The Ghost in the Kernel

For fifteen years, a silent vulnerability has sat inside the Linux kernel, waiting. Now, researchers at Nebula Security have pulled back the curtain on GhostLock — officially tracked as CVE-2026-43499. The bug is brutal in its simplicity: any logged-in user, no special permissions required, can seize full root control of an unpatched machine. Container escapes? That’s on the menu too.

This isn’t some obscure edge case. The vulnerable code has shipped by default in nearly every mainstream Linux distribution since 2011. No unusual settings needed. No network access required. Just a user account on the box.

How GhostLock Works: A 15-Year Blind Spot

The flaw lives deep in the kernel’s memory management subsystem — specifically, in how it handles certain locking mechanisms during process scheduling. Nebula Security’s team found that a race condition in the kernel’s futex (fast userspace mutex) implementation allows an attacker to corrupt kernel memory. From there, it’s a straight shot to root privileges.

What makes GhostLock particularly nasty is its longevity. The vulnerable code was introduced in kernel version 2.6.39, released in May 2011. Every major distro that has shipped a kernel based on that version or later — which is essentially all of them — carries the bug. We’re talking about Ubuntu, Debian, Fedora, CentOS, RHEL, SUSE, Arch, and virtually every other distribution in active use.

“This is the kind of bug that keeps infrastructure engineers up at night,” said a Nebula Security researcher in a technical write-up shared with select media. “It’s been there for over a decade, silently compiling into every kernel build.”

Root Access and Container Escape in One Package

GhostLock isn’t just a privilege escalation bug. It also enables container escape — a nightmare scenario for cloud-native environments. An attacker who compromises a single container can break out to the host system and gain root control there too. In multi-tenant Kubernetes clusters or shared hosting platforms, that means one compromised workload can potentially spill into every other workload on the same node.

Nebula Security demonstrated a proof-of-concept exploit that achieves both goals: full root on the host and escape from a Docker container. The exploit runs entirely from user space, requires no special capabilities, and completes in under a second on modern hardware.

Who Is Affected?

Short answer: almost everyone running Linux. Here’s a quick breakdown:

• Desktop users: Any Linux desktop installed or updated since 2011 is vulnerable if it hasn’t received the GhostLock patch.
• Server administrators: Every server running a mainstream distro with a kernel from the last 15 years needs patching immediately.
• Cloud and container environments: Kubernetes nodes, Docker hosts, and any container orchestration platform are at risk for container escape attacks.

Nebula Security has not released the full exploit code publicly, but they have shared technical details with kernel maintainers and major distro security teams. Patches are already rolling out.

What You Need to Do Right Now

The fix is straightforward: update your kernel. All major distributions have released or are in the process of releasing patched kernels. Here’s the action plan:

1. Check your kernel version: Run uname -r to see what you’re running. If it’s older than the patched version for your distro, you’re exposed.
2. Apply updates immediately: Use your package manager to install the latest kernel. For Ubuntu/Debian: sudo apt update && sudo apt upgrade. For RHEL/CentOS/Fedora: sudo dnf upgrade.
3. Reboot: Kernel updates require a reboot to take effect. Plan maintenance windows for production systems.
4. For container environments: Update the host kernel, then restart all containers. Container escape protections like user namespaces and seccomp profiles can help but do not fully mitigate GhostLock.

Nebula Security also recommends enabling kernel address space layout randomization (KASLR) and disabling unprivileged user namespaces where possible — though these are mitigations, not fixes. The only real cure is the kernel patch.

For those running long-term support (LTS) kernels, check your distro’s security advisory page. Canonical, Red Hat, and SUSE have all issued advisories for CVE-2026-43499.

The Bigger Picture: 15 Years of Silent Exposure

GhostLock raises uncomfortable questions about kernel security auditing. How many other bugs have been sitting in plain sight for over a decade? The Linux kernel is one of the most audited pieces of software on the planet, yet this one slipped through. It was introduced in a routine commit that touched memory management code — exactly the kind of change that rarely gets the scrutiny it deserves.

“The futex code is notoriously complex,” noted a kernel developer who asked not to be named. “It’s been rewritten multiple times, and each rewrite can introduce subtle new races. Catching something like this requires not just code review but systematic fuzzing and formal verification.”

