Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years

Unit 42-wide threat roundup with a focus on a newly disclosed, high-impact Linux kernel local privilege escalation dubbed “Copy Fail” (CVE-2026-31431) that allows stealthy root access across millions of systems. Other notable findings include evolving npm supply-chain attacks (wormable malware, CI/CD persistence), active exploitation of TP‑Link command‑injection (CVE-2023-33538) tied to Mirai‑style payloads, high‑risk Gen‑AI browser extensions exfiltrating data and credentials, multiple Amazon Bedrock/AgentCore weaknesses (IAM “God Mode” and sandbox escape via DNS tunneling/credential exposure