Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The public proof-of-concept panics the host; the researcher claims that a separate, unreleased expl…

https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html

sha256:7a3148a612933eca03a5a55196c829a8889d3815719dabf84d4b9ed2b0f9dfee

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve7
md50
url0
ipv40
ipv60
sha10
domain1
sha2560
malware_token1
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-43284	Open →
cve	CVE-2026-43500	Open →
cve	CVE-2026-53359	Open →
cve	CVE-2026-46817	Open →
cve	CVE-2026-55200	Open →
domain	role.word	Open →
cve

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Turla

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports