Random in Security is a summary of the cybersecurity news.
Vulnerabilities#
Copy Fail: Four Bytes to Root#
Cloudflare’s writeup on how they handled “Copy Fail” (CVE-2026-31431) is a rare vulnerability story where the blue team looks good.
The bug is an out-of-bounds write in the kernel’s algif_aead / authencesn AEAD wrapper that spills four bytes past the output buffer — enough to poison the page cache backing setuid binaries like /usr/bin/su and hand an unprivileged process a root shell.
Cloudflare’s behavioral detection flagged the exploit within minutes with no signature update, a 48-hour fleet-wide hunt turned up nothing, and they shipped a two-stage eBPF and bpf-lsm mitigation blocking unauthorized AF_ALG socket binds while the patched kernel rolled out.
Turns out four bytes is still plenty when they land in the right place.
FortiBleed: The Firewall Is the Foothold#
Kevin Beaumont has an update on FortiBleed, and it is not getting smaller. Attackers are pulling FortiGate configurations and cracking the password hashes at scale on rented GPU clusters, with roughly 75,000 devices hit and around 1,000 organizations now showing confirmed internal breaches. The follow-on is the usual persistence playbook — new rogue admin accounts, edited firewall rules — with ransomware crews circling telecoms and managed service providers. The device you bought to keep attackers out is, once again, the way in.
Interesting Reads#
The CVE System Meets the AI Firehose#
The CVE Program has opened a community discussion about what happens to the vulnerability-tracking ecosystem when AI starts finding bugs faster than humans can triage them. It is the institutional version of the question the rest of this issue keeps circling: when anyone — or any model — can mint a CVE, what does the number still certify? The models scale; the CVE-and-NVD metadata pipeline does not.
curl’s First CVE Dispute#
Daniel Stenberg documents curl’s first CVE dispute since becoming a CNA, and it is a tidy case study in what “vulnerability” even means.
A researcher contested curl’s rejection of a CVE for a wildcard-certificate hostname-matching quirk in Curl_cert_hostcheck() that required an illegal leading-dot DNS name, a specific TLS backend, and a local attacker already in place.
Stenberg filed it under “lower than LOW,” and MITRE’s Top-Level Root agreed it is not a security vulnerability — a reminder that in an era of CVE inflation, disputing them is becoming its own job.
CVE-2026-LGTM: Seven Scanners, One Honeypot#
Andrew Nesbitt’s satirical incident report is the funniest — and bleakest — thing in this issue.
A malicious package, foxhole-lz4, sails through seven AI-powered security scanners because they defer to each other, get distracted by hidden text, and each assume someone else did the review; the attacker’s own autonomous agent only stands down after reading a honeypot file that politely instructs it to self-destruct.
The one control that worked was a human-crafted booby-trap, and the junior developer who simply said “it is malware” gets buried under AI process — over-automation as its own attack surface.
ZRON: An Espionage Suite, Allegedly#
A threat actor is claiming a 7GB leak from Zhengzhou Zhirong Network Technology (ZRON), a purported Chinese digital-espionage shop, complete with malware samples, operational docs, and remote-management consoles for Windows and Android. NetAskari’s analysis goes further, describing cross-platform implants (Windows, macOS, iOS, Android, Linux), credential harvesting, and email interception, alongside recovered diplomatic emails naming targets from South Africa and Russia to Panama, Kyrgyzstan, the Philippines, Afghanistan, and the Vatican. The seller — going by “penguinbrew” and “ZRONLEAKS,” PGP-signing messages for credibility — has hawked Chinese-tech-company databases before, though both write-ups caveat that the full dataset’s authenticity is not yet verified.