Cloudflare’s teams quickly reviewed CVE-2026-31431 (“Copy Fail”), confirmed their behavioral detections flagged the exploit within minutes, and found no signs of in-the-wild abuse. They ran fleet-wide threat hunts, deployed a bpf-lsm mitigation, and rolled out updated kernels without impacting services or customer data.

• Cloudflare's anomaly-based behavioral detection caught the "Copy Fail" exploit pattern within minutes, without a CVE-specific rule ever being written.
• A 48-hour log hunt turned up no evidence of pre-disclosure exploitation in the wild.
• Cloudflare patched its fleet across 330 cities with zero downtime or customer data exposure, using weekly kernel builds and rolling reboots.
• The bug itself let an unprivileged process abuse the AF_ALG crypto interface to corrupt cached files (e.g., /usr/bin/su) for root privilege escalation.

Researchers published a local root exploit for CVE-2026-23111 in nf_tables, letting unprivileged users escape containers and gain host root. The fix was a one-line patch in February; update kernels or disable unprivileged user namespaces if you haven’t.

• A one-character inverted check in nf_tables (CVE-2026-23111) allows unprivileged users to escalate to root, patched upstream in February but publicly exploited by Exodus Intelligence and FuzzingLabs in April/June.
• Most major distros (Ubuntu, Debian, Red Hat) shipped vulnerable kernels with unprivileged user namespaces enabled by default, rated CVSS 7.8.
• Until systems are patched and rebooted, disabling unprivileged user namespaces is the recommended mitigation.
• This flaw is part of a broader wave of recent local-root exploits (Copy Fail, Dirty Frag, Fragnesia, DirtyDecrypt, a nine-year-old ptrace bug), which Synacktiv attributes partly to AI-aided vulnerability discovery.