AI Tool Uncovers 15-Year-Old Linux Kernel Root Exploit Affecting Most Distros

·4 views

Nebula Security's AI platform VEGA has discovered GhostLock, a use-after-free vulnerability in the Linux kernel's futex subsystem that has existed since kernel version 2.6.39 was released in 2011. Tracked as CVE-2026-43499, the flaw allows an unprivileged local user to gain full root access in approximately five seconds, with a reported 97% success rate on vulnerable systems. The bug requires no special kernel configuration, meaning standard installations across most Linux distributions are affected. Because futexes underpin threading in glibc, container runtimes, and language virtual machines, the vulnerability has broad reach — and researchers warn it can also be used to escape containers and compromise the underlying host. The discovery highlights a growing capability of AI-assisted code review to surface critical security flaws that years of manual auditing had missed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Clock Drift Broke a Redis Lock, Letting Two Workers Run the Same Billing Job

A nightly billing-reconciliation system designed to run once on one of three workers accidentally executed twice simultaneously, doubling entries for the same customer batch. The root cause was an NTP daemon that had silently stopped syncing after a container restart, leaving one worker's clock running roughly 9 seconds behind the Redis server's clock. Because Redis measures lock expiry using its own clock, the 30-second lock expired sooner than the worker expected, allowing a second worker to acquire it while the first was still running. The engineering team resolved the issue with three fixes: adding a background thread to auto-renew the lock, introducing monotonically increasing fencing tokens to reject stale writes, and adding explicit monitoring alerts on NTP synchronisation status. The incident highlights a fundamental risk in lease-based distributed locks — the lock server and client clocks must stay in close agreement, or the safety margin can silently disappear.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Treat Scope Creep as a State Machine, Not a Client Problem

A framework published on DEV Community argues that scope creep is best managed as a structured state machine rather than blamed on difficult clients or poor relationships. Under this model, every new project request must be classified into one of four states: included, swapped, deferred, or added — before any work begins. The approach requires developers to calculate and communicate both the fee impact and schedule impact of each change, accounting for factors beyond raw coding time such as context switching, retesting, and displaced capacity. A standard response template is proposed to acknowledge requests, name scope boundaries, and obtain written approval without conflict. The author also recommends defining clear acceptance criteria at project kickoff to make future scope disputes easier to resolve by reference rather than negotiation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Tool Lets Solo Founders Automate Email Verification in Signup Bots

A new guide published on DEV Community explains how solo founders and non-engineers can fully automate account registration workflows, including the email verification step that typically requires manual intervention. The solution combines Playwright, a browser automation engine, with Claude Code, an AI coding agent, so users can describe tasks in plain English without writing code themselves. A key component is the UnCorreoTemporal MCP server, which provides the bot with a fresh disposable inbox for each run, eliminating the need to use personal or reused email addresses. The server supplies dedicated tools such as create_signup_inbox and wait_for_verification_email, allowing Claude Code to handle the entire signup loop autonomously. The approach addresses common pain points like personal inbox bottlenecks, flagged reused addresses, and the complexity of connecting real email accounts programmatically.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Launches Agentic Autofix for Code Scanning Alerts in Public Preview

GitHub released an agentic autofix feature for code scanning alerts in public preview on July 10, 2026, designed to automatically generate patches for identified vulnerabilities. The system moves each alert through multiple stages — from candidate patch generation through build, testing, security checks, and human review before any merge. Experts caution that simply measuring the percentage of alerts with a generated patch is a misleading success metric, as generation is only the first of many critical steps. A structured evaluation framework is recommended, using deterministic canary assignments, detailed failure classification, and predeclared reliability gates to ensure patches genuinely resolve security issues without introducing regressions. Broader deployment should be justified by bounded evidence and explicit safety checks rather than surface-level averages.

0 comments Read more at DEV Community