Cyber Threat Brief — August 8 2026
⚠️ This report is AI-generated. Always validate findings.
1. SCTPhantom — 18-Year Linux SCTP UAF — CVE-2026-64564
TL;DR: Use-after-free in Linux kernel SCTP ASCONF processing (since 2007) gives local root and container escape. Tencent Zhuque Lab published full exploit chain August 6; patch your kernels or disable SCTP.
What’s New:
- Tencent Zhuque Lab published full technical writeup August 6 with exploit chain details
- CVSS v4 8.5 (High) — local privilege escalation to root + container-to-host escape
- Root cause: identity mismatch in ASCONF DEL-IP processing — kernel validates deletion against packet source address but caches transport by address parameter, leaving dangling pointer
- Exploit chain: SCTP transport UAF →
pg_vec(TPACKET V1) reclamation → kernel address leak → KASLR defeat viaSCTP_STATUS/sctp_assoc2id→ second UAF with controlled auth-key data →commit_creds()for root - Validated on Ubuntu 24.04, Debian 13, Rocky Linux 9, kernels 5.14 through 7.2-rc — root on every tested target
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Kernels 2.6.25 through unpatched (6.6.147, 6.12.100, 6.18.41, 7.1.5 and earlier) | Vulnerable asset | T1068 | uname -r, asset inventory | Patch to 6.6.148 / 6.12.101 / 6.18.42 / 7.1.6 |
sctp kernel module loaded on containers or multi-tenant hosts | Attack surface | T1068 | lsmod, /proc/modules | Disable — modprobe -r sctp; echo "install sctp /bin/false" > /etc/modprobe.d/no-sctp.conf |
| SCTP ASCONF chunks with wildcard addressing + rapid transport changes | Exploitation indicator | T1068 | Network capture, auditd socket(IPPROTO_SCTP) | Hunt — SCTP socket creation from container or unprivileged user |
TPACKET_V1 ring buffer allocation from non-root process | Exploitation chain | T1068 | auditd, seccomp logs | Hunt — pg_vec allocation pattern during SCTP activity |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No SCTP-specific privilege escalation detection — need rule for SCTP socket creation from containers |
| Elastic | None | No SCTP kernel module abuse detection |
| Sigma | lnx_auditd_kernel_module_load.yml (partial) | Gap: does not filter for sctp module specifically; no ASCONF-level detection |
Sources: Tencent Zhuque Lab, The Hacker News, Debian kernel update
2. NatJack — NAT Session Hijacking — CVE-2026-56181 / CVE-2026-63913
TL;DR: New attack class manipulates NAT connection-tracking tables to hijack TCP sessions and spoof DNS responses. Affects Windows Hyper-V NAT (CVE-2026-56181, CVSS 8.3) and Linux Netfilter conntrack (CVE-2026-63913, CVSS 8.2). 32 products from 13 vendors tested — all vulnerable to at least one technique.
What’s New:
- Presented at Black Hat USA 2026 on August 6 by Malcolm Stagg (SODIUM-24); full research at natjack.io
- Four attack techniques: TCP connection hijacking via NAT mapping replacement, DNS response spoofing, NAT-assigned port discovery, NAT table exhaustion
- Design flaw baked into RFC specifications — no single patch fully closes it; implementation-specific fixes reduce feasibility
- Windows: patched in July 2026 cumulative updates (KB5101650 for Win11 24H2/25H2, KB5101649 for 26H1)
- Linux: Netfilter conntrack fix — crafted SYN + invalid-sequence RST prematurely forced active NAT entries closed; fixed in stable kernels 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1
- No ITW exploitation observed as of August 7; requires co-tenant/same-NAT access
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Windows 11 < 26100.8875 (24H2), < 26200.8875 (25H2), < 28000.2525 (26H1); Server 2025 < 26100.33158 | Vulnerable asset | T1557 | Windows Update, WSUS | Patch — install KB5101650 / KB5101649 |
| Linux kernels before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35 | Vulnerable asset | T1557 | uname -r | Patch — update kernel |
| NAT connection table entries with unexpected state transitions (ESTABLISHED → CLOSED via single RST) | Exploitation indicator | T1557 | Netfilter conntrack logs, conntrack -E | Hunt — anomalous conntrack state changes |
| DNS responses arriving from unexpected source after NAT state manipulation | Exploitation indicator | T1557.002 | DNS logs, network tap | Hunt — DNS response with mismatched transaction ID or source |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No NAT state manipulation or conntrack anomaly detection |
| Elastic | None | No NAT-layer session hijack detection |
| Sigma | None | No conntrack state transition anomaly rules |
Sources: The Hacker News, natjack.io, Network World, WindowsForum
3. AI Coding Agent CI/CD Flaws — CVE-2026-12537 / CVE-2026-54316
TL;DR: Gemini CLI (CVSS 10.0) and Claude Code had flaws letting a malicious GitHub issue execute code on CI runners and exfiltrate secrets. Both patched, but any org running coding agents in CI needs to audit immediately.
