CopyFail: A nine-year-old Linux kernel bug that grants root in seconds

Root access on practically every Linux system since 2017. A single git push to execute commands on GitHub’s servers. One character to take over two million cPanel instances. And one SMS that cost a person in the Frýdek-Místek region 230,000 CZK. Welcome to Security Sunday.

On April 29, researchers from Theori disclosed a vulnerability nicknamed CopyFail (CVE-2026–31431). It is a local privilege escalation in the Linux kernel with a CVSS score of 7.8, affecting practically every major distribution released since 2017.

The publicly available exploit consists of just 732 bytes of Python code, and according to Theori it works without modification on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16.

The vulnerability arose from an unfortunate interaction between three kernel changes: the addition of authencesn in 2011, the introduction of AF_ALG AEAD sockets in 2015, and an in-place optimization in algif_aead.c from 2017.

On its own, CopyFail cannot be exploited remotely — an attacker must first execute code under a regular user account.

The fix reverts the 2017 optimization and was merged into the kernel in early April. Ubuntu 26.04 is not affected, AlmaLinux released patched kernels to its production repositories on May 1, 2026, and Fedora has also published a patch.

Other distributions are still finalizing their packages. As an immediate mitigation, both CERT-EU and most vendors recommend disabling the algif_aead module.

Do you know whether your systems are secure?

Every week we bring examples of attacks and vulnerabilities that can affect anyone. If you are not sure whether your infrastructure is resilient, we would be happy to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and simulated phishing campaigns.

Get in touch — your first consultation or vulnerability scan for one domain or IP address is free.

A single git push was enough to take over GitHub’s infrastructure

Security researchers from Wiz uncovered a critical vulnerability in GitHub’s internal Git infrastructure. The bug, tracked as CVE-2026–3854 with a CVSS score of 8.7, affected not only the self-hosted GitHub Enterprise Server (GHES) but also the public GitHub.com platform.

An attacker with any push access to any repository — even one they had just created themselves — needed only a single git push command with crafted push options to achieve arbitrary command execution on GitHub’s backend servers.

The Wiz research team reported the bug on March 4. GitHub confirmed it within 40 minutes and deployed the fix on GitHub.com within a matter of hours. Public disclosure was deferred until April 28, 2026, to give GHES customers enough time to update.

The impact on the public platform was particularly severe. GitHub.com operates as a multi-tenant environment in which repositories belonging to millions of different organizations share common storage nodes. Code execution under the system user git meant the ability to read any repository on a given node. During testing, the Wiz researchers demonstrated the presence of millions of index records of third-party repositories on two compromised nodes — although they did not access the actual contents of any third-party data, verifying everything only with their own test accounts.

GitHub subsequently conducted a forensic investigation, and CISO Alexis Wales confirmed that telemetry detected no execution of this exploit beyond the researchers’ own tests. According to GitHub, no customer data was compromised.

Critical vulnerability in cPanel and WHM threatens millions of servers

On April 28, cPanel released an emergency security update addressing a critical vulnerability affecting practically every supported version of the cPanel control panel and WebHost Manager (WHM). The flaw, tracked as CVE-2026–41940 with a CVSS score of 9.8, allows an unauthenticated attacker to remotely bypass the login process and obtain administrator access to the server.

According to data from Eye Security, more than two million cPanel instances are connected to the internet. A Shodan search reveals roughly 1.5 million potential targets — in the Czech Republic, just under a hundred servers.

Technically, this is a CRLF injection (Carriage Return Line Feed) attack in the process of uploading and storing session files. The cpsrvd daemon writes the session file to disk before authentication itself takes place.

According to available information, the bug was actively exploited as a zero-day even before its official disclosure. Daniel Pearson, CEO of KnownHost, states that the vulnerability had been observed for at least 30 days before the patch was released, with some forum speculation pointing to targeted attacks as early as February 23, 2026. The hosting providers’ response was rapid, but in some cases rather desperate. Namecheap, hosting.com, KnownHost, and other major players immediately blocked TCP ports 2083 and 2087 at the firewall, temporarily cutting off their own customers from their administration interfaces.

Benjamin Harris of watchTowr summed up the situation aptly: “Within hours of the patch being released, the largest hosting companies pulled the emergency brake — because the alternative was watching their entire customer base get compromised in real time.”

Patches are available for all currently supported product branches. For compromise detection, cPanel has published a script that searches for indicators of attack.

Beware of fraudulent SMS messages with fake fines

On April 30, the Czech national security team CSIRT.CZ issued a warning about a large-scale campaign of fraudulent SMS messages urging recipients to pay an alleged fine. The team, operated by the CZ.NIC association, reports that over the past week it has been taking down fraudulent websites used in this campaign on a daily basis — a campaign that the Czech Police also flagged a week earlier.

The attackers send a short message containing a link that redirects the victim to a fake page imitating a government portal — most often the Citizen Identity portal. CSIRT.CZ recommends not responding to such messages, not opening the links, and forwarding suspicious SMS messages to your operator on the toll-free number 7726.

The attack scenario is sophisticated and leverages the three classic pillars of social engineering: authority, time pressure, and a technical trick. The message is disguised as an official notice from the Czech Police or the Ministry of Transport. The victim is presented with a fine for an alleged speeding offense and given a short deadline — typically three days — before the amount will be enforced. Some variants additionally offer a 50% discount for prompt payment.

The fake pages faithfully mimic the design of government portals, including login via Bank ID. Once the victim enters their credentials, the attacker gains access to their online banking. Police have recorded dozens of such cases in recent days, with one victim from the Frýdek-Místek region losing more than 230,000 CZK.

The key message repeatedly emphasized by both the police and operators is unambiguous: the police never send SMS messages demanding payment of a fine and containing a payment link.

So what should you do if you receive such a message? Do not click the link, do not reply, and forward the SMS to 7726 — ideally with the time of delivery and the sender’s number. If someone has already clicked a fraudulent link and entered their login credentials, they must immediately contact their bank, block their payment card, change their passwords, and report the incident to the Czech Police.