Three names on the KEV list, and why the kernel one is the one to chase
Two big enforcement stories broke on the same day, and both are worth reading, but neither is the thing that should change what you do this week. Help Net Security reported that the DOJ and FBI seized the infrastructure behind QScan and QTRouter, a pair of tools a Nanjing-linked outfit called QTFY used to build an obfuscation network out of hijacked IoT devices — the kind of story where NASA, the Federal Reserve and the U.S. Senate turn up on the victim list. Separately, Australian police, working with the FBI, arrested two men alleged to be part of TeamPCP, the crew that cloned the Shai-Hulud worm and poisoned open-source packages to harvest credentials at scale.
Both are satisfying. Neither gives you a Monday task. The one that does is quieter.
The actual work item
On the same day, CISA added three CVEs to its Known Exploited Vulnerabilities catalog, all with evidence of active exploitation:
- CVE-2023-49105 — ownCloud improper authentication
- CVE-2026-53362 — Linux kernel, described only as "Unspecified Vulnerability"
- CVE-2026-66384 — JFrog Artifactory path traversal
The KEV label is the important part. These aren't theoretical scores; something added them because attackers are already using them. For a mail-server operator the kernel entry is the one that touches every box you run — your Postfix relays, your Dovecot backends, your iRedMail all-in-one, the LDAP node, the lot. It doesn't matter what the box does; it runs a kernel.
Be honest about what CISA didn't tell you
"Linux Kernel Unspecified Vulnerability" is genuinely unhelpful on its own. The advisory gives no subsystem, no affected version range, and no fix command — and I'm not going to invent one, because a wrong kernel instruction is somebody's outage. What CISA is telling you is that it's exploited, not how to fix it. You have to go to the CVE record and, more usefully, to your distribution's security tracker to find out which package version carries the fix for the kernel series you're actually running.
So the reasoning, in prose: confirm which kernel each host is booted on before you touch anything, check your vendor's advisory for that series, and remember that installing a patched kernel package does nothing until the machine reboots onto it. On a mail server that's a scheduled-maintenance conversation, not a lunchtime apt run — a queue that flushes cleanly and a Dovecot process that comes back are worth ten minutes of planning.
The directive quietly changed too
The advisory references BOD 26-04, which is a shift worth noting even if you're not a federal agency. Instead of "patch everything on the KEV list by date X," it tells agencies to prioritise publicly exposed assets where exploitation grants total control, and to check whether a box was already compromised before the patch went on. That's the right instinct to borrow. Your internet-facing SMTP and IMAP hosts jump the queue; an internal Artifactory or an ownCloud instance behind a VPN can wait a beat — but "wait a beat" is not "ignore," and ownCloud sitting next to a mail stack is exactly the kind of internet-facing file service attackers love.
Where the three stories actually connect
The TeamPCP arrests are the reminder underneath all of this: the supply chain is a live attack surface. If you pull npm or PyPI packages to build Roundcube plugins, webmail themes, or automation around your mail stack, that credential-harvesting worm is your problem more than QTFY's IoT botnet ever was. The arrests don't close that door — investigators explicitly haven't ruled out more people. Pin your dependencies, and don't let a build server hold long-lived tokens it doesn't need.
Sources
Runs enterprise networks and security for a living, and writes Shore Up to turn two decades of hands-on Linux, Windows and mail-server work into guides you can actually use.
More about the author →Was this article helpful?
Tap a star — no sign-in needed.
Be the first to rate this article.
Related guides
wp2shell Is Already in the KEV List — Patching Won't Un-Own You
CISA put two WordPress core flaws into its Known Exploited Vulnerabilities catalogue on 21 July, alongside a DD-WRT overflow and a Langflow bug. The pair that matters here — CVE-2026-63030 and CVE-2026-60137, chained under the name wp2shell — gives an anonymous attacker remote code execution against a stock WordPress install with a single HTTP request. No login, no plugin, no theme required. By the reporting in The Hacker News, exploitation was underway within hours of the public proof-of-concept, and watchTowr's honeypots logged tens of thousands of attempts.
The OpenSSL Memory Leak With No CVE to Patch Against
Okta's Red Team gave this one a name, HollowByte, and named things get attention. What deserves the attention here isn't the trick — it's the paperwork, or rather the lack of it.
The July kernel respin: reboot, and mind your out-of-tree modules
Canonical shipped a batch of Linux kernel security fixes this month, and LWN flagged three stable kernel updates landing upstream in the same window. None of this is dramatic. It is the ordinary heartbeat of running Linux under a mail stack — but "ordinary" still means a reboot, and there are two details worth reading before you schedule one.
When the Patch Wasn't the Patch: N-central's Auth Bypass Redux
If you run N-able N-central yourself, or an MSP runs it on your behalf, stop and read this one properly. CISA put CVE-2026-18577 into the Known Exploited Vulnerabilities catalog on 3 August, then followed up the next day by adding CVE-2026-18556 alongside two unrelated bugs. Two CISA advisories, one day apart, both pointing at the same product. That ordering is the whole story.