Threat Intelligence Daily · 2026-09-19

Three Linux kernel flaws enter CISA KEV

Severity

Critical

Status

Confirmed active exploitation; CISA KEV

CVE

CVE-2025-39682, CVE-2026-53266, CVE-2025-39964

Affected

Linux kernels and downstream distributions containing the vulnerable code

CISA added all three vulnerabilities to KEV on September 18. CVE-2025-39682 affects the kernel TLS receive path; NVD records a 7.1 score from NIST while the kernel CNA record carries 9.8. CVE-2026-53266 is an ebtables SNAT out-of-bounds write that can lead to memory corruption, denial of service or local privilege escalation under specific bridge-netfilter configuration. CVE-2025-39964 is a race condition involving concurrent writes to an AF_ALG socket.

CISA’s entries establish that exploitation has occurred. Public sources reviewed for this report do not identify an actor, victim set or whether the flaws are used together. The KEV remediation date is September 21, 2026.

Recommendations

• Use kernel packages supplied by the operating-system or cloud vendor rather than mapping generic upstream version numbers onto a distribution kernel.
• Reboot after installation and verify the running kernel, not only the installed package version.
• Where CVE-2026-53266 cannot be patched immediately, Red Hat recommends disabling ARP hardware-address rewriting in ebtables SNAT rules or removing affected ARP SNAT rules.
• Review crash telemetry, privilege changes, namespace activity and unexpected netfilter changes from the pre-patch period.

vm2 3.11.7 closes sandbox escapes and host-state manipulation

Severity

Critical

Status

Patched; no confirmed in-the-wild exploitation

CVE

CVE-2026-92937, CVE-2026-92941

Affected

vm2 releases before the fixes documented for 3.11.7; exact preconditions differ by CVE

CVE-2026-92937 describes an incomplete Promise sanitization fix in vm2 3.11.6. When an embedder exposes a host-realm Promise and a rejected Error contains a host object, Function.prototype.call or apply indirection can bypass the bridge check and expose that object to sandbox code. The published record describes command execution in the host Node.js process.

CVE-2026-92941 affects vm2 3.11.3 before 3.11.7 when relevant built-ins are exposed. Sandbox code can reach the host tls module and alter process-wide default certificate authorities, changing what subsequent host HTTPS clients trust. Both records point to 3.11.7 as the fixed release.

Recommendations

• Upgrade to vm2 3.11.7 or later.
• Inventory applications that execute tenant, plugin, workflow or AI-generated JavaScript through vm2; configuration determines whether the vulnerable bridge paths are reachable.
• Minimize exposed built-ins and host objects even after patching. A JavaScript sandbox should not be the sole boundary protecting credentials or high-trust network access.

Chrome 153 fixes critical Dawn and WebGL memory-safety flaws

Severity

Critical

Status

Patched; no confirmed exploitation stated by Google

CVE

CVE-2026-93374, CVE-2026-93372

Affected

Chrome desktop before 153.0.8010.52/.53 and corresponding Android builds

Google’s September 17 stable-channel update contains 16 security fixes. It identifies CVE-2026-93374 as a critical use-after-free in Dawn and CVE-2026-93372 as a critical buffer overflow in WebGL. Chrome for Android 153.0.8010.52 carries the corresponding desktop security fixes unless Google notes otherwise.

Recommendation

Move managed desktop and Android fleets to the fixed stable release as it becomes available and verify version compliance through browser-management telemetry.

WordPress 7.1.1 fixes the path used by Click2Shell

Severity

High

Status

Patched; no confirmed in-the-wild exploitation

Affected

WordPress core before the applicable September 17 security release

WordPress 7.1.1 contains 11 security fixes. One prevents specially crafted URLs from automatically installing and previewing an inactive theme from WordPress.org. The later Click2Shell research demonstrated that a logged-in administrator opening such a URL could trigger theme installation without separately pressing Install; a second flaw in theme code can turn that primitive into server-side PHP execution.

The core issue requires administrator interaction, and the demonstrated code-execution chain also depends on vulnerable theme code. It is not a zero-click unauthenticated WordPress RCE. WordPress is backporting the security fixes to eligible branches through 4.7.

Recommendation

Update to WordPress 7.1.1 or the patched release for the deployed branch, verify that automatic background updates actually completed, and avoid opening untrusted links in an authenticated administrator session.