title: "OpenAI Finds 948 Local Privilege Escalation Bugs In The Linux Kernel" url: "https://www.phoronix.com/news/OpenAI-948-Linux-LPE-Bugs" author: "Written by Michael Larabel in AI on 5 November 2026 at 05:00 AM EST. 38 Comments"

OpenAI published a blog post outlining their work on autonomous vulnerability discovery. To showcase their AI potential, they found 948 valid local privilege escalation vulnerabilities within the Linux kernel.

OpenAI's prototype found 2,308 candidate vulnerabilities in the Linux kernel, dynamically reproduced 1,724 vulnerabilities, and ultimately found 948 local privilege escalation exploits for allowing unprivileged local users to gain root access. They also generated candidate patches for maintainer review.

Discovering nearly one thousand local privilege escalation vulnerabilities consumed $1.2 million USD in API credits.

OpenAI researchers noted in their blog post:

"Within the next few years, we believe that if there are vulnerabilities in a given software project, frontier models will likely be able to discover them and even less capable models may be able to develop exploits once disclosed. In a world of no unknown vulnerabilities, it will be critical to build and maintain high assurance software, especially core software such as operating systems, browsers, image parsing libraries, the TCP/IP stack, and more. Investing in training models to write secure code by default, minimizing attack surface by removing unnecessary features, and formal verification are promising areas of future research to effectively scale software security, in addition to finding and fixing existing vulnerabilities."

Another interesting takeaway is that their GPT-5.5 Cyber model is finding more than 5x more novel LPEs than their GPT-5.6 Sol model despite three months of hardening/patches in the Linux kernel between scans.

Those wanting to go through this OpenAI showcase in more detail can do so via their blog post.

I've been trying to get good at fuzzing for a while. I recently started a new fuzzing project and I realized that I could take from past PoCs and put them in a corpus to try and generate bugs of a similar shape. Do you know any good sources of searchable PoCs? I've mostly been going through specific projects' issue trackers looking for PoCs.

I'm not sure what I expected, but this article is quite depressing.

Many industrial devices include a service access so the vendor’s technician can get in without the customer’s password. A classic —and dangerous— way to implement it is the code of the day: a code that changes every day according to a formula that, in theory, only the vendor knows.

The problem shows up when that “secret formula” is the only thing protecting access (security by obscurity) and it can also be recovered from the firmware itself. That is exactly what happens here: sm_app ships unobfuscated, with function and variable names in plain sight. The one that validates the code is called, literally, check_code_of_day.

The article is from October 14th and notes:

Whether the attack went through CVE-2025-41450 is, for now, just a hypothesis: the vector has not been officially established and the investigation is still open. Several reports throughout this year had already warned that something like this could happen, and during 2025 several vulnerabilities were disclosed in Danfoss equipment that ended in a vendor fix. The flaw we look at here is public and patched (at least since R4.3.1).

That makes the most recent attacks all the more alarming, should they have been achieved via the same method.

CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google's Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.

I've recently registered a .eu domain name.

EURid registry has a portal where you can generate a transfer code, thus not fully relying on access to registrar (as well as check and verify your info).

Welp, security.

The only security is a code sent to e-mail associated with the domain. While the portal requires entering this address to log in, it can also be pulled from WHOIS where it is mandatorily published.
Regardless, e-mail (as a string) should not be affecting security.

The code, as I mentioned, is just lowercase letters and numbers. Precisely 6 of them. This is valid for 2 hours and one use.
While there is a "Request new code" button, I wasn't able to generate multiple codes for one 2 hour window, so that's good.

But now we get to rate-limiting. After 9 attempts, I get:

You have exceeded the allowed number of requests.
Please try again in 10 minutes.

Sounds good, BUT, clearing cookies bypasses this.
I have not (yet) tried any automation, I just quickly manually repeated this tomfoolery from same IP 3 times without actually being rate-limited.

I find this... at least strange. Especially since everyone is doing at least 2FA, while some sites even support physical security keys, and then there's "we email you 6 characters".

It's scary month

CVE-2026-109618 CVE-2026-109618

https://x.com/NSACyber/status/2112903220209098897

https://x.com/Sad_HAMs_/status/2112879897572180387

Node.js

>Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines. > >If you run either stack in production, keep an eye on official advisories and apply patches promptly. > >Security maintenance doesn't stop at your application code. Your runtime matters too.

https://x.com/itsMikeKipruto/status/2112846839720341572

Hey ! Running a Snowflake proxy in Brave for a while now. Normally I help around 20 people on a busy day. Today the counter says 226 in the last 24h. Never seen anything close to that.

Is anyone else running a proxy and seeing a jump? Any tips on how to tell a real event from a local fluke?

Cheers