InfoQ - Security Vulnerabilities - News

Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution

Matt Saunders — Tue, 12 May 2026 08:00:00 GMT

Two recent Linux kernel vulnerabilities have been disclosed: Copy Fail (CVE-2026-31431) on April 29, 2026, and Dirty Frag (CVE-2026-43284 and CVE-2026-43500) on May 7, 2026. Both allow local users to gain root access, affecting multiple Linux distributions. These vulnerabilities exploit flaws in the page cache via different subsystems, necessitating immediate patching by affected organizations.

By Matt Saunders

Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them

Steef-Jan Wiggers — Wed, 06 May 2026 10:00:00 GMT

An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight months before activating it across 400,000 installations. The attack used Ethereum smart contracts to resolve C2. WordPress.org has no mechanism for reviewing plugin ownership transfers, a gap that npm and PyPI addressed years ago.

By Steef-Jan Wiggers

Cloudflare Processes 10M+ Daily Insights with New Security Overview Dashboard

Leela Kumili — Mon, 04 May 2026 14:33:00 GMT

Cloudflare has launched a Security Overview dashboard that consolidates security signals into prioritized action items. It surfaces millions of daily insights, helping teams identify and remediate critical risks faster. Built on distributed checkers and real-time event processing, it integrates analytics workflows to reduce investigation overhead and improve response efficiency.

By Leela Kumili