Zapscape Flaw in KVM Breaks Nested Virtualization Isolation Allowing L1 Guest Root Code Execution on Linux Host
A security flaw in KVM/x86 within the Linux kernel has highlighted a risk that many infrastructure platforms accept almost without question: nested virtualization exposed to untrusted workloads. The vulnerability, named Zapscape and registered as CVE-2026-64561, can allow an attacker with kernel privileges inside a level-1 virtual machine to execute code on the host with root permissions.
The problem centers on the shadow MMU and the way KVM manages shadow page tables when the L1 guest itself acts as a hypervisor for an L2 guest. In practical terms, the isolation that normally protects the host from activity inside a VM is weakened exactly in the scenario where a provider grants more power to a tenant by allowing nested virtualization inside the tenant’s own VM.
The technical root cause lies in an incorrect ordering when checking a “stale root” condition during guest page-fault handling. This sequence can result in a use-after-free, followed by writes after free — a classic pattern used to turn a memory corruption issue into arbitrary code execution.
Public disclosure includes a proof-of-concept exploit that chains the vulnerability and ultimately creates a file named /Zapscape on the host with root ownership. On Intel platforms the scenario requires the L1 guest to have EPT page walk lengths 4 and 5 exposed. No equivalent condition appears in the published information for AMD processors.
No active exploitation in real-world attacks has been observed so far. Nevertheless, the potential scope justifies rapid action, especially in multi-tenant environments. The NVD lists affected versions starting from Linux 5.9, and fixes are already present in the mainline tree and stable branches, including versions 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2 rc5.
The most direct mitigation is to update to a patched stable kernel or install the vendor package containing the backported fix. At the same time, organizations should inventory hosts that offer nested virtualization to untrusted tenants and treat them as patching priorities. If a server does not require nested virtualization, disabling it immediately reduces the attack surface. Administrators should also verify the effective version through their distribution vendor, because some fixes arrive as backports without obvious changes to the upstream version string.
Related articles
Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild
Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.
Critical Vulnerability CVE-2026-76519 in Cisco Secure Email Gateway Allows Arbitrary File Writes Without Authentication
Cisco Systems has disclosed a critical vulnerability in its Cisco Secure Email Gateway product that affects the Advanced Malware Protection feature responsible for processing email attachments. The flaw, tracked as CVE-2026-76519, permits unauthenticated attackers to write arbitrary files to the underlying operating system by sending a specially crafted email attachment. Successful exploitation can lead to remote command execution with root privileges. The vulnerability received a CVSS v3.1 base score of 9.8 and is rated Critical. Cisco confirmed active exploitation of the issue in October 2026, shortly after publishing the security advisory on October 14, 2026. This marks the second publicly disclosed exploited vulnerability in the product within a short period, though the flaws are unrelated.
Cyberattack Exploits Exposed Danfoss Refrigeration Controllers Across French Supermarkets
A remote cyberattack targeted Danfoss AK-SM 8xxA Series controllers in French supermarkets, allowing attackers to manipulate refrigeration parameters and trigger defrost cycles that raised temperatures and spoiled food stock. The incident impacted an estimated 250 to 350 stores belonging to major chains including Intermarché, Carrefour Market, Leclerc, and others. Paris prosecutors have opened a large-scale investigation into the attack and associated damages, including potential fires. The root cause traces to outdated software on internet-exposed OT management interfaces, with multiple CVEs enabling authentication bypass and remote code execution. Thousands of similar Danfoss systems remain publicly accessible worldwide, highlighting persistent OT exposure risks. Immediate remediation steps include closing web consoles, enforcing VPN access, and applying updates to versions 4.2 and 4.3.1 or later.
Three Zero-Days Chained in Ivanti Connect Secure Grant Root Access Without Login
An attacker chained three zero-day vulnerabilities in Ivanti Connect Secure to execute commands as root without authentication. The compromised appliance was running the fully patched version 22.8R2.4 when exploitation began on October 3. Volexity discovered the intrusion, attributed the activity to UTA0576 with low confidence in criminal rather than espionage motives, and reported the flaws to the vendor. Ivanti acknowledged limited in-the-wild exploitation on October 13. The first two issues, an authentication bypass and remote code execution, were combined under CVE-2026-104935 with a CVSS score of 8.6, allowing code execution as the cgi-server user. A third privilege-escalation flaw then elevated access to root. The final flaw lacked a patch at disclosure time, with a fix promised in an upcoming release. CISA classified the exploitation as active with total technical impact.