Threat Brief — 2026-07-23 — Linux LPE, DNS stack chaos, browser-routed RAT

Executive summary. A nine-year-old XFS filesystem flaw (CVE-2026-64600) gives unprivileged local users root on default RHEL installs — patch urgently. Check Point has now released fixes for the actively exploited SmartConsole zero-day first added to CISA KEV yesterday. A cluster of nine DNS resolver vulnerabilities in Unbound and libngtcp2 exposes DoS, cache poisoning, and ghost-domain renewal paths. The Chaos ransomware gang debuted a new backdoor (msaRAT) that routes C2 through Chrome/Edge to evade network monitoring.

Top items

• CVE-2026-64600 — RefluXFS: nine-year-old Linux kernel XFS flaw enables local root on default RHEL. An unprivileged local user can overwrite root-owned files on XFS filesystems to gain persistent root. Default Red Hat Enterprise Linux installations are affected out of the box. Tracked as CVE-2026-64600, disclosed July 22 by Qualys. (src: The Hacker News)

• Check Point patches actively exploited SmartConsole zero-day — full admin access possible. Check Point has released security updates for Security Management and Multi-Domain Management (MDSM) products, addressing a critical flaw that was under active exploitation. This follows CISA's addition of the SmartConsole auth bypass to the KEV catalog yesterday (first reported 2026-07-22 by CISA). Patch immediately. (src: The Hacker News) · (src: BleepingComputer)

• msaRAT: Chaos ransomware gang routes C2 through Chrome and Edge browsers. A new backdoor dubbed msaRAT hides command-and-control traffic by tunnelling it through the user's Chrome or Edge browser process, making C2 blend into legitimate HTTPS web traffic. Attributed to the Chaos ransomware operation. Network egress monitoring alone will not detect this. (src: BleepingComputer)

• Nine CVEs in Unbound / libngtcp2 DNS stack: DoS, cache poisoning, ghost-domain renewal. A cluster of vulnerabilities affects DNS-over-QUIC (DoQ), DNS-over-TLS (DoT), DNSCrypt, and core resolver logic. Highlights: CVE-2026-50252 enables cache poisoning by mapping source-port populations per thread; CVE-2026-55990 is a "packet of death" for misconfigured DNSCrypt Unbound; CVE-2026-50046 is a heap use-after-free in a DoT error path; CVE-2026-42955 closes a ghost-domain delegation renewal via glue records; CVE-2026-50251 lets attacker-supplied 0.0.0.0/:: glue trigger a full-cache flush. Multiple assertion-failure DoS paths exist in libngtcp2 under high-concurrency DoQ. (src: MSRC CVE-2026-50252) · (src: MSRC CVE-2026-55990) · (src: MSRC CVE-2026-50046) · (src: MSRC CVE-2026-42955) · (src: MSRC CVE-2026-50251) · (src: MSRC CVE-2026-14586) · (src: MSRC CVE-2026-55991) · (src: MSRC CVE-2026-41637) · (src: MSRC CVE-2026-50243)

• HAProxy Community Edition 3.x DoS: varint mishandling and missing NEW_TOKEN length check. CVE-2026-26080 causes HAProxy CE 3.2.x–3.3.x (before 3.3.3) to enter a loop or crash from mishandled varints; CVE-2026-26081 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. Upgrade to 3.3.3+. (src: MSRC CVE-2026-26080) · (src: MSRC CVE-2026-26081)

• Linux kernel published 432 CVEs in two days, raising triage concerns. The kernel team assigned 432 new CVE identifiers on Sunday and Monday, an volume that makes manual assessment impractical for most organisations. Prioritisation tooling and automated patch cadence are essential. (src: Xakep)

• Exchange Online mistakenly quarantining customer mailboxes since Sunday. Microsoft is working to resolve an ongoing issue where Exchange Online is incorrectly quarantining mailboxes, potentially disrupting mail flow for affected tenants. Monitor M365 service health dashboard. (src: BleepingComputer)

• Brazilian banking trojan actively spreading in Portugal. Portuguese-speaking businesses are being targeted by a Brazilian banking trojan leveraging shared language for social-engineering effectiveness. Organisations with Portuguese-speaking employees or operations should heighten email and endpoint vigilance. (src: Dark Reading)

• rpcbind stack buffer overflow in rpcbaddrlist() (CVE-2026-16277). A stack buffer overflow in rpcbind's rpcinfo rpcbaddrlist() function could allow remote code execution on systems running rpcbind with exposed RPC services. (src: MSRC CVE-2026-16277)

• QEMU guest-agent local privilege escalation via symlink in guest-ssh-add-authorized-keys (CVE-2026-12080). A symlink attack in qemu-guest-agent's authorized-keys handling enables local privilege escalation on guest VMs where the agent is installed and the virtioserial channel is accessible. (src: MSRC CVE-2026-12080)

• glib2 gdbusserver pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588). An unbounded SASL line buffer in gdbusserver allows pre-authentication denial of service. Any application using GDBus server functionality is potentially affected. (src: MSRC CVE-2026-15588)

Themes

Linux/Unix attack surface widening. Between the RefluXFS root escalation on default RHEL, 432 new kernel CVEs, the snapd isolation weakness, rpcbind overflow, qemu-guest-agent LPE, and glib2 pre-auth DoS, the *nix patch backlog is growing faster than most teams can triage. Prioritise RefluXFS and rpcbind first — they offer direct privilege escalation or remote code execution on common configurations.

DNS resolver stack under pressure. Nine CVEs across Unbound, libngtcp2, and DNS-over-QUIC/TLS/Crypt paths signal that the encrypted-DNS transition is exposing new attack surfaces. Cache poisoning (CVE-2026-50252) and ghost-domain persistence (CVE-2026-42955) are the highest-impact issues for recursive resolvers in production.

Browser-as-C2 channel. msaRAT's use of Chrome/Edge to tunnel C2 is part of a broader trend of adversaries leveraging legitimate browser processes to bypass egress filtering. Endpoint process telemetry and behavioural detection are more effective than network signatures here.