Information regarding several vulnerabilities in the Linux kernel has been disclosed before the release of official patches. These reports were published as part of the Zero Day Initiative by Trend Micro, possibly due to an error.
Two of the identified vulnerabilities received a CVSS score of 9.0. One affects the SMB Direct function, while the other concerns the Linux kernel file server implementation. Both could potentially allow remote code execution.
Additional reports detail vulnerabilities that enable local privilege escalation via network code, as well as issues affecting the VMware graphics driver. Patches are currently being tested or prepared for future integration.
Greg Kroah-Hartman, a Linux kernel maintainer, expressed concern regarding the premature public disclosure of these vulnerabilities. It remains unclear if the information was released unintentionally.
Separately, private keys for eight intermediate TLS/SSL certificates from the Indian authority eMudhra were compromised. Furthermore, PHP developers released emergency fixes for CVE-2026-109618 and CVE-2026-109619, which both held a CVSS score of 9.2.
