KVM Arm64 Guest Escape PoC Released

CVE-2026-46316 — A guest-to-host escape in KVM/arm64's VGIC-ITS translation cache is the day's most alarming Linux kernel disclosure. The flaw allows a malicious VM to corrupt the hypervisor's memory by walking the per-ITS translation cache with xa_for_each() and dropping references for entries that may already have been erased. Cyber Security News reports that a proof-of-concept exploit has already been released, and Vypr Intelligence notes this was part of a batch of 25 kernel CVEs disclosed June 8–9. With a CVSS 9.3 and a working PoC in the wild, this should be at the top of every cloud and virtualization team's patching queue.

CVE-2026-54420 — A LiteSpeed cPanel plugin vulnerability is being actively exploited in shared-hosting environments running CloudLinux/CageFS. The flaw, in versions before 2.4.8 of the LiteSpeed cPanel plugin (distributed in LiteSpeed WHM PlugIn before 5.3.2.0), mishandles symlinks provided by a user with FTP or web shell access. An attacker with a low-privilege foothold on a shared server can leverage the symlink mishandling to escalate privileges or access other tenants' data. This is a confirmed in-the-wild exploitation scenario, making it the highest-signal event of the day for hosting providers.

CVE-2026-46289 and CVE-2026-46325 — Two additional critical Linux kernel flaws round out the batch. CVE-2026-46289 (CVSS 9.8) is a bug in extract_kvec_to_sg() within the scatterlist library that causes incorrect length calculations, potentially leading to memory corruption when handling kvec and user variants of extract_iter_to_sg(). CVE-2026-46325 (CVSS 9.8) affects the RDMA/rxe driver, where the IOVA-to-VA conversion for memory regions with page sizes different from PAGE_SIZE is incorrectly implemented. Both are rated 9.8 and, as Vypr Intelligence notes, were part of the same 25-CVE disclosure wave. While no public PoC has been reported for these two yet, the sheer number of critical kernel bugs in a single batch demands attention.

CVE-2026-12183 — A gas station automation system from Nefteprodukttekhnika carries a critical authentication bypass that is almost too on-the-nose for critical infrastructure. The BUK TS-G system (versions 2.9.1 through 2.10.2 on Linux) exposes an endpoint at /php/ajax-login.php that returns userid=1 (admin) without proper authentication. With a CVSS 9.8, this means any network-adjacent attacker can gain full administrative control over gas station fueling and monitoring systems. While the EPSS score is currently 0.00, the attack vector is trivial and the asset class — fuel infrastructure — makes this a high-priority disclosure for industrial security teams.

CVE-2026-12174 — D-Link's DCS-935L IP camera (firmware 1.10.01) contains a format string vulnerability in the HTTP Handler component. The snprintf function in /web/cgi-bin/greece/rhea allows manipulation of the data argument, leading to a format string attack (CVSS 8.8). Format string bugs in embedded devices typically enable remote code execution or information disclosure. This camera is a consumer/IoT device that is likely past its end-of-life support window, meaning no patch will be forthcoming — users should treat these as permanently compromised and isolate or replace them.

CVE-2026-6428 — Koha, the open-source integrated library system used by thousands of libraries worldwide, has a SQL injection vulnerability in reports/catalogue_out.pl. An authenticated staff user can exploit this to execute arbitrary SQL commands. The affected versions span a wide range: through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00. Given that Koha is often deployed on shared or minimally segmented library networks, a SQL injection could expose patron records, circulation data, and potentially serve as a pivot point into broader municipal networks.