InfoQuest Consulting LLC

10/18/2026

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (UPDATE)

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.

The disabled identities are listed below -

ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae
ConnectWise Cloud Management - 2399d300-6fca-4e6a-a686-399fefe75b83
ConnectWise Cloud Management - MS Teams - 24205314-2b89-4e07-a2a4-579e898a5640
ConnectWise Cloud Management - Exchange Online - b78f6a77-d4e5-46fb-87e5-d1648bd02519
ConnectWise Cloud Management - MS Graph - 0de14c77-b9b0-4137-9360-34878a929827
ConnectWise Cloud Management - Partner Center - 412dcf96-176d-4b3a-a1b0-4981ad66971e
ConnectWise Cloud Management - SharePoint Online - b2b55f5b-7758-4719-8d8f-88ae172e6bdb

The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.

"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," it said.

"The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation."

ConnectWise also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.

Out of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.

The attack is particularly dangerous as it allows an attacker to abuse the application's credentials to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions.

Depending on the permissions assigned to the application, this could enable the attacker to potentially access other Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information.

With ConnectWise's applications operating with extensive permissions to perform backups and management tasks, the theft of the credential allows the threat actor to authenticate as the application itself and expand their access by adding it to the Global Administrator role, adding client secrets to other trusted applications in the tenant, and creating new applications and granting them permissions.

By doing so, the client secrets offer a way to authenticate as that application and establish persistence, providing an alternative means to regain access to the compromised environment even if the original compromised credential is later revoked.

As of late Saturday, Huntress said it identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15. These efforts, which singled out a narrow scope of 16 tenants, were unsuccessful. The tenants are in the policy, national security, trade, and critical mineral sectors.

"For the new target set, the first sweep targeted Graph tokens from the SkyKick app and occurred on October 15 between 09:25:04 and 12:35:50 UTC," Huntress said. "The second sweep hit the same tenants on the same date, between 13:54:39 and 14:20:24 UTC. This sweep appeared to be manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs."

In all, the managed security service provider has identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity from the IP address in question, out of which 300 succeeded. Despite the successful sign-in, the absence of a service principal in some tenants is said to have prevented the threat actor from gaining access to those tenants.

Partners are advised to take the following actions -

Review both their own Microsoft 365 tenant and each managed customer tenant, including environments with dormant SkyKick connections.
Verify the status of the listed application connections and keep affected applications disabled until further notice.
Review sign-ins across identities from October 13, 2026, through the current time, specifically for activity originating from the IP address "144.172.64[.]128."
Preserve available sign-in and audit records before initiating containment steps.
Review application and user authentication, application credentials and federation trusts, directory roles, owners, consent grants, and recent policy changes.
Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
Investigate any other identities changed or used during suspicious activity.

https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html

10/18/2026

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

ybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.

ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) to secure their clients' Microsoft 365 or Google Workspace data. To accomplish its tasks, the application is granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant on which it's installed.

Huntress said it has observed confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. The incident impacts every organization that has the app installed, and the credential works against every tenant the app is consented in.

"The app's credential is in hostile hands," security researcher Jonathan Semon said. "It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list."

In the observed attackers, the adversary has been observed authenticating to the app using their own tooling, in a manner analogous to the backup service, and obtains tokens with the app's existing permissions. Given that the app has extensive permissions to access customer data, an attacker in possession of the tokens can read mailboxes, files, and directory data the backup service can.

Huntress said the same IP address engaged in password spraying against four law firm tenants on October 13 and 14, 2026, although it said it detected no successful user sign-ins in its telemetry.

In at least one partner tenant, the cybersecurity company said it found a separate ConnectWise app assigning itself Global Administrator privileges and adding credentials to other trusted applications within this environment, thereby opening a pathway to other privileged apps within customer environments. This effectively extends the risk beyond the vendor account.

The ConnectWise Cloud Management app for Microsoft Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that modified two other applications in the tenant: an MSP management application, and Huntress's own application (Huntress Security Platform), adding new client secrets to both," Semon explained.

"The two applications that received new secrets are trusted, privileged tools. Adding a credential to an MSP management application can extend access beyond the one tenant, because those applications are often consented into the MSP's customers' tenants. A credential on a security tool's application gives the holder whatever that tool is permitted to do."

Todyl, in a similar analysis, said it detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application.

