The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting vulnerabilities in the Linux kernel and Android operating system. Organizations and users are urged to apply patches immediately.
CISA disclosed the threat following reports of real-world attacks targeting both platforms. The vulnerabilities affect critical components used across millions of devices globally, from servers running Linux to Android smartphones and tablets.
Linux Kernel Vulnerability
The Linux kernel flaw allows attackers to escalate privileges and execute arbitrary code with elevated permissions. This vulnerability poses particular risk to enterprise environments relying on Linux-based infrastructure.
Android Security Issue
The Android vulnerability similarly enables unauthorized access and code execution on affected devices. Users running older versions of Android face heightened exposure, as patch availability varies by device manufacturer and carrier.
Immediate Actions
CISA recommends users and organizations:
- Install available security updates immediately
- Prioritize patching on systems exposed to untrusted networks
- Review access logs for signs of exploitation
- Enable automatic security updates where possible
Risk Assessment
The active exploitation indicates these vulnerabilities are not theoretical threats. Attackers have developed working exploits and are actively deploying them against targets. Organizations should treat these as critical priorities rather than standard patch cycles.
Linux administrators should check their kernel versions and apply updates from their distribution provider. Android users should check Settings > System > System Update for available patches. Device manufacturers including Samsung, Google Pixel, and others have released or are releasing patches.
Ongoing Monitoring
CISA will continue monitoring attack activity and may issue additional guidance. The agency maintains a catalog of known exploited vulnerabilities on its website for reference.
Both Linux and Android represent significant attack surfaces due to their widespread deployment. These latest vulnerabilities underscore the importance of maintaining current security patches across all systems and devices.
A threat actor deployed the open-source Hermes AI agent in unattended mode to automate post-exploitation activities during an alleged breach of Thailand's Ministry of Finance.
OnTrac, a major parcel delivery company, has notified customers of a network breach that may have exposed personal information. The hack compromised the company's corporate systems.
Slopsquatting, phantom domains, and HalluSquatting exploit identical vulnerabilities in AI coding agents. Security researchers warn that these attacks leverage late-binding patterns where AI systems trust non-existent packages and repositories.
Chick-fil-A confirmed a credential stuffing attack compromised over 13,000 customer accounts between June 17-19. The breach targeted the restaurant chain's website and mobile app.