TL;DR Researchers have published full details and working exploit code for CVE-2026-31694. This Linux kernel FUSE bug lets a local user overflow the page cache and seize root. It reaches recent ke…

TL;DR The GNU Guix project disclosed four GNU Guix vulnerabilities in early July 2026. Three affect the guix substitute helper, and one affects guix pull and guix time-machine. Together, they allo…

TL;DR X.Org shipped fixes for two memory-safety flaws in the X.Org Server and Xwayland. The more severe one, CVE-2026-56000, is a use-after-free rated CVSS 9.0. The second, CVE-2026-55999, is a he…

A hands-on walkthrough covering reconnaissance, service enumeration, vulnerability analysis, and privilege escalation in one of VulnHub’s…

TL;DR The Exim team published advisory EXIM-Security-2026-06-22.1 on July 22, 2026. It describes an Exim vulnerability that lets a local attacker read files outside the mail spool. The bug can lea…

The Fedora Linux project plans to enable shadow stack protection by default in its upcoming version 46. The change targets 64-bit x86 systems and aims to strengthen their security posture. This fe…

TL;DR NVIDIA recently published an urgent software update for NVIDIA Dynamo for Linux. This update patches several security issues, including a critical NVIDIA Dynamo flaw. The most severe vulnera…

TL;DR Security researchers have detailed a critical Linux suTrap local privilege escalation flaw. This interactive su TIOCSTI bug allows an unprivileged user to gain root access during an active s…

A curious incident has come to light. According to an official Mozilla Security Blog post, the GPG signing key used to authenticate Firefox for Linux and Thunderbird for Linux packages has been ro…

A practical, command-by-command walkthrough of enumeration, encoding, hash cracking, steganography, SSH access, and Linux privilege…

Task 2 — Discovery Overview

Start running the lab machine and the AttackBox. in the AttackBox, connect via SSH using the given credentials

A collection of local Linux vulnerabilities has acquired a second life as weaponized code engineered for total root compromise. NebuSec disclosed a series of critical kernel vulnerabilities and pu…

TL;DR NVIDIA released security updates to fix 14 security flaws in its data center management tooling. These NVIDIA Infrastructure Controller vulnerabilities allow unauthenticated attackers to alt…

TL;DR Security researchers recently disclosed a high-severity Sudo security vulnerability tracked as CVE-2026-96512. This flaw allows local users to bypass time-based access restrictions by manipu…

Spectre has unequivocally discovered a novel infiltration vector precisely where applications dynamically compile code into machine instructions during runtime. The esteemed VUSec team, a collabor…

A hands-on cybersecurity assessment covering vulnerability discovery, exploitation evidence, risk analysis, and remediation in an…

TL;DR Artifex released Ghostscript 10.08.0 on September 8, 2026, fixing a critical heap buffer overflow rated CVSS 9.8. Wordfence found the Ghostscript vulnerability and turned a crafted PDF into …

A Large Tor Exit Node Attack An unknown attacker took over 333 Tor exit nodes. That gave the intruder a way to intercept SSH connections and unencrypted correspondence. The hijacked relays made up…