In response to the incident, ConnectWise has taken the step of closing Cloud Backup application access until further notice. The company said it has found no evidence that Cloud Backup partner backup data has been compromised. It has also shared the following steps to look for indicators of compromise -

In the Microsoft Entra Admin Center, navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
The default User sign-ins tab will not display the required information.
In the IP address column, review authentication activity originating from IP addresses outside expected Microsoft/Azure ranges. The application's normal egress has been identified as Azure private IPv6.
Suspicious IP address: 144.172.64[.]128

"The backup service needs broad access to do its job, and an attacker using its credentials will inherit that level of access for every tenant where the app is installed," Huntress explained.

"Depending on the permissions in the tenant, that can include mailboxes, OneDrive and SharePoint files, Teams data, and directory information, much of it belonging to your clients. Some of that access, such as directory reads through Microsoft Graph, leaves no audit trail, which is why we suggest acting now instead of waiting for proof of access. The full potential impact depends on the permissions in play in each tenant."

Users are recommended to disable the application until ConnectWise confirms all credentials have been reset, enable Microsoft Graph activity logs, audit for any new credentials added since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role.

Attackers used a compromised ConnectWise Cloud Backup credential for unauthorized sign-ins across 173 Microsoft 365 tenants.

08/31/2026

We will be closed on Monday, September 7th!

On Monday, September 7th, our phone support lines will be closed in observance of the Labor Day holiday. Any tickets submitted through the web portal will be processed next business day (with exception of Disaster Recovery Service customers). Phone lines will be open again at 9:00AM on Tuesday, September 8th.

From everyone at InfoQuest Consulting LLC - Have a happy and safe Labor Day!

08/28/2026

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions

PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks.

The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An investigation into the incident is ongoing.

The following indicators of compromise have been shared so far -

Alerts from intrusion-detection, endpoint-security, or network-monitoring tools involving the PaperCut Application Server, particularly suspicious post-exploitation activity from "pc-app.exe"
Missing, unexpectedly truncated, or deleted PaperCut server.log files
The presence of the below entries in "server.log" -
ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

There are currently no details about the flaw, how it is being exploited, or who is behind the efforts. Users who have PaperCut NG/MF Application Server exposed to the internet are advised to immediately restrict access to trusted IP addresses.

"Use firewall rules, network access controls, or equivalent measures to ensure the PaperCut server’s web interfaces cannot be reached from untrusted internet addresses," PaperCut said. "Take this action now, even if you have not observed suspicious activity."

In 2023, a critical flaw in PaperCut MF and NG (CVE-2023-27350, CVSS score: 9.8) was exploited by Russian threat actors as well as a financially motivated hacking group called Lace Tempest to deliver Cl0p and LockBit ransomware.

(This is a developing story. Please check back for more details.)

PaperCut says a zero-day affecting all NG and MF versions is actively exploited; emergency patches are available for v25 and v26.

06/29/2026

We will be closed on Saturday, July 4th!

Our phone support lines will be closed on Saturday in observance of the July 4th holiday. Any tickets submitted through the web portal will be will be processed next business day (with exception of Disaster Recovery Service customers).

From everyone at InfoQuest Consulting LLC - Have a happy and safe 4th of July!

06/29/2026

New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets

DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration for this variant.

Tracked as CVE-2026-43503 (CVSS 8.8), it lets a local user corrupt file-backed memory through a cloned network packet and gain root. The patch landed in mainline on May 21; if your kernel does not have it, update now.

When the kernel copies a network packet internally, two helper functions drop a safety flag that marks the packet's memory as shared with a file on disk. That missing flag is the entire vulnerability.

The attacker loads a privileged binary like /usr/bin/su into memory, wires those memory pages into a network packet, and forces the kernel to clone it. The cloned packet passes through an IPsec tunnel that the attacker controls, and the decryption step overwrites the binary's login checks with attacker-chosen bytes. The next time anyone runs su, it hands over root.

The file on disk never changes. The modification lives only in the kernel's in-memory copy, so file-integrity tools miss it, the attack leaves no audit trail, and a reboot restores the original binary. The attacker already has root by the time anyone might think to check.

The exposed systems are multi-tenant servers, CI runners, container hosts, and Kubernetes clusters where untrusted users can create namespaces. JFrog confirmed the exploit on Debian, Ubuntu, and Fedora systems with default namespace configurations.

This is the fourth recent privilege escalation with the same failure mode: file-backed memory gets treated as packet data, then an in-place network operation writes where it should have copied.

Copy Fail (CVE-2026-31431) came first in late April, exploiting the algif_aead module for a four-byte page-cache write.
DirtyFrag (CVE-2026-43284 and CVE-2026-43500) followed on May 7, chaining IPsec ESP and RxRPC paths for a full write primitive.
Fragnesia (CVE-2026-46300) appeared on May 13, bypassing the DirtyFrag patch through a flag-dropping bug in skb_try_coalesce().

