Reported by 1 outlet

Timeline

1. original reporting

   Dirty Frag — Microsoft confirms active exploitation, CVE-2026-43284 patched but CVE-2026-43500 remains unpatched with no fix timeline

   microsoft.com · 158d ago · May 9th, 2026

   Microsoft Defender is observing limited in-the-wild exploitation of Dirty Frag, with telemetry showing external SSH connections spawning interactive shells followed by execution of an ELF binary (./update) that triggers privilege escalation via su. Post-exploitation activity includes modification of GLPI LDAP authentication files, reconnaissance of system configuration, deletion of PHP session files, and harvesting of session contents — a blend of credential theft and operational disruption. As of May 8, CVE-2026-43284 (xfrm-ESP Page-Cache Write) has been patched in mainline Linux, but CVE-2026-43500 (RxRPC Page-Cache Write) has no available patches. The RxRPC vector is particularly dangerous because it requires only normal user privileges — no user-namespace creation needed — meaning it works on hardened Ubuntu systems where AppArmor blocks the ESP path. Qualys notes that the exploit does not touch files on disk: malicious changes persist only in RAM page caches until reboot or cache flush, making file-hash-based detection tools blind to exploitation. Organizations should disable esp4, esp6, and rxrpc kernel modules where operationally feasible, clear page caches (echo 3 > /proc/sys/vm/drop_caches), and prioritize kernel patches as vendors release them. Canada's Cyber Centre has issued alert AL26-011 with distribution-specific guidance.