Weekly Cybersecurity Summary — 14 August to 20 August 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help organisations understand what they mean, who may be affected, and what sensible steps to take. This week’s issues are all at the operating system and web server infrastructure level rather than in website software itself, with a particular concentration of Linux kernel local privilege escalation bugs affecting shared and virtualised hosting platforms.

Apache Portable Runtime Utility (apr-util) is a supporting library used by Apache httpd and many PHP builds. Two heap buffer overflow flaws were found in its caching-backend client code: one in the Redis client (CVE-2026-34501) and one in the memcached client (CVE-2026-34502). Both were disclosed by the Apache Software Foundation alongside the release of apr-util 1.6.4 around 12-13 August 2026, and reshipped by Debian in DSA-6437-1 on 13 August. The root cause is a buffer overflow triggered when the library parses a response from a Redis or memcached backend it is connected to, meaning a malicious or compromised caching backend could corrupt server memory.

On shared hosting, this only matters where apr-util’s Redis or memcached client is configured against a backend outside your direct control, which is uncommon in standard shared-hosting set-ups. On VPS or dedicated servers where you run your own Redis or memcached instance, make sure that instance is not reachable by untrusted parties, and update apr-util regardless.

Update apr-util to 1.6.4 or later via your distribution’s package manager; Debian 13 users should apply DSA-6437-1, and Debian 12/AlmaLinux/Ubuntu users should check for an equivalent backported update.

BadGarbage is a use-after-free race condition in the Linux kernel’s AF_UNIX socket garbage collector, triggered by a race between an MSG_PEEK read and the garbage collector itself. The CVE was published by NVD on 4 July 2026 with a CVSS score added by the kernel.org CNA on 18 July, but it only became an urgent operational concern once a working public proof-of-concept was released on 10 August 2026. CloudLinux published its own advisory confirming impact on the AlmaLinux 10 kernel line on 17 August.

Exploiting the race lets an unprivileged local user escalate straight to root, and in CloudLinux’s own lab testing, escape a default Docker container to host root in under 30 seconds.

On shared hosting running AlmaLinux 10 or CloudLinux 10, this is a route to full host compromise from any local account, including from inside a container, which is a serious concern for multi-tenant infrastructure. VPS customers on the same kernel line with shell access granted to other users should treat this as high priority too.

Apply the AlmaLinux 10 kernel update (or your CloudLinux equivalent) as soon as possible.

RtabRace is a race condition in the Linux kernel’s traffic-control (TC) subsystem, specifically in the code that manages rate-table objects, reachable through the unlocked “flower” and “police” filter path. A public proof-of-concept was published by researcher A. Ramos on 12 August 2026, reliably escalating to root on a stock Ubuntu 22.04 system. CloudLinux published its own advisory and a sysctl-based mitigation on 18 August.

An unprivileged local user who can open a Linux user namespace can trigger a double-free that corrupts kernel memory badly enough to crash the host outright on CloudLinux, or be chained to full root elsewhere.

This is squarely a shared-hosting risk: any local account on an exposed CloudLinux 8 or CloudLinux 7 Hybrid server, or any AlmaLinux server once a fix reveals the same exposure, can crash or potentially escalate on the host.

On CloudLinux 8/CloudLinux 7 Hybrid, apply CloudLinux’s sysctl mitigation immediately. Keep an eye on AlmaLinux/RHEL advisories for a permanent kernel fix.

VsockDrop is a data-only exploit in the Linux kernel’s virtio-vsock zero-copy send path, combined with io_uring registered buffers. When a large zero-copy send fragments across multiple socket buffers, only the final buffer receives a completion-tracking object; earlier buffers hold pinned memory pages with no such record, so the kernel eventually drops a page reference it never held. The freed page can then be reused by the kernel as page cache for a setuid-root binary such as /usr/bin/su, letting a local attacker rewrite it and gain root, without any memory corruption or information leak. The CVE was published on 13 July 2026 with an upstream fix already merged in May, but a working public proof-of-concept only surfaced in mid-August: CISA logged public-exploit availability on 17 August, TuxCare independently reproduced a working root exploit on Ubuntu 24.04 and AlmaLinux 10.2 on 18 August, and CloudLinux confirmed on 19 August that stock CloudLinux/AlmaLinux configurations are not affected.

AlmaLinux and CloudLinux shared hosting is protected out of the box unless io_uring has deliberately been re-enabled. Ubuntu-based VPS or dedicated servers on the 22.04 HWE or 24.04 kernel line are exposed today with no confirmed vendor fix.

Check `sysctl kernel.io_uring_disabled` on AlmaLinux/RHEL 9/10 (should read 2). On Ubuntu, check your kernel version and watch for a Canonical update or a KernelCare live-patch.

If you have questions about any of the issues covered in this summary, or need help checking your hosting environment, you can raise a support ticket via the Customer Area at heartinternet.uk, or chat with our live support team Monday to Friday, 09:30–16:00. You can also browse our knowledge base at heartinternet.uk/support for step-by-step guides.

We’re here to help keep your website secure.