Copy Fail: New Linux bug enables Root via page‑cache corruption
2026-04-30T20:51:53Z•7d6b7e2849aa0d0ce387e5f8285084c4037013471c22964c75aa9065573183d7
CISACVE-2026-31431CVE-2026-3854CVE-2026-42208account-takeoveranodotauthentication-bypasscpaneldata-breachdsagithubinternet-censorshipknown-exploited-vulnerabilitieslinuxliteLLMlocal-exploitmetapage-cache-corruptionprivacyprivilege-escalationremote-code-executionrobloxsql-injectionvimeowhatsapp
What happened
Multiple high‑impact security incidents and vulnerabilities were reported: a local Linux privilege‑escalation bug dubbed “Copy Fail” (CVE-2026-31431) allows unprivileged users to write four controlled bytes into page cache enabling root escalation; a critical LiteLLM SQL injection (CVE-2026-42208) was exploited within ~36 hours to access/modify databases; a critical GitHub command‑injection/RCE (CVE-2026-3854) can be triggered via a git push; and all supported cPanel versions were patched for a critical authentication flaw. U.S. CISA added Windows Shell and ConnectWise ScreenConnect issues (e.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 7d6b7e2849aa0d0ce387e5f8285084c4037013471c22964c75aa9065573183d7
- Enrichment time
- 2026-04-30T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.