The Patch

Several security vulnerabilities have been discovered in the Linux kernel. Details of the flaws and patched kernel versions are being circulated in the security community, prompting administrators and developers to check their systems and plan updates. As the Linux kernel underpins much of the internet's infrastructure and countless devices, new kernel vulnerabilities typically draw immediate attention from operators and security teams worldwide.

Meta quietly patched a serious security vulnerability in its Muse product shortly before launch, according to 404 Media. The flaw, described as a 'VM escape', could have allowed a user to break out of the sandboxed environment and access sensitive internal Meta databases. The company fixed the issue before the public release, but the near-miss is drawing attention to how thoroughly new AI products are being tested before they ship.

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable kernel releases, has a talk on software security in the era of large language models. The discussion covers what LLM-generated code means for the kernel's security processes and for maintainers reviewing an influx of machine-written patches.

A zero-day vulnerability in KVM, the Linux kernel's virtualization module, reportedly allows a virtual machine to escape and execute code on the host system. Cybernews describes the flaw as critical, since KVM underpins cloud infrastructure and enterprise virtualization widely. Security researchers are discussing the potential impact on cloud providers and the urgency of patching.

A cybersecurity newsletter bulletin rounds up more than 20 stories, headlined by a data breach at the Pentagon alongside newly disclosed zero-day vulnerabilities in Citrix, Fortimail and Apple products. The roundup highlights an unusually busy stretch for security teams, with flaws affecting widely used enterprise and consumer software requiring urgent patching and attention.

Kit, the email marketing service formerly known as ConvertKit, has patched a missing authorization vulnerability tracked as CVE-2026-105421 in its Kit for WooCommerce WordPress plugin. Versions through 2.2.0 are affected, and the fix is available in version 2.2.1. No exploitation in the wild has been confirmed, but security researchers are urging users of the plugin to update promptly.

A newly disclosed vulnerability, CVE-2026-105238, affects NextChat and carries a CVSS score of 7.3. Security researchers report a server-side request flaw that lets a single unauthenticated request make the server fetch arbitrary internal URLs or cloud metadata endpoints, bypassing access-code protection. No patched version has been confirmed; mitigations include blocking the x-base-url header at reverse proxies and restricting server egress.

Security teams are being reminded that patching everything at once is impossible, so prioritization matters. The discussion centers on how organizations should rank vulnerabilities by real-world risk, exploitability and business impact rather than severity scores alone. With exploits increasingly weaponized fast, choosing which flaw to fix first has become a core part of cybersecurity strategy.

Saber Interactive's zombie shooter World War Z has released a new update called Waves of Lead, accompanied by an official launch trailer. The trailer showcases the fresh content added to the co-op game, and gaming communities are sharing the news as players check out what the latest patch brings to the title.

A game-worn Kobe Bryant Los Angeles Lakers jersey bearing an NBA Finals patch has gone up for auction. Items tied to the late Lakers star consistently draw intense interest from collectors, and Finals-worn memorabilia ranks among the most coveted basketball collectibles, with prices for authenticated Bryant pieces previously reaching millions at major auctions.

Meta reportedly patched a virtual machine escape vulnerability in its MetaMuse product immediately before launch, according to 404 Media reporting. A VM escape flaw would let code break out of an isolated virtual machine, a serious security risk. Users in infosec and tech communities are discussing the fix and whether it connects to a fellow Mastodon user known to run servers from their own systems.

Meta quietly patched a serious 'VM escape' vulnerability in its Muse product only moments before launch. According to 404 Media, the flaw could have allowed a Muse user to break out of the sandbox and access sensitive internal Meta databases, exposing company data and potentially user information. The last-minute fix is raising questions about how thoroughly the product was tested before release and how close Meta came to a major security incident.