Kaspersky's Q2 2026 vulnerability landscape report finds a record surge in registered CVEs, driven largely by AI's dual role in both vulnerability discovery and software development flaws. New critical Linux kernel vulnerabilities, dubbed the 'Dirty Frag' family, exploit the page cache mechanism for privilege escalation. Windows saw a wave of unpatched, CVE-less exploit publications for Defender and other subsystems from a researcher known as Nightmare Eclipse. Fake, AI-generated vulnerability write-ups for Exchange and SharePoint also emerged as a new attack vector to waste researchers' time. Sliver, Havoc, AdaptixC2, and Metasploit remain top APT C2 frameworks, with an APT group exploiting a Langflow AI vulnerability marking one of the first cases of AI-technology targeting. Notable AI/LLM tool vulnerabilities are detailed in OpenClaw, Dify, and Open WebUI, alongside a spoofing flaw in Microsoft Exchange.
Table of contents
Statistics on registered vulnerabilitiesExploitation statisticsVulnerability exploitation in APT attacksC2 frameworksLLM/AI tool vulnerabilitiesNotable vulnerabilitiesConclusion and adviceQuestions this post answers
What is the Dirty Frag vulnerability family in the Linux kernel?
Dirty Frag refers to a family of Linux kernel vulnerabilities in the networking subsystem, including CVE-2026-43284 and CVE-2026-43500, affecting IPsec ESP and RxRPC handling. They let a local user overwrite the page cache and escalate privileges to root, and are related to CVE-2026-46300 (Fragnesia), which involves packet fragment handling and the page cache mechanism. Track emerging Linux kernel privilege escalation flaws like this on daily.dev before patching becomes urgent.
What is the OpenClaw gatewayUrl vulnerability CVE-2026-25253?
CVE-2026-25253 is a vulnerability where OpenClaw's user interface trusts an attacker-controlled gatewayUrl URL parameter and automatically opens a WebSocket connection to it, sending an authentication token without user confirmation. If the attacker captures a valid token, they can compromise the user session, modify agent configuration, or access connected tools and resources. Developers securing AI agent integrations can follow disclosures like this on daily.dev.
What Windows Defender vulnerabilities were published without a CVE identifier in 2026?
A researcher known as Nightmare Eclipse published exploits for six unpatched Windows vulnerabilities before any received a CVE identifier, including BlueHammer (a TOCTOU race condition in Defender's signature updates enabling privilege escalation), RedSun (a Defender file-restoration logic flaw), YellowKey (a BitLocker bypass via Windows Recovery Environment), GreenPlasma (CTF loader object injection), RougePlanet (another Defender TOCTOU flaw overwriting wermgr.exe), and UnDefend (a Defender denial-of-service bug). Follow pre-CVE exploit disclosures like these on daily.dev to stay ahead of unpatched risks.