RefluXFS Linux flaw allows local root privilege escalation

🔓 VULNERABILITIES & CVEs

• RefluXFS Linux flaw (CVE-2026-64600) allows local root privilege escalation — BleepingComputer
  A race condition in the Linux kernel XFS filesystem lets local attackers gain root privileges.
  • Affects Linux systems with XFS filesystem and reflink enabled, kernel version 4.11 or later
  • Impacts major enterprise distros including RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux
  • Attack exploits a race condition in copy-on-write allocation to overwrite protected files on disk
  • By reflink-cloning and racing concurrent O_DIRECT writes, attackers modify root-owned files or SUID binaries
  • Bypasses standard defenses like SELinux, kernel lockdown, container isolation, and memory protections
  • Exploit is reliable, leaves no kernel logs, and changes persist across reboots
  • Discovered by Qualys TRU using AI-assisted research and patched in July 2026

💥 BREACHES & INCIDENTS

• Upbound Group Data Breach Leads to $13M in Fraudulent Lease Contract Losses — SecurityWeek
  Upbound Group suffered a data breach resulting in $13 million in fraudulent lease contract losses.
  • Applies to Upbound Group's Acima lease-to-own segment customers
  • Hackers accessed non-sensitive customer information and documents
  • Stolen data was used to create fraudulent lease-to-own agreements
  • Fraudulent contract losses totaled approximately $13 million in Q2 2026
  • Attack details and perpetrators remain unknown; investigation ongoing

🕵️ THREAT RESEARCH & DEEP DIVES

• Attackers Exploit GitHub Actions Runners to Target cPanel and WHM Servers — The Hacker News
  Attackers used compromised GitHub Actions runners to exploit cPanel and WHM servers.

  • Targets: cPanel and WebHost Manager (WHM) servers vulnerable to CVE-2026-41940
  • Attack vector: Malicious GitHub Actions workflows in compromised repositories of PHP developer dinushchathurya
  • Payload: Linux scanner exploits authentication bypass to harvest credentials and sensitive data
  • Delivery: Workflows trigger GitHub-hosted runners that download payloads from attacker C2 server
  • Scope: 10 Packagist packages with 583 malicious workflow files active between July 12-13, 2026

• Chaos ransomware group deploys msaRAT to hijack browsers for covert C2 via WebRTC — Cisco Talos
  Chaos ransomware uses msaRAT malware to establish covert C2 channels through hijacked browsers.

  • Targets large organizations using Chaos ransomware-as-a-service (RaaS)
  • msaRAT is a Rust-based remote access trojan leveraging Chrome/Edge browsers
  • Establishes C2 communication via Chrome DevTools Protocol and WebRTC DataChannel
  • Downloads MSI installer 'update_ms.msi' via HTTP on port 443 to deploy RAT
  • Uses WebRTC over Twilio TURN relay to hide attacker IP and evade detection