Eresus research, advisory, and security news
We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.
Featured Posts
Latest Posts
Dirty Frag CVE-2026-43284: Linux Kernel Local Privilege Escalation via ESP and RxRPC
Dirty Frag (CVE-2026-43284 / CVE-2026-43500) is a deterministic Linux kernel local privilege escalation vulnerability chain in the xfrm-ESP and RxRPC subsystems. Microsoft Defender has observed limited in-the-wild exploitation. Includes mitigation commands, affected distro list, Fragnesia variant (CVE-2026-46300), and a hardening checklist for Kubernetes nodes and CI runners.
AI Chatbot Web Application Pentesting: Attack Surface Beyond Prompt Injection
How to pentest the web application wrapping an AI chatbot — not the LLM itself. Covers IDOR in conversation endpoints, XSS via AI markdown rendering, API key exposure in frontend bundles, SSRF via browsing tools, rate-limit abuse for cost amplification, file upload attack paths, and authorization failures in share/export features.
CVE-2026-7482: Ollama GGUF Heap Out-of-Bounds Read — Full Technical Analysis
CVE-2026-7482 is a critical heap out-of-bounds read in Ollama's GGUF model loader (CVSS 9.1). Unauthenticated remote attackers can leak ~2 MB of heap memory per request — including environment variables, API keys, system prompts, and concurrent users' conversation data. Two-bug chain, full PoC, patch diff, and Ollama 0.17.1 fix.
CVE-2026-41940: Emergency Action Plan for cPanel & WHM Authentication Bypass
CVE-2026-41940 is a critical authentication bypass in cPanel & WHM affecting all versions after 11.40. Covers affected versions, patch commands, temporary firewall mitigations, session IOC checks, and a fleet action checklist for hosting teams.
Copy Fail CVE-2026-31431: Linux Kernel Local Privilege Escalation
CVE-2026-31431 (Copy Fail) is a local privilege escalation vulnerability in the Linux kernel's algif_aead cryptographic interface. Affects kernels from 4.14 to 6.12.x across Ubuntu, RHEL, Debian, Amazon Linux, and more. Includes a kernel module workaround, container hardening steps, and a patch strategy for Kubernetes nodes and CI runners.
What Is AWS IAM in Cloud Security?
Learn how AWS Identity and Access Management (IAM) controls access, prevents data breaches, and serves as the ultimate perimeter in modern cloud security.
Vercel, Context.ai, and AI SaaS Security
Eresus analyzes the April 20, 2026 Vercel incident linked to Context.ai and explains why OAuth-connected AI tools now belong in the core SaaS attack surface.
The April 2026 MCP RCE Wave
Why MCP security depends on architecture, identity, tool isolation, and registration control more than a single CVE.
AI Agent Traps: Web Attacks Against Agents
How hidden web content, poisoned context, and tool access can manipulate autonomous AI agents in real enterprise workflows.