Got Linux appliances online? Attackers turned web shells into root on 25 of them and reached a US government network. The bug: CVE-2026-46300 in the Linux kernel (Fragnesia), now on CISA's exploited list.
Check /etc/pam.d/su before rebooting, then patch.