Daily · 2026-05-31
🛡️ CIFSwitch Linux LPE, Flowise RCE CVSS 9.9, Edge Password Leak, Russian Tech Theft, Microsoft vs Researchers
CIFSwitch Linux kernel LPE gives root on multiple distros (PoC published); Flowise CVE-2026-40933 CVSS 9.9 critical RCE targets AI agent builders with published exploit; Microsoft Edge stored all saved passwords in plaintext RAM — reversed course after community backlash; Russian intelligence accelerates Western tech theft as sanctions intensify; Microsoft threatens legal action against researcher Nightmare Eclipse over zero-day dumps, sparking widespread security community backlash.
The GlobalProtect story is the day's defining item. Palo Alto Networks raised CVE-2026-0257 to High severity and confirmed limited exploitation against unpatched devices, extending the waves Rapid7 reported; CISA's KEV entry carries a June 1 remediation deadline. Any unpatched gateway with authentication override and a shared certificate stays directly exploitable. GlobalProtect authentication bypass
The new patching item is CIFSwitch, a 19-year-old Linux kernel privilege escalation in the CIFS subsystem. An unprivileged user forges cifs.spnego key requests to load a malicious NSS module and reach root; the public PoC works by default on Linux Mint, CentOS Stream 9, Rocky Linux, AlmaLinux, Kali, and SLES 15 SP7. The kernel fix adds origin validation; disable CIFS or cifs-utils where unused.
The AI tooling item is equally urgent. CVE-2026-40933 is a CVSS 9.9 remote code execution in Flowise, the open-source agent builder, rooted in unsafe stdio serialization in its MCP adapter: importing a shared chatflow triggers tool enumeration that runs the attacker's command. Patched in 3.1.0; chatflow permissions are the secondary control. Microsoft Edge was found loading all saved passwords into memory at startup; it reversed that design after backlash, and Edge 148 decrypts on demand.
The wider context: European intelligence chiefs describe Russia intensifying technology theft, sabotage, and covert procurement, and Microsoft's threat of legal action against the researcher who dumped six Windows zero-days drew broad criticism over the chilling effect on disclosure. Watchlist: patch PAN-OS gateways before June 1, update Flowise and Edge, and disable CIFS where unused.