What to Do

Install your distribution's kernel update. The fix landed upstream in v7.1-rc5 and has been backported to stable and LTS branches. Ubuntu, Debian, and SUSE have published advisories; Red Hat has a Bugzilla tracking entry.

If you cannot patch today, two workarounds reduce the attack surface. Restrict unprivileged user namespaces: on Debian and Ubuntu, set kernel.unprivileged_userns_clone=0 (other distributions use different mechanisms).

Alternatively, blacklist the esp4, esp6, and rxrpc kernel modules, though that breaks IPsec and AFS and only works when those features are loadable modules rather than compiled into the kernel. Both are temporary controls, not fixes.

DirtyClone, tracked as CVE-2026-43503, lets local users gain root by corrupting file-backed memory through cloned network packets.

06/03/2026

New CIFSwitch Linux flaw gives root on multiple distributions

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

The issue, now tracked as CVE-2026-46243, impacts multiple Linux distributions that ship vulnerable combinations of the kernel CIFS and cifs-utils (versions 6.14 and higher, although some older variants are also affected).

CIFS (Common Internet File System) is a networking protocol that allows access to files, folders, and devices across a local network. Linux uses it to mount, read, and write data from remote systems.

"The kernel requests a cifs.spnego-type key, and the normal keyutils/request-key config runs cifs.upcall as root to fetch or build the Kerberos/SPNEGO material," explains Asim Viladi Oglu Manizada, a SpaceX security engineer who discovered and named the CIFSwitch privilege escalation vulnerability in Linux.

As a result, an unprivileged user can create a forged cifs.spnego request and trigger the normal authentication workflow.

Impact, fixes, and the exploit

Manizada says that CIFSwitch was introduced 19 years ago, in 2007. He adds that it is "non-universal" and exploiting it depends on several factors, such as a vulnerable kernel version.

Some distributions Manizada confirms as vulnerable with their default configurations are:

Linux Mint 21.3 / 22.3
CentOS Stream 9
Rocky Linux 9
AlmaLinux 9
Kali Linux 2021.4–2026.1
SLES 15 SP7

The researcher noted that various Ubuntu, Debian, Pop!_OS, openSUSE, Oracle Linux, and Amazon Linux versions might also be vulnerable if ‘cifs-utils’ is installed.

However, there are also versions such as Ubuntu 26.04, Fedora 40-44, CentOS Stream 10, Rocky Linux 10, SLES 16, AlmaLinux 10, and openSUSE Leap 16, where the default SELinux/AppArmor settings prevent exploitation of CIFSwitch.

Also, Amazon Linux 2 and Kali Linux 2019.4 and 2020.4 are not affected at all, as their cifs-utils versions lack the namespace-switch functionality.

CIFSwitch has been fixed by a kernel patch that adds validation of cifs.spnego request origins (upstream commit 3da1fdf), but the exact kernel versions that ship that patch vary per distribution.

The researcher recommends that users disable or blacklist the CIFS module if unused, remove the cifs-utils package if unnecessary, and disable unprivileged user namespaces.

Manizada published a proof-of-concept (PoC) exploit for CIFSwitch, which can help organizations validate the effectiveness of the applied patches and mitigations.

CIFSwitch is the latest in a series of privilege-elevation flaws impacting Linux systems that were recently disclosed, including ‘Copy Fail,’ ‘Dirty Frag,’ ‘Fragnesia,’ ‘DirtyDecrypt,’ and ‘PinTheft.’

A newly discovered local privilege escalation vulnerability dubbed 'CIFSwitch' in the Linux kernel could allow attackers to forge CIFS authentication key descriptions, abuse the kernel's key request mechanism, and gain root privileges.

05/12/2026

GhostLock Tool Leverages Windows API to Lock File Access Like Ransomware

Traditional ransomware disrupts organizations by encrypting data and demanding payment for decryption keys.

However, a newly disclosed technique called GhostLock demonstrates a fundamentally different availability attack that achieves the same business disruption without writing a single encrypted byte to disk.

Discovered by Kim Dvash, an Offensive Security Team Leader, GhostLock exploits standard Windows file-sharing behavior to cause widespread accessibility failures.

By systematically holding files in an exclusively locked state, a low-privileged domain user with standard read access can paralyze corporate Server Message Block (SMB) file shares. From the victim’s perspective, the impact is identical to a ransomware infection.

