UnLocoPoco

Zapscape (CVE-2026-64561) is more than a guest-to-host escape. The vulnerability stems from an ordering flaw in KVM’s Shadow MMU page fault handling, where a stale root validation occurs before MMU quota reclaim. Under specific nested virtualization conditions, quota reclaim can invalidate the active shadow root while execution continues, leading to corrupted shadow page state, linked-list corruption, cross-cache reallocation, KASLR disclosure, and ultimately controlled host kernel code execution.

Or some specific OSes like Proxmox…which is heavily geared towards VMs. Other than that, mitigation steps mentioned works

Fair point. Even my asus zenbook 2025 around 20% of times when I close my lid, it goes to hibernation and asus Software notifies that due to system not going to sleep within time, it was forced to go into hibernate. In Linux, forcing might work for s3 but u need to test out wirh everything. Else it’ll be stuck in between. Do you have a system currently which is comparable to framework specs? Yes I know they have much better out of the box suppoet for Linux but in this way you can test out you main Hardware for support.

CVE-2026-64531 (OVSwrap) is a recently disclosed Linux kernel privilege escalation vulnerability affecting the Open vSwitch datapath. The flaw is particularly notable because the vulnerable code had existed for roughly 13 years but remained practically unreachable until a 2025 change removed a long-standing size limit, exposing an integer wraparound that can lead to kernel memory corruption. The published proof of concept also demonstrates an unusually reliable exploitation path compared to many traditional kernel exploits

Yeah yeah😅

Also, notice one thing…along with windows, MacOS also lost share during the same time. People are fed up with Apple too!

cross-posted from: lemmy.world/post/50160528 OpenAI says its investigation into the Hugging Face incident uncovered additional cases where autonomous AI agents escaped their intended containment environments. While the newly identified incidents reportedly remained inside OpenAI’s network, they reinforce a growing concern: securing AI systems is now as much a cybersecurity problem as it is an AI safety problem

Update: GitHub has started sending notices to users who forked the bitchat repo, requesting them to take them down due to Indian government order

India has directed GitHub to disable access to the repositories of Bitchat, Jack Dorsey’s decentralized Bluetooth mesh messaging application, under Section 79(3)(b) of the Information Technology Act and the IT Rules, 2021. According to the official notice issued by the Indian Cyber Crime Coordination Centre (I4C), authorities argue that Bitchat’s decentralized architecture, lack of mandatory user registration, absence of centralized logging, and ability to operate without internet connectivity make lawful interception and criminal investigations significantly more difficult.

A newly disclosed vulnerability chain dubbed wp2shell affects WordPress Core, not a third-party plugin. The disclosure has prompted emergency security updates and includes publicly available PoC, IoCs, and detection guidance for defenders

Telegram’s t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

A newly disclosed privacy vulnerability in Apple’s Hide My Email feature can reportedly allow an attacker to uncover the real email address behind a generated alias. According to the researcher who found the bug, it was responsibly disclosed to Apple more than a year ago but remains unpatched, and independent testing has verified the issue.