DirtyClone: Fourth Linux Kernel Flaw in Six Weeks Escalates to Root
2026-06-27T14:51:44Z•40c183da5686f18f5613e6af532faacc337ef1a0fedcb1722e75372af203f36b
CISACL-STA-1062CVE-2026-12569CVE-2026-20245CVE-2026-43503Chinese-APTCiscoDPRKDirtyCloneFlexPLMGaslightKnown-Exploited-VulnerabilitiesPTCPolymarket','crypto-theft'SD-WANTinyRCTWindchillkernellinuxmacOSmalwareprivilege-escalationprompt-injectionthird-party-breachzero-day
What happened
Feed of June 25–27, 2026 security news: JFrog disclosed a local Linux kernel privilege escalation dubbed DirtyClone (CVE-2026-43503, CVSS 8.8) that rewrites executables in memory with no disk traces. CISA added critical Cisco and PTC Windchill/FlexPLM flaws to its KEV list (including CVE-2026-12569), and a Cisco Catalyst SD‑WAN zero-day (CVE-2026-20245) was confirmed as exploited in the wild. Threat actor coverage includes China-linked CL-STA-1062 targeting Southeast Asian government and energy networks with custom tooling and a TinyRCT backdoor, and a DPRK-linked macOS implant (macOS.Gaslight
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 40c183da5686f18f5613e6af532faacc337ef1a0fedcb1722e75372af203f36b
- Enrichment time
- 2026-06-27T14:51:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.