Microsoft reports 59 Linux kernel bugs and 33 CVEs

Microsoft’s threat briefing this week flags 59 Linux kernel bugs, uncovered by MDASH scans of kernel subsystems between late May and mid‑June 2026, which formed the basis for 59 upstream reports and 33 CVEs. One notable entry is CVE-2026-64563, described as a one-line state-reset bug in rhashtable that enabled a stable local privilege escalation on Linux and affected Android with SELinux enforcing, without requiring special kernel configurations or user namespaces.

Microsoft notes that eight of the CVEs include working root privilege-escalation exploits. The tally is presented as confirmed upstream reports tied to those CVEs, with details attributed to Microsoft’s security team.

The ThreatsDay round‑up also highlights a surge in GSocket detections—356.2% growth across March–August 2026—where threat actors deployed the open‑source GSocket RAT on internet‑facing Linux servers to maintain persistence after patching, with attackers leveraging shared public networks to obscure origin.

Unit 42 reports Falcon browser spyware, a JavaScript C2 framework used to compromise government and webmail portals, operate entirely in the browser, sideload Chrome extensions, and exfiltrate passwords, cookies, and emails, with the Antino implant using OneDrive as a C2 channel. Europol announces the seizure of 235 servers and 257 domains tied to GootLoader, CastleRAT and StealC infrastructure, including over 6 million victim credentials as part of a broader criminal network disruption.

The piece credits Microsoft, Unit 42, and Europol for the specific findings and actions, and it notes other major threads, such as North Korea’s crypto‑laundering activity around Binance and related brand of AI‑assisted or AI‑driven intrusions.

The bulletin also references several other notable items, including BluePhishing‑style OAuth consent abuse, AI‑assisted espionage in Central Asia, Citrus ransomware activity via contractor access, and various software supply‑chain and credential‑theft campaigns, with claims attributed to researchers, vendors, or agencies.

The piece closes by underscoring that attackers increasingly blend trusted accounts, AI tools, and legacy mistakes to normalise malicious activity, while defenders are gradually improving but not yet eliminating all threats.