Container namespaces and Android’s application sandbox each became paths to more privileged execution.
Unprivileged container code is sufficient on the demonstrated target, and several current Ubuntu kernel packages were still listed as vulnerable on September 24.
The Linux kernel, including vulnerable Ubuntu kernels used by Docker and Kubernetes container hosts.
Container escape to host root and kernel-level execution
A container workload can cross the host-kernel boundary without container privileges, and usable exploit code is public.
The chain starts with a concurrent AF_UNIX send-and-close race. It leaves a freed garbage-collector vertex linked into a persistent SCC ring, and a later collection pass traverses that freed object.
The published target-specific exploit converts that corruption into kernel execution and host root. Upstream fixes exist, but the Ubuntu package state made remediation incomplete as of September 24.
The first two questions are not established by the available evidence; this is a host-kernel source fix, with no documented artifact rejection or revocation component.
The same APK worked on stock OnePlus 15 and OnePlus 12 Pro devices; OnePlus says additional OnePlus and OPPO products are affected.
OnePlus OxygenOS, the vendor Android distribution on OnePlus phones; OnePlus says related OPPO products are also affected.
Root command execution from an ordinary Android application
The chain starts in Android’s ordinary untrusted_app domain with no requested permissions and ends in a vendor shell with all Linux capabilities.
An unrestricted AtlasService Binder call places attacker-controlled text into audioDumpInfo, which interpolates it into system() while running as UID 0. That first step provides a restricted root process in the dumpstate domain.
The process can then call olc2 doShell, whose only caller check is UID 0, and execute commands in vendor_qti_init_shell with all capabilities. OnePlus announced remediation, but it did not publish a complete affected-product list.
Dell 17G Boot Optimized Server Storage N-1 controllers used as operating-system boot storage in PowerEdge and related servers.
Physical bus access, or equivalent access after an iDRAC compromise, reaches unauthenticated S-MCU debugging and update paths. Modified firmware can then redirect verification reads to the unchanged slot.
Dell published remediation, but pre-fix firmware images remain acceptable.
Codex CLI, a local AI coding agent and plugin client on developer workstations.
A branch named after the reviewed commit could win Git’s ambiguous-ref resolution because the updater did not check the resulting HEAD. The replacement plugin then ran with the Codex user’s local and connected access.
The published fix compares the resolved HEAD with the pinned commit.
Secure Folder by FluteCode, a password-protected file-vault application for Android.
A local application with broad shared-storage access, or a person using a capable file manager, can read the originals under Documents/.SecureFolder without entering the PIN.
The evidence covers imported media and documents, not the application’s notes, passwords or payment-card database.
GitLab.com and GitLab Self-Managed source-code hosting and CI/CD installations with incoming email enabled.
The address embeds a non-expiring account-wide token. Changing its suffix to the merge-request route and attaching a patch can create commits as the owner, modify CI and operate outside project IP restrictions.
GitLab changed its wording but left the underlying token and sender-handling mechanism intact.
F5 BIG-IP Access Policy Manager, an application-delivery and remote-access appliance deployed at enterprise network edges.
Only virtual servers combining an APM policy with an OAuth authorization-server profile expose the path. An oversized Bearer header can corrupt an adjacent callback and reach command execution through a ROP chain and the tmm.finish hook.
F5 published fixes, but it continues to accept pre-fix software images.
Check Point Security Gateway and Spark Firewall, embedded network-security appliances providing firewall and VPN services.
Malicious certificate data supplied during VPN negotiation can execute code before authentication in the gateway service context.
The exact fixed hotfix and build matrix could not be confirmed from the available record.
Altera Trusted Firmware for ARM Hard Processor System SoCFPGA platforms, providing the BL31 EL3 secure monitor beneath an embedded operating system.
High-privilege normal-world code can pass attacker-selected addresses and sizes to insufficiently validated SiP handlers; separate VAB and HKDF paths expose EL3 memory-corruption conditions.
The records do not establish controlled EL3 execution, key extraction or persistence.
Norwegian Cruise Line shipboard door-access controllers using NTAG212 NFC keycards.