Critical files become inaccessible, enterprise resource planning applications crash, and shared workflow pipelines fail, requiring specialist intervention to restore operations.

The technique exploits a fundamental, well-documented behavior of the Windows operating system. By invoking the CreateFileW API with dwShareMode set to 0x00000000, any authenticated domain user can acquire an exclusive deny-share handle on a file over SMB.

This forces a STATUS_SHARING_VIOLATION (0xC0000043) error for every other process or network client attempting to open that file for any purpose, including read, write, or delete until the handle is voluntarily closed or forcibly terminated by a storage administrator.

The attack surface is not new. CreateFileW with dwShareMode = 0 is the same mode Microsoft Office uses when it opens a document for editing a behavior that has existed since Windows NT 3.1. No CVE has been filed because there is no software defect to patch.
GhostLock Attack Exploited

GhostLock implements this single API call through a Python ctypes wrapper requiring no administrative rights and no external dependencies.

To scale across an enterprise NAS, it employs a 32-thread parallel work-stealing scanner that parallelizes SMB2 QUERY_DIRECTORY round-trips, reducing file discovery on a 500,000-file share from over 61 minutes to approximately 6 minutes and 22 seconds.

During a 60-second hold period, victim simulations recorded a 99.8% file access block rate. A single SMB session can hold up to 64,000 exclusive handles simultaneously; with ten parallel sessions, an attacker can exceed 500,000 locked handles sufficient to paralyze a significant fraction of an entire enterprise NAS deployment.

What makes GhostLock particularly dangerous is its complete evasion of every conventional ransomware defense layer. The paper evaluated the tool against seven enterprise security control categories:

Honeypot/canary files produced zero alerts — canaries trigger on write events, and GhostLock performs no writes.
Write-rate anomaly detectors produced zero alerts — the metric they monitor (write operations) is simply absent.
Behavioral AI ransomware engines produced zero alerts — GhostLock’s read-open profile is indistinguishable from a search indexer or backup pre-scan agent.
Commercial EDR agents produced zero alerts — the system call profile mirrors Microsoft Word opening documents.
NDR/deep packet inspection produced zero alerts — SMB2 traffic showed only CREATE and CLOSE requests, identical to normal document access.
SIEM correlation rules produced zero alerts — no existing ruleset monitors per-session exclusive handle accumulation.

The only reliable detection signal exists inside the NAS management layer itself: the per-session count of simultaneously held exclusive handles.

The paper notes that a legitimate single-user application rarely holds more than a few dozen exclusive handles at once, while GhostLock accumulates tens of thousands, but this metric is not ingested by any enterprise SIEM reviewed in the research.

Even after detection, recovery is not straightforward. Terminating the offending SMB session requires storage administration expertise, and in most large enterprises, the storage operations team and security operations team operate independently without pre-built joint runbooks.

The estimated mean time to recovery in tabletop exercises without a pre-built runbook was 4 to 8 hours.

Notably, if the attacker’s Active Directory credentials are revoked, the existing authenticated SMB session and all its locks can persist for an additional 15 to 60 minutes before session timeout, depending on platform configuration.

Dvash calls on NAS vendors to expose per-session exclusive-handle counts as standard security telemetry alongside existing syslog outputs, and urges SIEM vendors to build storage platform integrations that ingest this data.

For immediate defensive action, the paper recommends alerting on any single SMB session accumulating more than 500 exclusive handles, implementing an NDR rule for bulk SMB CREATE requests with zero corresponding WRITE operations over a 30-minute window, and establishing a joint SecOps/StorageOps runbook specifically for NAS session termination.

GhostLock demonstrates a fundamentally different availability attack that achieves the same business disruption without writing a single encrypted byte to disk.

05/11/2026

How to Protect Your Linux Systems from "Dirty Frag" and "Copy Fail" exploits

For those who have been concerned about the impact of the two most recent Linux exploits that allow escalation of privilege to root access, here are the current recommendations from InfoQuest Consulting LLC.

Both exploits have been confirmed to target all major Linux distributions released since 2017, so systems released after that time are potentially vulnerable.

FOR "DIRTY FRAG":

At the moment, most major vendors are still working on releasing a patch for affected distros, so systems are still vulnerable. Defenders should assume any local foothold on an unpatched host can become root within seconds.

You can mitigate your risk of exposure by performing these moves IMMEDIATELY!

1. Restrict Shell Access: Revoke SSH or Telnet terminal permissions for all non-administrator accounts.

2. Minimize Attack Surface: Disable unused services, such as the Web Server, and uninstall non-essential third-party applications.
Ensure your server, NAS or network appliance is not directly exposed to the internet. Utilize a firewall or a VPN to restrict access to trusted internal networks only.

