Active attack: Dirty Frag Linux vulnerability expands post-compromise risk

This collection highlights multiple active, high-impact threats and mitigation guidance from Microsoft Security Blog in May 2026. Notable items: “Dirty Frag” — a newly disclosed Linux local privilege escalation (kernel networking and memory-fragment handling, esp4/esp6/rxrpc) enabling reliable unprivileged→root escalation and observed limited in‑the‑wild activity; “Copy Fail” (CVE-2026-31431) — a high‑severity Linux root escalation affecting cloud and Kubernetes workloads with an active exploit; prompt-injection vulnerabilities in AI agent frameworks that can lead to remote code execution; a “