Linux NFTables Root Exploit, Gemini Prompt Injection,…

When the Attack Surface Runs the Network

Five stories this week, one thread: attackers keep moving up the stack from kernel primitives to AI assistants to the infrastructure carrying all your traffic. Here's what stood out from the operator chair.

Four months is an eternity until it's weaponized, then it's nothing. A single inverted character in the Linux kernel's NFTables subsystem (CVE-2026-23111) lets an unprivileged user escalate to root and escape containers into the host underneath. Two independent research teams found different exploitation paths from the same bug. The four-month patch-to-exploit gap sounds like breathing room; with AI compressing development timelines to hours, it mostly isn't. If a patch doesn't address the underlying primitive, both paths survive it.

Your AI assistant is as trustworthy as every notification it reads. A prompt injection flaw in Google Gemini lets malicious instructions hidden inside phone notifications influence what the assistant says and does without any direct user interaction. A system-wide assistant with cross-app permissions is a very wide IPC channel: get in through one malicious package, and you inherit whatever Gemini can touch. Prompt injection is becoming the new XSS: obfuscation techniques are already getting creative, and nobody has a real solution yet.

Owning the SD-WAN means owning what it can see. Cisco disclosed an actively exploited zero-day in Catalyst SD-WAN giving unauthenticated attackers root on a system managing connectivity across offices, clouds, and remote users. This is why advanced operators prefer infrastructure over endpoints: control the routing fabric and you control what the target thinks is segmented. Edge devices are patient targets; internet-facing, rarely rebooted, hard to log, and yours indefinitely once you're in.

The real AI attack surface is the tooling, not the model. Attackers compromised Microsoft open-source repositories used by AI developers, injecting password-stealing malware to harvest API tokens. Nobody attacked an AI model; they attacked the tooling developers rely on to build those systems. A developer workstation sits at a trusted intersection of source code, credentials, and deployment pipelines. Standardized AI tooling just means a standardized target.

Guardrails that block defenders don't stop attackers. Anthropic released Claude Fable V, the first public model from the Mythos family, with routing guardrails that kick cybersecurity queries to a less capable system. The practitioners doing legitimate security work are the ones getting blocked. Any LLM can be drifted from its system prompt; the controls that matter are external. The security community cracks its knuckles when it sees a high wall.

The takeaway. The more overbearing the parent, the harder the teenager rebels. Wait until you see what gets built around the guardrails.

Security Headlines: