Patch Tuesday Came Early — Three Fires to Put Out Before the Weekend

A nine-year-old Linux kernel bug, a router backdoor with no fix in sight, and nine new BIND CVEs walk into a bar — and your infrastructure is the punchline.

CVE-2026-64600: Silent Root Takeover Hiding in Your XFS Filesystem for Nine Years

Red Hat Enterprise Linux and its derivatives are staring down one of the uglier kernel CVEs in recent memory. CVE-2026-64600 is a race condition buried in the XFS filesystem driver that's been sitting in the kernel since 2017 — and Qualys just dragged it into the light using LLM-assisted code auditing. The estimated blast radius: 16.4 million RHEL systems.

What makes this one particularly nasty is what doesn't stop it. SELinux? Bypassed. Containers? Not a barrier. Kernel hardening features like SMEP and SMAP? Insufficient. A local attacker — or any process that achieves code execution at a low privilege level — can escalate silently to root. No log noise, no obvious tripwire.

What you should do right now:

1. Pull the latest kernel update from Red Hat, CentOS Stream, AlmaLinux, or Rocky — patches are out.
2. If you're running immutable infrastructure, rebuild and redeploy your images immediately.
3. If patching is blocked by a change window, consider disabling XFS mounts where feasible as a temporary mitigation (check your workload compatibility first).
4. Audit any externally-reachable RHEL systems as highest priority.

This one earns emergency-patch status. Don't let it sit.

That Router Backdoor Has No Patch — Time to Vote With Your Wallet

The details coming out of How-To Geek's coverage are genuinely bad: a hardcoded backdoor password baked into affected router firmware, and — here's the kicker — the username field isn't validated at all. Whoever holds the password can authenticate as any user they want. Full stop.

The manufacturer hasn't released patched firmware. There's no timeline. There's no workaround short of replacing the hardware.

I've said it before on this blog and I'll say it again: consumer and prosumer routers from brands that treat security as an afterthought are a liability, not an asset. If you're running one of the affected devices (check the How-To Geek article for the model list), the calculus is simple — you're one exposed WAN port away from owning a pivot point inside your own network.

The article specifically calls out the Ubiquiti UniFi Dream 7 as a recommended replacement, and I'll second that without hesitation. I've run UniFi gear in both home lab and small business contexts for years. The UDR7's threat management, automatic firmware updates, and Ubiquiti's track record of actually patching CVEs make it a reasonable upgrade path for most readers here.

If you're already on UniFi, verify your UDM/UDR firmware is current. If you're not — this is the nudge.

BIND 9.20.26 Drops Nine CVEs, Including Remote Code Execution Over DoH

ISC shipped BIND 9.20.26 this week with nine CVEs addressed, and the headliner is a remote code execution vulnerability in the DNS-over-HTTPS handler. If your resolvers or authoritative servers are serving DoH endpoints — and increasingly they are — that's an unauthenticated remote vector. Full stop.

The broader story here is worth paying attention to: ISC has confirmed that LLM-assisted code auditing has driven vulnerability report rates more than 10x above historic levels. That's not a fluke. Security researchers now have AI copilots that can chew through C codebases at a pace no human team can match. The implication is that the cadence of "surprise, here's a critical patch" is going to keep accelerating across every major open-source infrastructure project — BIND, OpenSSL, Unbound, you name it.

Also critical: BIND 9.18 is end-of-life. If you're still running it, you're now accumulating unpatched CVEs with every release cycle and ISC isn't coming back for you.

Action items:

• Upgrade to BIND 9.20.26 immediately if you run any BIND instance.
• If you're on 9.18, this isn't a "plan to migrate" moment — it's a "migrate this sprint" moment.
• Audit whether your DoH endpoints are exposed externally and tighten ACLs if they don't need to be public-facing.

DNS is the nervous system of your network. Treat it accordingly.

Want this in your inbox? Subscribe here · Follow on LinkedIn