The reader authenticates only the card’s cleartext seven-byte UID, with no cryptographic challenge-response. Reading range is approximately 2–5 centimeters, and the duplicate still must be presented at the protected door.
Roundcube Webmail, a self-hosted browser-based email client commonly deployed on Linux hosting servers.
The exposed population is limited to installations using the optional virtuser_query plugin. There, a backslash-escape bypass lets login input reach SQL before authentication, enabling database commands, authentication bypass or access to Roundcube records.
Roundcube has published fixed releases.
WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway, Java-based API-management and gateway services.
WSO2’s account says an unsupported signing algorithm can yield administrative account takeover. CISA’s account instead names path traversal, unrestricted upload and remote code execution.
We do not know whether the CVE conflates two vulnerabilities or how the asserted upload path relates to the JWT flaw.
ViewSonic ViewBoard Android smart displays running the vCast/EShare wireless-presentation service.
The unauthenticated vCast control socket accepts an attacker-selected APK URL and key-event commands that approve the Android installation prompts.
Rapid7 Insight Agent on Windows, an endpoint agent that runs centrally delivered InsightVM assessment content.
The attacker first needs a non-administrator-writable machine PATH directory ahead of Visual Studio Code. A planted executable named code is then selected by a SYSTEM assessment check.
Rapid7 says corrected assessment content was delivered automatically to all agents.
AMD Versal Prime, Premium, AI Edge, AI Core, HBM, and RF adaptive SoCs, including specified Versal Premium Gen 2 devices used in embedded systems.
After non-trivial board modification exposes the test-only mode, a crafted USB image can overflow a buffer and replace an active function pointer.
AMD identifies release 2026.1 as the mitigation.
MrSteam iSteamX, a mobile application and connected hub used to monitor and control residential steam generators.
An overbroad AWS policy exposed wildcard MQTT topics for other customers’ telemetry and start-or-stop commands.
CISA says vendor countermeasures became effective September 18 but names no fixed application or firmware build.
AMD Zynq UltraScale+ MPSoCs, Zynq UltraScale+ RFSoCs, and Kria system-on-modules using the optional USB boot implementation.
The route is limited to builds that include and enable USB boot. Excessive DFU download requests then overflow the DDR receive buffer into FSBL memory.
Unauthorized preboot execution remains potential; controlled instruction flow has not been demonstrated in the available record.
nimble_zta, an Elixir authentication library used by Phoenix and Plug server applications behind Cloudflare Zero Trust.
The library discarded JOSE’s signature-verification verdict and returned decoded claims even after verification failed.
The public fix requires a true verdict and adds a failed-signature regression test.
Botslab G980H dash cameras, embedded recording devices with BLE provisioning, a local Wi-Fi network, HTTP services, and network-delivered firmware updates.
Unauthenticated BLE exposes protected Wi-Fi material; firmware-wide constants can recover it; session weaknesses expose privileged functions; and the updater lacks trusted-signature verification.
The complete chain has not been demonstrated on stock hardware, and we do not know the upload authorization route or final execution identity.
Wireshark, a cross-platform network protocol analyzer used for live packet capture and trace-file analysis.
The vendor considers over-the-wire triggering possible, but reliable radio injection into the crashing path has not been established.
Wireshark reports no known exploitation and has published fixed releases.
GitHub Actions, the hosted and self-hosted CI workflow system used by GitHub repositories.
Disabling the compromised repositories had interrupted downstream execution. Re-enabling them without repairing the tags restored automatic payload delivery when scheduled or event-triggered workflows ran.
The accessible record says two actions and thousands of repositories were involved, but we do not know the repository names, tag hashes, exact count or whether executions were observed after re-enablement.
No additional findings today.
Unauthenticated Botslab BLE access exposes protected Wi-Fi credential material.
AF_UNIX container escape, autonomous portal intrusion and BOSS-N1 verification bypass.
The same brief, every morning. One email a day, nothing else.
fullchain.sh follows the day’s disclosures from bug to shell — what each one enables, what it links to, and where the fix left the primitive in place.
Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.