🐧 Linux Copy Fail 0-Day Escapes Containers, 🔴 cPanel Zero-Day Exploited Since February, 🇰🇵 DPRK PromptMink LLM Supply Chain

The Copy Fail Linux kernel zero-day is the day's defining story. A logic flaw in the authencesn cryptographic template, reachable through the AF_ALG socket interface and the splice syscall, lets any unprivileged local user gain root with a single 732-byte Python script using only the standard library. The bug dates to a 2017 optimization in algif_aead.c that places page-cache pages into a writable scatterlist, producing a controlled four-byte write into in-memory setuid binaries such as /usr/bin/su. Because corrupted pages are never marked dirty, on-disk files stay untouched and checksum-based integrity tools see nothing. It is confirmed on Ubuntu, Amazon Linux, RHEL, and SUSE, and it escapes containers.

Famous Chollima's PromptMink campaign is the other notable item. North Korea's group used AI coding assistants to slip a malicious package into an open-source project, with clean bait packages silently importing the payload, a template for poisoning the AI-assisted supply chain. VECT 2.0 is expanding past its broken encryptor with the Starkiller adversary-in-the-middle phishing framework, which generates dynamic pages per session and defeats MFA in real time; it counts 20 victims across manufacturing, education, healthcare, and technology.

The ProFTPD SQL injection allows pre-auth RCE and privilege escalation on more than 162,000 exposed instances, and it ships with cPanel, Plesk, and other control panels. The Qinglong task scheduler auth bypasses have been exploited for cryptomining since February.

Watchlist: apply the kernel update across every distro, patch ProFTPD, audit dependencies introduced by AI-assisted development, and scan for Starkiller-style phishing landing pages.