DAILY BRIEFING
Linux OVSwrap Flaw, Critical Gitea Vulnerability, and Leaked n8n API Tokens
Today's briefing covers local privilege escalation in the Linux kernel, unauthenticated file reads in Gitea, exposed n8n API tokens, Kali365 device-code phishing, and malicious Open VSX extensions.
5 stories2 min read
Today's security threats span infrastructure vulnerabilities, credential exposures, and supply chain risks. System administrators and DevOps teams face immediate patch requirements for core platforms like Gitea and the Linux kernel to stop unauthorized file access and local root escalation.
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0.
- Why it matters
- Unauthenticated attackers can extract sensitive files or server configuration secrets from self-hosted Gitea instances, potentially chaining to full system takeover.
- What to do
- Upgrade self-hosted Gitea instances to version 1.27.1 immediately.
New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch
A local memory corruption vulnerability in the Linux kernel's Open vSwitch datapath (OVSwrap, CVE-2026-64531, CVSS 7.8) allows unprivileged users to escalate privileges to root. A public exploit is available containing pre-built offsets for approximately 800 kernel builds across standard distributions.
- What to do
- Patch Linux kernel packages containing fixes for CVE-2026-64531 across affected systems.
Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk
The Kali365 phishing kit targets US organizations by leveraging Microsoft's legitimate device code authentication flow. Victims approve attacker-controlled device codes on Microsoft's genuine login portal, granting attackers persistent access tokens to email, cloud resources, and internal documents.
- Why it matters
- By weaponizing legitimate Microsoft device authentication flows, attackers bypass standard MFA prompt defenses to maintain persistent cloud and email access.
Leaked n8n API Tokens Exposed Live Instances to Credential Theft
GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability.
- Why it matters
- Exposed n8n API keys grant access to integrated enterprise data, cloud assets, and third-party API credentials stored within automated workflows.
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
Open VSX removed 77 malicious 'evil twin' extensions uploaded between July 26 and August 1, 2026. The extensions impersonated legitimate developer tools to exfiltrate system details and information about local development environments.
Key takeaways
- Patch Gitea self-hosted instances to version 1.27.1 to fix CVE-2026-59774 and prevent unauthenticated file reads.