# ZDI-CAN-33367

Published articles for ZDI-CAN-33367.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Security briefing: October 2026

DevFeed: [Security briefing: October 2026](<https://devfeed.tech/articles/security-briefing-october-2026-116286.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/security-briefing-october-2026>)

Author: Crystal Morin

Published: 2026-11-03T00:00:00Z

Content type: news

Language: en

Sources: [Sysdig](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [cloud security](<https://devfeed.tech/topics/cloud-security.md>), [patches](<https://devfeed.tech/topics/patches.md>), [Linux](<https://devfeed.tech/topics/linux.md>)

Tags: [1-3](<https://devfeed.tech/tags/1-3.md>), [17](<https://devfeed.tech/tags/17.md>), [2](<https://devfeed.tech/tags/2.md>), [about](<https://devfeed.tech/tags/about.md>), [actively-exploited](<https://devfeed.tech/tags/actively-exploited.md>), [addition](<https://devfeed.tech/tags/addition.md>), [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agentic-ai-threats](<https://devfeed.tech/tags/agentic-ai-threats.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ahold-delhaize](<https://devfeed.tech/tags/ahold-delhaize.md>), [ai-agent-attack](<https://devfeed.tech/tags/ai-agent-attack.md>), [artex](<https://devfeed.tech/tags/artex.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cve-2026-109618](<https://devfeed.tech/tags/cve-2026-109618.md>), [cve-2026-109619](<https://devfeed.tech/tags/cve-2026-109619.md>), [cve-2026-111497](<https://devfeed.tech/tags/cve-2026-111497.md>), [danfoss](<https://devfeed.tech/tags/danfoss.md>), [dirty-frag](<https://devfeed.tech/tags/dirty-frag.md>), [divd-breach](<https://devfeed.tech/tags/divd-breach.md>), [french-supermarket-cyberattack](<https://devfeed.tech/tags/french-supermarket-cyberattack.md>), [hackers](<https://devfeed.tech/tags/hackers.md>), [http2shell](<https://devfeed.tech/tags/http2shell.md>), [idc-frontier-ransomware](<https://devfeed.tech/tags/idc-frontier-ransomware.md>), [idcf-cloud](<https://devfeed.tech/tags/idcf-cloud.md>), [japan](<https://devfeed.tech/tags/japan.md>), [linux-kernel-vulnerabilities](<https://devfeed.tech/tags/linux-kernel-vulnerabilities.md>), [machine-learning-security](<https://devfeed.tech/tags/machine-learning-security.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [microsoft-patch-tuesday](<https://devfeed.tech/tags/microsoft-patch-tuesday.md>), [monthly-security-news](<https://devfeed.tech/tags/monthly-security-news.md>), [node2shell](<https://devfeed.tech/tags/node2shell.md>), [october](<https://devfeed.tech/tags/october.md>), [october-2026](<https://devfeed.tech/tags/october-2026.md>), [patches](<https://devfeed.tech/tags/patches.md>), [php2shell](<https://devfeed.tech/tags/php2shell.md>), [pickle-bypass](<https://devfeed.tech/tags/pickle-bypass.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [runtime-security](<https://devfeed.tech/tags/runtime-security.md>), [security](<https://devfeed.tech/tags/security.md>), [security-briefing](<https://devfeed.tech/tags/security-briefing.md>), [storm-0940](<https://devfeed.tech/tags/storm-0940.md>), [sysdig-threat-research-team](<https://devfeed.tech/tags/sysdig-threat-research-team.md>), [zammad](<https://devfeed.tech/tags/zammad.md>), [zdi-can-33367](<https://devfeed.tech/tags/zdi-can-33367.md>)

### AI overview

October's incidents show how quickly exposed systems and newly disclosed flaws can lead to operational damage or compromise. Ransomware at Japan's IDC Frontier reportedly affected nearly 500 companies and local governments; the briefing recommends testing backups through restores outside the provider. Internet-exposed grocery refrigeration running outdated or unsupported firmware was forced into defrost mode, causing fires and spoiled food. PHP2Shell was reportedly exploited before patches were available; the excerpt advises patching, restarting PHP workers, and checking for unauthorized access. Node2Shell exploitation attempts followed a public tracking repository within days, and the Brotli decoder also appears in Bun, Python packages, and some Envoy configurations. For pickle-based model files, documented bypasses defeated several safety checks because checks and loaders interpreted files differently; the briefing recommends safetensors where possible and runtime monitoring. With Microsoft issuing 1,411 patches, it urges prioritizing reachable and exploited flaws while monitoring post-exploit behavior.

### Source excerpt

October 2026 security briefing: ransomware hits Japan's IDCF Cloud, hackers cook French fridges, PHP2Shell, Node2Shell, and Microsoft's record 1,411 patches.

## Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws

DevFeed: [Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws](<https://devfeed.tech/articles/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws-98968.md>)

Original publisher: [Read original article](<https://webflow.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws>)

Author: Sysdig Threat Research Team

Published: 2026-10-24T00:00:00Z

Content type: news

Language: en

Sources: [Sysdig](<https://devfeed.tech/sources/sysdig-blog.md>)

Topics: [Linux](<https://devfeed.tech/topics/linux.md>), [Security research](<https://devfeed.tech/topics/security-research.md>), [Falco](<https://devfeed.tech/topics/falco.md>)

Tags: [dirty-frag](<https://devfeed.tech/tags/dirty-frag.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exposed](<https://devfeed.tech/tags/exposed.md>), [ksmbd-vulnerability](<https://devfeed.tech/tags/ksmbd-vulnerability.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-flaw-detection](<https://devfeed.tech/tags/linux-flaw-detection.md>), [linux-kernel-mitigation](<https://devfeed.tech/tags/linux-kernel-mitigation.md>), [linux-kernel-vulnerabilities](<https://devfeed.tech/tags/linux-kernel-vulnerabilities.md>), [linux-privilege-escalation](<https://devfeed.tech/tags/linux-privilege-escalation.md>), [linux-root-exploit](<https://devfeed.tech/tags/linux-root-exploit.md>), [public](<https://devfeed.tech/tags/public.md>), [skb-zerocopy](<https://devfeed.tech/tags/skb-zerocopy.md>), [unprivileged-user-namespaces](<https://devfeed.tech/tags/unprivileged-user-namespaces.md>), [zdi-can-33367](<https://devfeed.tech/tags/zdi-can-33367.md>)

### AI overview

ZDI-CAN-33367 is the most immediate broad Linux risk: a public local exploit can gain root on tested Ubuntu, Debian, and AlmaLinux releases by dropping a page-cache protection flag during `skb_zerocopy()`. A fix is under review but not merged; fixing CVE-2026-90049 alone does not address it. Its syscall sequence is distinctive and can be detected at runtime. Restricting unprivileged user namespaces or blocking `nlmon` and `act_pedit` can stop the public PoC, with compatibility costs or incomplete coverage; patch when distributions ship the fix. The two highest-scored flaws affect ksmbd, not Samba: inventory and disable ksmbd where unnecessary, restrict TCP 445, and disable SMB Direct if RDMA is not needed. ZDI-CAN-34068 applies to VMware guests using vmwgfx; inventory those guests and consider disabling 3D acceleration or the module. Runtime sensors can identify exposure and post-exploitation effects for ksmbd, but not the kernel race or overflow itself. None of the six had a CVE ID or reported in-the-wild exploitation at publication.

### Source excerpt

A public root exploit exists for ZDI-CAN-33367, one of six Linux flaws from ZDI. Learn who's exposed, how to detect it, and how to mitigate it.