#0058: Linux Under Siege & The Chaotic Eclipse Zero-Days

Gaming Roundtable

The crew kicks things off with the Gaming Roundtable, checking in to chat about what they've been playing lately, tackling their recent backlogs, and discussing what's currently on their radar.

Matt's BSides Talk

Matt pulls back the curtain on his recent presentation at BSides, breaking down the core security takeaways, the audience reception, and key lessons learned from the conference floor.

Linux Under Siege

We look at the absolute state of the Linux kernel. With a record-breaking 5,784 CVEs published in 2025, the volume has become unmanageable for humans. We break down a brutal two-week window featuring three major Local Privilege Escalation (LPE) vulnerabilities:

Copy Fail (CVE-2026-31431): Disclosed on April 29, 2026, by researchers using an AI system named Xint Code, this flaw hides in the kernel's cryptographic subsystem. It allows a deterministic, 732-byte exploit to corrupt the page cache and grant root access on virtually every major distro since 2017 without relying on race conditions.
Dirty Frag (CVE-2026-43284 / CVE-2026-43500): Dropping just a week later, this exploit chains two separate vulnerabilities in the IPsec ESP and rxrpc components. By abusing fragmented socket buffers, it allows for in-place cryptographic operations that permanently modify the page cache in RAM.
Fragnesia (CVE-2026-46300): A new variant of Dirty Frag that manipulates Linux page cache behavior strictly through the esp/xfrm module.
We discuss the bigger pattern of these exploits acting as "LPE-as-a-second-stage" attacks, which are being weaponized by ransomware variants targeting high-value VMware ESXi hypervisors.

The Chaotic Eclipse Zero-Days

We dive into the wild story of "The Color-Coded Chaos." A disgruntled researcher known as Nightmare-Eclipse (or Chaotic Eclipse) has been systematically releasing Microsoft zero-days.

In April, the researcher dropped BlueHammer, RedSun, and UnDefend—exploits designed to escalate privileges and blind Microsoft Defender. RedSun exploits Defender's cloud tagging to rewrite malicious files in their original locations.
On May 13, one day after Patch Tuesday, they dropped YellowKey—a terrifying BitLocker bypass. By utilizing a specially crafted USB drive and booting into the Windows Recovery Environment (WinRE), attackers with physical access can gain an unrestricted shell.
Released on the same day was GreenPlasma, a privilege escalation flaw targeting CTFMON that can manipulate registry settings to achieve a SYSTEM shell.
With rumors of a "June Surprise" dead man's switch, we discuss why security models built around trusting signed, native components like WinRE and CTFMON are consistently failing.

Watch & Listen

VOD: https://youtu.be/eASoi99sK1Y
Twitch: https://twitch.tv/TheDigitalAscent
YouTube: https://youtube.com/@TheDigitalAscent
Spotify: https://creators.spotify.com/pod/profile/digitalascent/

Hosts & Credits

Hosts: Brent, Matt, Brandon
Technical Design / Production: Brent