlights a category-level design gap in AI coding assistants, where HITL controls intended as a last line of defense can be systematically bypassed. As AI agents gain greater autonomy over developer filesystems, the integrity of these controls must be treated as a first-class security requirement.

Cisco Researchers Warn of Multi-Turn Attacks Bypassing LLM Safety Guardrails Researchers at Cisco have uncovered a critical vulnerability in leading large language models (LLMs), demonstrating that their safety guardrails can be bypassed through multi-turn conversations. The study tested widely used models including OpenAI’s ChatGPT, Anthropic’s Claude, Google Gemini, Amazon Nova, and xAI’s Grok revealing that none were fully resistant to exploitation. The attack method relies on prolonged, iterative dialogue, where adversaries refine prompts, adopt personas, or gradually escalate requests to circumvent built-in protections. Unlike single-prompt testing, which many organizations rely on for safety evaluations, real-world attackers persist across multiple exchanges, exposing gaps in current security benchmarks. Key findings include: - No model was immune to multi-turn manipulation, challenging existing AI safety assessments. - Techniques like roleplay, ambiguity, and reframing requests proved effective in bypassing guardrails. - Configuration matters: For example, Grok became significantly more vulnerable when "reasoning mode" was enabled. The report highlights a disconnect between current safety evaluations and real-world threats, warning that enterprises deploying LLMs may underestimate risks. As regulators push for improved testing standards, Cisco’s research underscores the need for more robust defenses against evolving attack vectors.

Braintrust Urges API Key Rotation After AWS Cloud Breach Exposes Customer Secrets AI evaluation startup Braintrust has instructed customers to revoke and replace their API keys following unauthorized access to an Amazon Web Services (AWS) cloud account containing sensitive credentials. The breach, disclosed in an email sent to customers on Monday and later posted on the company’s website, involved an AWS account storing API keys used to access cloud-based AI models. Braintrust confirmed the incident was contained, locking down the compromised account, auditing related systems, and rotating internal secrets. While the company stated it had only identified one impacted customer and found no evidence of broader exposure, it advised all users to rotate their stored API keys as a precaution. The cause of the breach remains under investigation. In a statement to TechCrunch, Braintrust spokesperson Martin Bergman emphasized the move was taken "out of an abundance of caution," noting no evidence of a confirmed breach at the time of disclosure. The startup, which provides a platform for monitoring AI models and raised $80 million in a February funding round valuing it at $800 million, positions itself as an "operating system for engineers building AI software." Cybersecurity experts warn the incident could have downstream effects for affected customers, particularly AI companies reliant on Braintrust’s infrastructure. Similar breaches, such as the 2023 attack on CircleCI, have demonstrated how compromised cloud accounts can expose API keys, allowing attackers to impersonate legitimate users and access systems without direct infiltration. Recent high-profile incidents, including a 2024 breach of an AWS account tied to the European Commission that exposed 92GB of data, underscore the growing threat of cloud-based credential theft.

North Korean Hacking Group Linked to Multiple NPM Supply Chain Attacks Amazon’s Threat Intelligence team has attributed a series of high-profile software supply chain compromises to a single North Korean threat actor, tracked under aliases including SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. Between March 2025 and March 2026, the group targeted widely used NPM packages, including axios, debug, chalk, and typo-crypto, by socially engineering trusted maintainers to distribute trojanized updates. The axios package alone sees over 100 million weekly downloads, making it one of the most critical JavaScript libraries in use. Organizations that automatically pulled these updates unknowingly executed the malicious code. During the debug and chalk compromise in September 2025, Wiz Research found that 1 in 10 cloud environments were affected within two hours. Amazon assesses the attacks as financially motivated, leveraging the efficiency of breaching a few high-impact packages to infiltrate thousands of downstream systems. The group has evolved its tactics, shifting from single malicious packages to fragmented workflows spread across multiple seemingly benign dependencies. Attackers now exploit generative AI to craft convincing code, documentation, and maintainer identities, making detection harder. Techniques include slopsquatting registering package names hallucinated by AI coding assistants and embedding hidden instructions in comments or README files to bypass automated AI reviewers. Amazon warns that traditional signature-based detection is becoming less effective, as attackers mutate code to evade static analysis. The company has expanded its Amazon Inspector capabilities and contributed $12.5 million to the Linux Foundation’s Akrites initiative to bolster open-source security against AI-driven threats. The shift toward AI-generated malware suggests future ransomware campaigns may adopt similar techniques.

Malicious VS Code Extensions Target Solidity and Ethereum Developers with Credential Theft Security firm Yeeth Security uncovered a campaign involving malicious Visual Studio Code (VS Code) extensions, disguised as "Solidity Pro", designed to steal sensitive credentials from Solidity and Ethereum developers. The extensions helper-beeps.solidity-pro and web3devtoolsx.solidity-pro harvested GitHub tokens, cloud credentials, wallet seeds, SSH keys, and other sensitive data, exfiltrating stolen information via a Telegram bot. While the extensions are no longer available on Open VSX, the web3devtoolsx/solidity-pro GitHub repository remains accessible. ### Evolution from Loader to Full Credential Stealer Early versions (1.0.0–2.4.x) functioned as loaders, fetching encrypted Python payloads from Cloudflare Workers. However, version 3.0.0 and later evolved into a full-fledged information stealer, expanding its capabilities to collect: - Source control tokens (GitHub `ghp_`, `github_pat_`; GitLab `glpat-`) - Cloud credentials (AWS keys, Cloudflare `cfat_` tokens, OpenAI API keys) - Wallet data (MetaMask, Phantom, Rabby, Coinbase, Trust, Keplr vaults; Bitcoin WIF/xprv keys) - SSH private keys, URL credentials, and 1Password MFA tokens ### Evasion Tactics and Delayed Activation To bypass detection, the extensions employed heavy obfuscation, splitting strings across immediately-invoked function expressions (IIFEs) and reassembling them at runtime. Operators also published clean intermediate versions to build trust before activating malicious behavior hours or days after installation, evading short-term sandboxing and casual review. ### Connection to WhiteCobra and Additional Threats Yeeth linked the campaign to the WhiteCobra cluster, previously associated with Lumma Stealer delivered via VS Code extensions. A related extension, ethdevtools.solidity-language-support, contained a delayed-activation clipboard stealer that swapped cryptocurrency addresses via `vscode.env.clipboard.writeText`. Beyond extensions, researchers identified the npm package `ascii-fetcher`, which concealed malicious code in its dependency `@jaymara/jsononifier`. This dependency executed hidden commands using `child_process.exec` with `windowsHide`, allowing silent execution during installation. ### Broader Attack Surface: VS Code Forks and Droppers Yeeth also reported ten additional rogue VS Code extensions delivering Windows BAT, JavaScript, and HTA droppers. One extension, DigitalBarberTrim.html-entity-codec, dropped a remote VSIX payload after enumerating installed VS Code forks (Cursor, Windsurf, Codium, Positron), tailoring attacks to the specific editor in use. ### Impact: Developer Authority and Supply Chain Risks The stolen credentials grant attackers direct access to repositories, cloud infrastructure, and cryptocurrency wallets, enabling both fund theft and supply-chain compromise. A single compromised developer machine could lead to wider organizational breaches, underscoring the need for provenance checks, allow-list management, and behavioral monitoring in extension supply chains. The campaign highlights persistent risks in developer-targeted attacks, where marketplace moderation alone is insufficient to prevent delayed-activation threats.