18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A use-after-free bug tracked as CVE-2026-64564 and nicknamed SCTPhantom has been lurking in Linux’s SCTP networking code since 2008 and can be chained into full root access on a host; researchers say they used it to escape a container and reach the underlying machine, getting root on kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS in six of eight attempts. The bug stems from a mismatch between the address used to validate a delete request and the address used to pick the actual network path, letting an attacker free a live connection object and reuse the dangling pointer. Fixed stable kernels shipped August 3, and since exploitation requires local access with SCTP reachable, blocking the module where it’s unneeded removes the exposure entirely.
Levi Strauss & Co. says hackers stole corporate data in cyberattack
An unauthorized party social-engineered three employees into handing over access to their company-issued computers, allowing corporate data to be accessed and exfiltrated before the intrusion was contained; no exploit, credential brute force, or unpatched flaw was involved. A regulatory filing states the response was fast enough to prevent any consumer data from being touched and that business operations weren’t disrupted. Some outlets have tied the intrusion to a voice-phishing group that has run similar campaigns against hundreds of organizations in recent weeks, underscoring how attackers are increasingly bypassing technical defenses by targeting people directly.
Metabase 0-Day Vulnerability Exploited in the Wild to Gain Admin Access
An unauthenticated SQL injection flaw in the popular open-source business intelligence platform’s password-reset endpoint let attackers inject arbitrary database commands and promote themselves to administrator without ever logging in, earning a maximum CVSS score of 10.0 across versions 0.58 through 0.63. The bug was discovered after the vendor’s own cloud platform was breached on August 3, and while cloud customers were patched automatically within hours, self-hosted deployments remain exposed until administrators upgrade manually. At least two downstream customers have already disclosed theft of names, addresses, phone numbers, and emails as a result of the intrusion.
Swiss IT agency hacked, 200 accounts compromised, SharePoint vulns suspected
Switzerland’s Federal Office for Information Technology and Communications disclosed that roughly 200 accounts on its on-premises SharePoint servers were compromised by previously unknown attackers, likely exploiting vulnerabilities patched in Microsoft’s July security updates. The agency detected anomalies on its servers, blocked external SharePoint access, patched the suspected flaws, and is now reinstalling affected servers as a precaution, though it says early analysis shows no evidence data beyond login credentials was accessed. Government cybersecurity bodies have separately warned that attackers exploiting these SharePoint flaws have been extracting cryptographic machine keys that can let forged session tokens survive even after patching, meaning credential rotation and a server restart are needed on top of the update itself.
Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools
Security research presented at Black Hat USA 2026 shows that plain CSS styling code, long assumed harmless, can be weaponized against major webmail providers including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail to steal passwords, hijack sessions, and manipulate connected AI tools. One demonstrated chain disguises a dropdown as a password field in Outlook and exploits a Firefox timing quirk to capture keystrokes in near real time, while a separate technique leaked an authentication token through Gmail’s image-loading behavior and chained it into a prompt-injection attack against an AI email assistant. Some providers have already patched the specific bugs reported to them, but the Outlook and Gmail techniques were confirmed still working as of August 6, and the researcher has published proof-of-concept code alongside recommendations like sandboxing HTML email and restricting allowed CSS properties.
