Weekly Cybersecurity Recap: Linux Kernel Flaws, AI Malware, Turla Backdoor, and Infostealers

This week’s cybersecurity landscape highlighted significant threats including a new Linux kernel flaw, AI-assisted malware, and active exploitation of critical vulnerabilities. The DirtyClone vulnerability (CVE-2026-43503) allows local users to gain root privileges via cloned packets, posing high risk to multi-tenant cloud environments and Kubernetes clusters. A critical PTC Windchill PDMlink and FlexPLM flaw (CVE-2026-12569) is under active exploitation to deploy JSP web shells. OpenAI previewed GPT-5.6 Sol, Terra, and Luna, with Sol being the most capable model for cybersecurity, while warning about dual-use risks. The Gaslight macOS malware uses prompt injection to confuse AI analysis tools, attributed to a North Korean threat actor. Turla deployed the STOCKSTAY backdoor against Ukrainian and Italian targets. Law enforcement disrupted Amadey and StealC infrastructure in Operation Endgame, recovering 27 million credentials. Other notable events include new infostealers like KuinaExtractor, a LokiBot campaign, and indirect prompt injection risks in agentic coding tools. The Linux Foundation launched Akrites and OSERA for coordinated vulnerability disclosure. Microsoft extended Windows 10 ESU and addressed Secure Boot certificate expirations.