What’s New:
- Presented at Black Hat USA 2026 August 5 by Novee Security; THN coverage August 7
- CVE-2026-12537 (CVSS 10.0): Gemini CLI OS command injection via
.gemini/.envfile — unprivileged attacker runs code on CI host before sandbox starts; affects @google/gemini-cli < 0.39.1 and google-github-actions/run-gemini-cli < 0.1.22 - CVE-2026-54316: Claude Code API key exfiltration via Hugging Face download counter — one character at a time; affects Claude Code 0.2.54–2.1.162, fixed in 2.1.163
- Attack vector: attacker opens a GitHub issue with crafted content → coding agent processes it during CI workflow → code execution or secret exfil
- Tested against Anthropic’s and Google’s own repositories — both were vulnerable
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
@google/gemini-cli < 0.39.1 in CI pipelines | Vulnerable asset | T1195.002 | package.json, GitHub Actions workflow YAML | Patch — update to 0.39.1+ |
google-github-actions/run-gemini-cli < 0.1.22 | Vulnerable asset | T1195.002 | GitHub Actions workflow YAML | Patch — update to 0.1.22+ |
claude-code versions 0.2.54–2.1.162 | Vulnerable asset | T1195.002 | CI runner package inventory | Patch — update to 2.1.163+ |
.gemini/.env files in repository commits or PRs | Attack indicator | T1059.004 | Git commit logs, PR file diff reviews | Block — reject PRs containing .gemini/.env files |
Unexpected outbound requests to huggingface.co from CI runners | Exfiltration indicator | T1567 | CI runner network logs, proxy logs | Hunt — HuggingFace API calls from build environments |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No AI coding agent CI/CD abuse detection |
| Elastic | None | No .gemini/.env injection or coding agent tampering rules |
| Sigma | None | No CI runner coding agent prompt injection detection |
Sources: The Hacker News, Hackread, Novee Security, GitHub Advisory CVE-2026-12537
Status Updates
- CVE-2026-63077 (TeamCity): Federal CISA KEV deadline TODAY August 8. Active exploitation confirmed. Upgrade to 2025.11.7 or 2026.1.3. Original brief.
- CVE-2026-9198 (Langflow): Federal deadline passed August 7.
auto_login+exec()exploitation ongoing. Original brief. - CVE-2026-34486 (Tomcat EncryptInterceptor): Federal deadline passed August 7. Deserialization via Tribes port 4000/TCP exploitation ongoing. Original brief.
- CVE-2026-18577/18556 (N-able N-central): Hotfix 2 (build 2026.3.1.10) released August 6. Federal deadline passed August 6. Attackers evolving techniques. Original brief.
- CVE-2025-68686 (FortiOS symlink persistence): Federal KEV deadline August 10 (Monday). No new artifacts. Original brief.
- CVE-2026-6875 (Confluence Data Center): Active exploitation entering sixth week. Two sandbox-escape gadget chains. Fortune 500 victims. Still not on CISA KEV. Original brief.
- CVE-2026-15409/15410 (SonicWall SMA1000): INC ransomware exploitation continues. 885+ victims per Resecurity. Original brief.