Nebula Security’s discovery was the result of targeted fuzzing of the futex subsystem — a reminder that even mature, well-tested codebases can harbor critical vulnerabilities. The researchers have published a detailed technical analysis of the GhostLock vulnerability for those who want to dig into the kernel internals.

For now, the message is simple: patch your kernels. GhostLock has been hiding in plain sight for 15 years. Don’t let it stay there any longer.

They called it WriteOut. And it could have blown open every tenant on the Writer AI platform.

Cybersecurity researchers at Sand Security have revealed the details of a critical vulnerability in Writer, an enterprise generative AI platform. The flaw, now patched, allowed a one-click attack that could leak session tokens across tenants — effectively letting an outsider hijack any agent preview without ever logging in.

The bug is being tracked as WriteOut. And it’s a textbook case of what happens when session isolation isn’t bulletproof.

What exactly was the Writer AI flaw?

The vulnerability lived inside Writer’s agent preview feature — the sandbox where users test and iterate on AI agents before deploying them. Under the hood, each tenant is supposed to be walled off from every other tenant. That’s basic multi-tenant security: your data, your sessions, your agents — all isolated.

WriteOut broke that wall.

Sand Security found that a malicious actor could craft a specially designed link. Click it, and the victim’s browser would execute a cross-tenant request that leaked their session token. From there, the attacker could impersonate the victim inside Writer, accessing their agents, their prompts, their history — everything.

No credentials needed. No brute force. Just one click.

Cross-tenant compromise: the real danger

Cross-tenant vulnerabilities are the nightmare scenario for any SaaS platform. They mean that a breach at Company A can spill directly into Company B’s data — without either company doing anything wrong.

In Writer’s case, the agent preview feature was the entry point. The platform uses session tokens to keep users authenticated as they move between features. But the token validation logic didn’t properly enforce tenant boundaries during preview requests. A request from Tenant A could include a token from Tenant B, and the server would accept it.

That’s the kind of bug that keeps CISOs up at night.

Sand Security’s team demonstrated the attack with a proof-of-concept they called WriteOut. It required no authentication from the attacker. Just a link, a victim, and a click.

How Writer fixed the session isolation vulnerability

Writer patched the flaw after Sand Security disclosed it responsibly. The fix involved tightening session token validation to ensure that tokens are scoped to their originating tenant. Now, a token from Tenant A simply won’t work when presented to Tenant B’s resources.

The company also added additional checks on the server side to verify tenant identity on every request involving agent previews. It’s the kind of layered defense that should have been there from the start — but at least it’s there now.

Writer has not disclosed whether the vulnerability was ever exploited in the wild. But given the nature of the bug — a cross-tenant session leak — the potential blast radius was enormous. If an attacker had discovered WriteOut before Sand Security did, they could have silently harvested tokens from any Writer user who clicked a malicious link.

That’s the quiet danger of session isolation flaws: no alarms, no unusual login activity. Just a stolen token and a ghost in the machine.

What this means for enterprise AI security

Writer is far from alone. Enterprise AI platforms are being built at breakneck speed, and security often takes a backseat to shipping features. Agent previews, custom model tuning, and collaborative workspaces all introduce new surfaces for cross-tenant attacks.

The WriteOut vulnerability is a reminder that session isolation isn’t a checkbox — it’s a continuous engineering discipline. Every new feature that touches authentication needs to be audited, not just for its intended behavior, but for what happens when someone sends unexpected data across tenant boundaries.

For enterprises using AI platforms, the lesson is clear: don’t assume your data is walled off just because the marketing materials say so. Ask your vendors about their session isolation architecture. Ask about their bug bounty program. And if they can’t give you a straight answer, that’s an answer in itself.

Key takeaways

• One-click exploitation: WriteOut required only a single click from a victim to leak their session token.
• Cross-tenant scope: The flaw broke tenant isolation, meaning data from one organization could be accessed by an attacker posing as a user from another.
• No authentication needed: The attacker didn’t need valid credentials — just a crafted link and a victim.
• Patched responsibly: Sand Security disclosed the bug to Writer, which fixed it before public disclosure.

For more on securing generative AI workflows, check out our guide on AI platform security best practices and how to audit session token handling in multi-tenant SaaS apps.

