This week’s Paul’s Security Weekly covers everything from a massive public exploit dump to yet another Linux kernel LPE. Buckle up.
First up: someone on GitHub dropped “exploitarium” — a single repo packing PoC exploit code and vulnerability writeups for roughly 15 to 18 different products. Anonymous account “bikini” just posted it without telling any vendors first. GitHub banned the account and yanked the repo. GitLab followed within days. Is this the early days of people YOLO’ing exploits into the wild? It’s both impressive and terrifying.
Next — the Athena coalition keeps finding vulnerabilities in open source code using frontier AI models. Members point models like Mythos or GPT-5.5-Cyber at commonly used libraries, find bugs, and submit reports to Chainguard. The catch? This is a club. You only get the vulnerability info if you’re a member. That conflicts with the whole point of open source. If you run OSS, you deserve to know what’s broken so you can fix it — or switch libraries.
Palo Alto Networks’ Unit 42 published research on “phantom squatting.” Attackers register domains that LLMs commonly hallucinate for well-known brands, then weaponize them for phishing. It gets worse — the research notes that frontier models still hallucinate CVE IDs. A digit off in the year and the model treats two different CVEs as the same thing.
A critical Linux LPE called “pedit COW” (CVE-2026-46331) lets an unprivileged local user gain root by corrupting in-memory cached binaries via the tc subsystem’s pedit action. No touching on-disk files. There’s also a related container escape (ipv6_frag_escape) that lets a low-privilege process break out of Docker-style containers and take over the host.
Also covered: libssh2 CVE-2026-55200 (outbound SSH as attack surface), TP-Link DHCP Option 66 unauthenticated RCE (CVE-2026-11834), the FCC banning Chinese-produced network equipment from Huawei, ZTE, Hikvision and others, and OpenAI’s “Patch the Planet” initiative for open source security.
