AI Software Cloning, Linux Copy Fail, and the BlackCat Case
· 24:08 · Watch on YouTube ↗
Summary
The hosts discuss AI-generated clean-room software clones and their licensing and security risks, Linux’s CVE-2026-31431 local root flaw, and the sentencing of two former ransomware negotiators tied to BlackCat attacks.
Key points
- The segment describes an AI clean-room approach that analyzes open-source software into specifications and uses a separate AI to recreate it, raising questions about license circumvention.
- The hosts warn that recreated software may lose maintenance history, support, and security context; they note that flaws in rewritten cryptographic implementations could expose key material.
- CVE-2026-31431, called Copy Fail, is described as allowing an unprivileged local Linux user to gain root by overwriting four controlled bytes in a readable file’s page cache; the exploit is described as a 732-byte Python program.
- The flaw is linked to a 2017 AF_ALG/AEAD in-place optimization. The discussed fix reverts that optimization, and the segment says major Linux distributions have been affected since 2017.
- The exploit requires local access, but the hosts discuss chaining it after other access and using its shared-page-cache behavior to escape containers.
- The segment reports that Ryan Goldberg and Kevin Martin were each sentenced to four years after pleading guilty to conspiracy to extort; Angelo Martino was awaiting sentencing.
- The segment says the three former ransomware negotiators worked with BlackCat, keeping 80% of ransom proceeds while paying 20% to its administrators; it also reports one victim paid $1.2 million.
Article Details
MITRE ATT&CK
CVE
Threat Actors
Angelo MartinoThe segment reports that Martino was one of three former ransomware negotiators who orchestrated BlackCat attacks and pleaded guilty; it says he was awaiting sentencing.BlackCatThe segment identifies BlackCat as a ransomware gang whose administrators reportedly received 20% of ransom proceeds from the three former negotiators; it says the group targeted 1,000 organizations between November 2021 and December 2023.Kevin MartinThe segment reports that Martin was one of three former ransomware negotiators who orchestrated BlackCat attacks; it says he pleaded guilty to conspiracy to extort and was sentenced to four years.Ryan GoldbergThe segment reports that Goldberg was one of three former ransomware negotiators who orchestrated BlackCat attacks; it says he pleaded guilty to conspiracy to extort and was sentenced to four years.