Linux Copy-Fail, GitHub RCE Flaw, and PyTorch Lightning Supply-Chain Attack
· 9:01 · Watch on YouTube ↗
Summary
Threat Wire covers Linux copy-fail, a local kernel flaw that can enable root access and container escape; a GitHub Git-infrastructure injection flaw fixed before any reported exploitation; and Team PCP’s compromise of PyTorch Lightning packages with credential-stealing`
Key points
- Copy-fail (CVE-2026-31431) affects Linux kernel builds dating from 2017 until the reported patch window; an unprivileged local account can exploit it without network access.
- The flaw involves improper handling of scatter-gather lists in the kernel’s AEAD crypto implementation. Chained with AF_ALG sockets and splice, it can overwrite four bytes in a readable file’s page cache, potentially enabling root access or container escape.
- The researchers committed Linux kernel patches to main on April 1, 2026. The report prioritizes multi-tenant Linux hosts for patching over single-user laptops and workstations.
- Wiz Research reported a Git-infrastructure injection flaw in GitHub (CVE-2026-2854) that could lead to remote code execution. GitHub deployed a fix on the day it was reported, and the video says no exploitation was found.
- Team PCP compromised the PyTorch Lightning project account and uploaded malicious package versions containing credential-stealing software. Socket identified the packages; developers later regained control and pushed fixes.
- The video also reports that ClickUp’s public website exposed an API key, resulting in enterprise email addresses being exposed for more than a year.
Article Details
- Topics
- [00:22] Linux copy-fail kernel vulnerability, local privilege escalation, container escape, and patch priorities
- [03:08] Wiz Research’s GitHub Git-infrastructure injection finding and remediation
- [05:06] Team PCP’s compromise of PyTorch Lightning packages and credential-stealing software
- [06:37] Socket’s acquisition of Secure Annex
- [07:01] Google’s changes to bug bounty payouts in response to AI-assisted vulnerability finding
- [07:32] ClickUp API key exposure and enterprise email data leak
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationCopy-fail is described as allowing an unprivileged local user to exploit a kernel flaw to achieve root access.T1195.002 · Compromise Software Supply ChainTeam PCP reportedly compromised the PyTorch Lightning project account and introduced malicious package versions containing credential-stealing software.