Monday, July 13, 2026
A 15-year-old Linux kernel flaw gets a 97%-reliable root exploit, malware colonizes the Go and npm supply chains, and AI agents post real numbers against physicians, CUDA benchmarks, and a 50-year-old conjecture.
Root on every unpatched Linux kernel
VEGA at nebusec.ai published a complete exploit chain for GhostLock (CVE-2026-43499), a Linux kernel stack use-after-free that shipped in every distribution from 2011 until an April 2026 fix. The only prerequisite is CONFIG_FUTEX_PI=y: no privileges, capabilities, or user namespaces. The bug sits in the rtmutex Requeue-PI path, where remove_waiter() clears current->pi_blocked_on during a proxy-lock rollback whose “current” is the requeuer, not the sleeping waiter, leaving a dangling pointer into a popped kernel stack frame; lockdep misses it because it checks only that a pi_lock is held, not whose. A three-thread, three-futex dependency cycle forces the rollback deterministically. The authors report 97% reliability and a $92,337 kernelCTF reward, with a flag captured in about five seconds; RANDOMIZE_KSTACK_OFFSET, off by default on both target images, drops reliability to roughly 1-in-32. Exploit code is published, with an Android writeup promised.
Malware in the developer supply chain
Two fresh campaigns weaponize routine developer actions. A crates.io maintainer documented a fake-interview scam: a fabricated Singapore VC steered him to a TypeScript “Ticket Harbor” test repo whose build step installs a previously unindexed RAT he names PinpinRAT. The vector is patch-package: a malicious typescript+5.9.2.patch, hidden among decoy patch directories, injects a base64+XOR stub that runs via new Function on the first npm run typecheck. git update-index —skip-worktree hides the patch from git status, and the author says the payload image triggered zero VirusTotal engines. Socket separately reports “Operation Muck and Load,” a Go module posing as a DNS scanner that is a Windows loader, spread across 222 GitHub repositories with 700+ malicious versions since January 24, 2026. It inflates its version count by abusing Go’s commit-timestamp pseudo-versioning, a GitHub Actions workflow force-pushing every minute, and pulls payloads from dead-drop markers on Pastebin, YouTube, and Telegram. Go blocked it from the module proxy.
AI capability, measured
A Nature paper reports MIRA, an autonomous LLM agent that runs full emergency-department workflows in a sandboxed FHIR EHR, from history-taking to ordering labs to executing prescriptions and admissions. On 500+ retrospective MIMIC-IV cases the authors measured 88.9% average diagnostic accuracy against 78.1% for board-certified physicians and 71.1% for a mixed cohort (both P<0.001), while cautioning that safety and governance still require prospective trials. Import AI 464 relays that a model called Fable produced the fastest KernelBench-Mega submission, an 18.71X Blackwell CUDA speedup that uses one cooperative kernel launch per token where rivals use 4 to 14, and that the Remote Labor Index rose from 2.5% to 16.1% freelance-task success in under eight months; the best agent on the harder OSWorld 2.0 still scores only 20.6%. Lower on the hardware curve, colibri runs GLM-5.2, a 744B mixture-of-experts model, on a 25GB machine in about 1,300 lines of dependency-free C by streaming experts from disk, at a measured 0.07 to 1.06 tokens per second. A PDF on OpenAI’s CDN claims GPT-5.6 Sol Ultra produced a proof of the 50-year-old Cycle Double Cover Conjecture, but the proof text is not extractable from the file and no independent or machine check is shown.
Trust and trade secrets
Anthropic quickly removed hidden tracking code from Claude Code after a developer exposed it, Ars Technica reports. The researcher described “prompt steganography,” markers that reported Chinese users’ timezone and possible ties to AI labs Anthropic accuses of distillation; an Anthropic engineer confirmed the tracker was added in March as an anti-abuse experiment and framed its removal as obsolescence. The episode sits against Anthropic’s public refusal, now in litigation, to let the US government use Claude to surveil Americans. Separately, Apple sued OpenAI, Jony Ive’s IO Products, and two former Apple staff, alleging ex-employees exfiltrated hardware trade secrets; OpenAI says it has “no interest in other companies’ trade secrets.” The allegations are unproven.
What to watch today
- VEGA’s promised GhostLock follow-up on Android exploitation, bypassing ASLR and CFI.
- Whether graph theorists or a proof assistant verify the claimed GPT-5.6 Cycle Double Cover proof.
- OSWorld 2.0 agent scores, after OSWorld 1.0 climbed from about 30% to 75% in a year.
- OpenAI’s first hardware product, expected 2027, as Apple’s trade-secret suit proceeds.