Google’s October 2026 Android security bulletin, shipping as patch level 2026-10-01, closes 25 vulnerabilities across Framework and System, seven of them critical, with the most severe allowing local privilege escalation in System with no added execution privileges and no user interaction. Apply the update as soon as your devices receive it, and treat the Pixel bulletin as a separate, mandatory step.

On 18 September 2026, researcher Asim Manizada published working exploits for four Linux kernel flaws — DirtyAH6, TUNderflow, PPPoEject and DiagSpill — each of which gives root to any local user. The fixes have been available for weeks, so check your kernel version and restrict unprivileged user namespaces now.

CVE-2026-43499, dubbed GhostLock, is a use-after-free in rtmutex priority-inheritance code that has shipped since kernel 2.6.39 and is reachable by any unprivileged local process. The fix landed in 7.1, but two months after the public PoC, blind spots like RHEL 9 kernel-rt remain: check your version and block PI futexes in the meantime.

On September 9, 2026, researcher Chaotic Eclipse published ShieldCrash, a proof of concept that bypasses CVE-2026-69414 (ShieldBreak), the privilege-escalation flaw Microsoft claimed to have patched in Defender’s antimalware engine. Check your Malware Protection Engine version and treat the EDR itself as attack surface to monitor.

A researcher releases FalconFlank, a zero-day that abuses CrowdStrike Falcon’s Office macro remediation to gain SYSTEM privileges on fully patched Windows 11 and Server machines. Disable the suspicious macro removal policy until an official fix lands.

Present since PostgreSQL 9.4 in 2014, CVE-2026-6471 (CVSS 7.2) lets an account holding the REPLICATION attribute load an arbitrary library through logical decoding and run code as the server’s operating-system user. Fixed on August 13, 2026 via the output_plugin_libraries parameter: update and make sure your output plugins are explicitly allowlisted.

University of Toronto researchers published GPUThor, a Rowhammer attack that bypasses the ECC on NVIDIA Ampere GPUs to trigger denial of service or a root-level privilege escalation. Anyone sharing GPUs or running untrusted CUDA has to redraw their trust boundary.

The Linux kernel’s NTFS3 driver restores setuid bits straight from untrusted on-disk data, letting a crafted NTFS image produce a setuid-root binary as soon as the volume mounts. Reported privately two months ago and still unpatched, the bug hits desktops whose automounter mounts NTFS volumes with suid on by default.

CISA updated its KEV catalog to flag the Windows Task Host privilege-escalation flaw CVE-2025-60710, patched in November 2025, as now being exploited by ransomware gangs. Organizations must treat privilege-escalation patches with the same urgency as RCEs: this is the link that turns limited access into full control.

On August 11, 2026 researcher Nightmare Eclipse published ShieldBreak, a proof of concept that bypasses the fix for CVE-2026-50656 (RoguePlanet), the Microsoft Defender flaw patched in July. Independent analysts have confirmed it works, and Microsoft has not yet shipped a new fix.

A use-after-free bug in the Linux kernel’s SCTP stack, dormant for 18 years and now tracked as CVE-2026-64564, lets a local attacker escalate to root and escape containers. Patches landed August 4, 2026 — kernel updates are not optional.

systemd 257 introduces run0, a sudo alternative that ditches the SUID bit for a Polkit and systemd-based privilege escalation mechanism. Available in Fedora 43 and expected in Ubuntu 26.04.1 — here is what changes and how to prepare your Ansible playbooks.

On July 14, 2026, Microsoft patched an AD CS flaw letting any authenticated user impersonate a domain controller. By July 27, the PoC was public — every unpatched domain is one script away from full compromise.