3. Implement the following workarounds to block the affected modules from loading into memory. Here are recommendations from Red Hat and Ubuntu. Will post links from other vendors as they become available:

Ubuntu: https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

Red Hat: https://access.redhat.com/security/vulnerabilities/RHSB-2026-003

Please be advised that the fixes require a reboot of affected systems so it is advised to perform the fixes at the earliest time which will not affect your business.

NOTE: these workarounds may "break" certain services. Please use with caution. If you need assistance with implementing these fixes, please contact InfoQuest Consulting LLC for a consult:

* Contact @ (404) 644-1386 between 9:00AM - 6:00 PM EST (M-F) or 10AM -2PM EST (Sat) to set up a call -back appointment
* go to https://www.infoquestconsultingllc.net/support and click on the "Virtual Appointment" button to setup a virtual appointment through Zoom.

4. If you are running container workloads on your Linux systems, Restrict AF_KEY, AF_RXRPC, and XFRM netlink syscalls in container runtimes via seccomp profiles; the default Docker seccomp profile already blocks AF_RXRPC but not AF_KEY or XFRM netlink configuration.

FOR "COPY FAIL":

1. Check the kernel version that you are running. Patches are now available for affected kernels through your distro's update mirrors.

Only 4.15 kernel versions (and higher) are affected.
4.4 kernel versions are not affected.

Update to a patched kernel version ASAP. For Ubuntu distros, perform the following commands:

sudo apt update && sudo apt upgrade

If this is not possible, the affected component can be targeted:

sudo apt update && sudo apt install --only-upgrade kmod

2. If you are running a distro which is EOL (end of life), and you do not have an extended service plan for security updates, you will need to either migrate to a newer distro or either block the kmod module by creating a /etc/modprobe.d/manual-disable-algif_aead.conf file. This is the same action that the kmod update performs.

If you need assistance with any of these issues, please contact InfoQuest Consulting LLC for a consult:

* Contact @ (404) 644-1386 between 9:00AM - 6:00 PM EST (M-F) or 10AM -2PM EST (Sat) to set up a call -back appointment
* go to https://www.infoquestconsultingllc.net/support and click on the "Virtual Appointment" button to setup a virtual appointment through Zoom.

InfoQuest Consulting is a full-service company dedicated to helping small to medium firms manage their security needs for their existing computer networks and their data protection services. With Customer support you can depend on!

05/11/2026

New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks

A newly disclosed local privilege escalation vulnerability affecting major Linux distributions may already be exploited in the wild.

The exploit, named Dirty Frag and Copy Fail 2, chains two flaws tracked as CVE-2026-43284 and CVE-2026-43500, allowing an unprivileged user to escalate permissions to root.

Researcher Hyunwoo Kim responsibly disclosed the vulnerability, but someone made it public before patches could be released, prompting Kim to make the technical details and PoC code available.

“Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high,” Kim explained.

The vulnerabilities affect the xfrm-ESP (IPsec) and RxRPC components of the Linux kernel, with the greatest impact on hosts that do not run container workloads. In container deployments, an attacker may be able to exploit Dirty Frag to escape a container, but this has yet to be demonstrated, Ubuntu developers noted.

Dirty Frag is similar to Dirty Pipe, a vulnerability that emerged in 2022, and the recently discovered flaw named Copy Fail.

Copy Fail has been exploited in the wild, and Microsoft reports that Dirty Frag may also have been exploited.

According to the tech giant, Dirty Frag can be exploited after attackers gain access to the targeted system, which can be achieved through various means, including compromised SSH accounts, web shell access via internet-exposed applications, abusing service accounts, container escapes to the host environment, or remote access compromise.

Microsoft said its Defender product has seen limited in-the-wild activity that could indicate exploitation of either Dirty Frag or Copy Fail.

“After gaining elevated access, the actor modifies a GLPI LDAP authentication file (evidenced by a .swp file from vim), performs reconnaissance of the GLPI directory and system configuration, and inspects an exploit artifact,” Microsoft explained.

“The activity then shifts to accessing sensitive data and interacting with PHP session files — first deleting multiple session files and then forcefully wiping additional ones — before reading remaining session data, indicating both disruption of active sessions and access to session contents,” it added.

Linux distributions have started releasing patches and mitigations for Dirty Frag, including Red Hat, Amazon Linux, Ubuntu, Fedora, and Alma Linux.

Also called Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, the exploit was disclosed before a patch was released.