Writer has since confirmed the patch is complete and no customer data was compromised. But WriteOut will go down as a near-miss — one that could have exposed every agent, every prompt, and every session on the platform.

How a Single Public Issue Can Expose Your Private Repos

A newly uncovered vulnerability, dubbed GitLost, exposes a dangerous gap in GitHub‘s agentic workflow system. The flaw allows an unauthenticated attacker to craft a seemingly harmless GitHub Issue in a public repository — and then silently siphon data from that organization’s private repositories.

It’s a classic supply-chain twist: the attacker never needs credentials. They don’t need to compromise a developer’s machine. All they need is a public repo where issues are open, and a victim organization that uses GitHub Actions or other automated workflows that respond to issue events.

The vulnerability was disclosed by researchers at Protect AI, who gave it the name GitLost. The name is fitting — it describes data that should be private but gets “lost” to an outsider through a side channel.

Why Agentic Workflows Are the Weak Link

GitHub’s agentic workflows — automated pipelines that can read, write, and act on repository events — are powerful. They let teams build bots that triage issues, run tests, or deploy code. But that power comes with a blind spot.

Here’s the core problem: when a workflow triggers on an issue_comment or issues event, it often runs with permissions that extend beyond the public repo. A typical action might clone the repo, check environment variables, or even access other repositories in the same organization. If the workflow’s code doesn’t strictly sanitize input from the issue, an attacker can inject commands that exfiltrate that data.

The Attack Chain, Step by Step

1. Identify a target — Find a GitHub organization with a public repository that has issues enabled and uses a workflow that responds to issue events.
2. Craft a malicious issue — The attacker opens an issue containing specially crafted content, such as a payload in the issue title, body, or a comment.
3. Trigger the workflow — The organization’s GitHub Action runs automatically (e.g., on issue_comment), pulling the issue data into its execution context.
4. Data exfiltration — The payload executes within the workflow, reading secrets, environment variables, or files from private repos, then sending them to an attacker-controlled server.

Protect AI’s researchers demonstrated the attack using a custom GitHub App that mimicked a real-world workflow. They were able to extract private repository contents, access tokens, and even organization-level secrets — all from a single public issue.

Who Is at Risk? Nearly Anyone Using GitHub Actions

The GitLost vulnerability doesn’t require exotic configurations. Any organization that runs GitHub Actions on issue events — including popular actions like stale, labeler, or custom bots — could be exposed. GitHub Actions security is often overlooked because teams assume the trigger event is low-risk.

But the risk is real. An attacker could:

• Steal proprietary source code from private repos
• Extract API keys, database credentials, or cloud service tokens
• Pivot to compromise other systems using leaked credentials
• Plant backdoors in CI/CD pipelines

The attack is especially dangerous for open-source projects that have both public and private repositories under the same organization. A popular library with a public issue tracker could become the entry point to the company’s internal infrastructure.

What GitHub Has Done — and What You Should Do

GitHub has acknowledged the vulnerability and released a security advisory. The company recommends that organizations review their workflow permissions and apply the principle of least privilege. Specifically:

• Use pull_request events instead of issue_comment where possible, since PRs come from forked repos with limited trust
• Set permissions: read-only on workflows that don’t need write access
• Avoid using ${{ github.event.issue.body }} or other user-supplied data directly in shell commands
• Pin action versions to specific commit SHAs, not version tags
• Use OpenID Connect (OIDC) for cloud authentication instead of long-lived secrets

Protect AI also released a free checker tool that scans your GitHub organization for workflows vulnerable to GitLost. The tool checks for common misconfigurations and flags risky patterns.

The Bigger Picture: Agentic Security Is Still Immature

The GitLost flaw is not an isolated incident. It’s part of a broader trend where AI-powered agentic workflows — systems that autonomously act on events — introduce new attack surfaces. Traditional security models assume a human in the loop, but agents act quickly, silently, and with broad permissions.

Security researchers have warned for years that GitHub Actions, like any CI/CD system, is only as secure as its least-trusted input. The GitLost vulnerability is a concrete demonstration of that principle. It shows that even a seemingly innocuous feature — opening an issue — can be weaponized.

For now, the best defense is skepticism. Treat every external input as untrusted, especially in automated workflows. Audit your actions. And remember: just because a repo is public doesn’t mean its workflows should trust anyone.