[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fR2lrlVbfahc-bJk-7t3OaX2Zynbo3VKklKyw4_BdPcc":3},{"article":4,"iocs":50,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5c816d02-5252-4d6f-8f7e-3cb1fca6b05c","16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems","16-year-old-linux-kvm-flaw-lets-guest-vms-escape-to-host-on-intel-and-amd-x86-sy-006a79","A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The public proof-of-concept panics the host; the researcher claims that a separate, unreleased exploit","A 16-year-old use-after-free vulnerability in Linux's KVM hypervisor, dubbed 'Januscape' (CVE-2026-53359), allows a guest virtual machine to corrupt the host kernel's shadow-page state. While a public proof-of-concept causes a host panic, a separate, unreleased exploit reportedly enables full host code execution. The flaw affects both Intel and AMD x86 systems and requires root access within the guest and nested virtualization enabled on the host.","Linux KVM hypervisor vulnerability allows guest VMs to escape to host on Intel\u002FAMD.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002F16-year-old-linux-kvm-flaw-lets-guest.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjG42lgj1grtq5EQICr-9RYvPU59uHFRBluzVoZ3TZLXEXBcF5bOPerpb_Ck-e6oNz6P4MO1VAiqbBXuPbImhng1CoRnRYHWSZTGOloHmYB5khhpCK5wW348uMgqmWIjTQPnOwCGV7OiPXJoJDWV0n1IPGP80hADXD3AnmRKbTb8jxyGQenhlgIpvNo29I\u002Fs1600\u002Flinux-kvm.jpg","2026-07-06T17:37:01+00:00","2026-07-06T20:00:10.176688+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"KVM","product",{"name":21,"type":22},"x86","technology",{"name":24,"type":25},"Intel","vendor",{"name":27,"type":25},"AMD",{"name":29,"type":19},"Linux",{"name":31,"type":19},"kvmCTF","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,59],{"type":52,"value":53,"context":54},"cve","CVE-2026-53359","Januscape vulnerability in Linux KVM",{"type":56,"value":57,"context":58},"mitre_attack","T1542","Exploitation for Privilege Escalation (Guest-to-Host Escape)",{"type":56,"value":60,"context":61},"T1068","Exploitation for Privilege Escalation (Local Privilege Escalation)",[24,27,18],{"controls":64,"vendors":149},[65,94,120],{"slug":66,"name":67,"problem":68,"products":69},"patch-management","Automated patch management","Known holes get closed in days, not months.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,112],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":108,"product_name":109,"url":110,"description":111},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":121,"name":122,"problem":123,"products":124},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"16-year-old-linux-kvm-hypervisor-flaw-enables-vm-escape-to-host","16-Year-Old Linux KVM Hypervisor Flaw Enables VM Escape to Host","A use-after-free vulnerability lurking in Linux's KVM hypervisor for 16 years demonstrates how long-lived kernel flaws can remain undetected while posing catastrophic risk to virtualized infrastructure. The flaw allows a privileged guest VM to corrupt host kernel memory and potentially achieve full host code execution, breaking the fundamental isolation boundary that virtualization security relies upon. This is especially dangerous in multi-tenant cloud and shared hosting environments where guest root access may be attainable by untrusted parties. The vulnerability highlights the compounding risk of legacy codebases, where security debt accumulates silently until a researcher or adversary discovers it — by which point exploitation capability may already exist outside of public disclosure.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-125A: Security Recommendations for Hypervisor Deployment","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","ITIL Change Management: Emergency Change procedures for critical security patches","PCI DSS Requirement 6.3: Identifying and managing security vulnerabilities",{}]