TL;DR A researcher disclosed four Linux kernel privilege escalation flaws on September 18, 2026. Each one can give a local user root on affected systems. The full technical details and proof-of-concept exploit code are now public. Why these Linux kernel vulnerabilities matter The Linux kernel runs servers, clouds, and containers everywhere. A local root flaw breaks the last wall between users and full control.

Linux Kernel 7.0.8 is released with patches to fix the ssh-keysign-pwn (CVE-2026-46333) root exploit flaw. Update your Linux system today.

TL;DR A researcher published cups2root, a working proof-of-concept that escalates a local lpadmin user to root on CUPS. The exploit chains several configuration and privilege-boundary flaws. No CVE, vendor advisory, or patch exists yet. The PoC code is already public on GitHub. Why This CUPS Privilege Escalation Matters CUPS ships on most Linux desktops and many servers. As a result, the lpadmin group is common on real systems.

An entirely ordinary Android application, devoid of any requested permissions, can now seize absolute control over contemporary flagship smartphones. Calif researcher Lucas Maar brilliantly demonstrated a devastating attack vector targeting devices from Samsung, Xiaomi, Oppo, and OnePlus. Astonishingly, this exploit functions perfectly on smartphones operating with locked bootloaders and factory-standard firmware, effectively elevating an unprivileged application into an omnipotent process possessing maximum systemic rights.

TL;DR A researcher has published full details and a working proof-of-concept for a macOS privilege escalation bug. It turns an unprivileged user into root in about two seconds, with no user interaction and no password prompt. Apple fixed the flaw in macOS 26.6, yet assigned no CVE. Why it matters Local privilege escalation flaws let attackers finish a break-in. Malware that lands as a normal user can use this bug to seize full control.

Linux 4.14 are listed in the Linux CNA record read more about Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit