---
analysis: This hunt pivots from software inventory to three distinct telemetry surfaces
  (HTTP, Network, Syslog), using stack-counting to identify rare behavioral anomalies
  that a single rule on a CVE finding or a generic kernel panic would miss.
blind_spots:
- id: no-kernel-log-visibility
  owner: Infrastructure Team
  question: Can we see rhashtable errors on all Linux hosts?
  remediation: Enable kernel logging and rsyslog forwarding for all production Kubernetes
    nodes.
  requires: hb_syslog with kernel facility
  risk: A host that does not forward kernel logs will show silence even if exploited,
    leading to a false negative.
  stage: privilege-escalation-linux-kernel-exploit
- id: tls-termination-blindness
  owner: WAF Team
  question: Does the reverse proxy log 5xx errors from the backend Node.js app?
  remediation: Ensure back-end server status codes are preserved in the proxy access
    logs.
  requires: hb_http_activity with status codes
  risk: If the proxy handles errors or masks them, we lose the primary signal of heap-use-after-free
    exploitation.
  stage: initial-access-exploit-public-application
coverage:
- stage: initial-access-exploit-public-application
  status: covered
  steps:
  - vulnerable-software-scoping
  - scanner-confirmed-vulnerabilities
  - nodejs-http-instability
  - libcurl-network-anomalies
- stage: privilege-escalation-linux-kernel-exploit
  status: covered
  steps:
  - vulnerable-software-scoping
  - scanner-confirmed-vulnerabilities
  - kernel-log-anomalies
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Exploitation of core runtimes like Node.js and kernel-level vulnerabilities
    represents a high-impact risk for initial access and privilege escalation; a negative
    result over the estate confirms security baseline integrity.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker is exploiting vulnerabilities in Node.js HTTP/2 (CVE-2026-56848)
  or the Linux kernel rhashtable (CVE-2026-64563) to gain initial access or elevate
  privileges, as evidenced by service instability or specific kernel errors.
labels:
- hunt
- attack.t1190
- attack.t1068
- initial access
- privilege escalation
name: Exploitation of Core Services and Kernel Vulnerabilities
parameters:
  cve_ids:
    default:
    - CVE-2026-56848
    - CVE-2026-64563
    - CVE-2026-9545
    - CVE-2026-13608
    description: CVE identifiers associated with the research.
    from:
      kind: article
      observed: '2026-10-07'
      ref: msrc-blog-2026-10-07
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine for behavioral logs.
    type: number
  scope_hosts:
    default: []
    description: List of hostnames to focus the hunt on, typically populated from
      the scoping result.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on internet-facing Linux servers and application clusters where Node.js
  is the primary runtime. Developer workstations running llama.cpp or heavy curl automation
  should also be included in the scope.
references:
- name: 'Microsoft Security Blog: 3 lessons from frontier AI vulnerability research'
  url: https://www.microsoft.com/en-us/security/blog/2026/10/07/3-lessons-from-frontier-ai-vulnerability-research/
related:
- hunt: container-escape-via-kernel-vulnerability
  reason: While this hunt looks for kernel rhashtable errors, a dedicated escape hunt
    would focus on process activity crossing namespace boundaries.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Exploitation of Public-Facing Application
    observables:
    - CVE-2026-56848 (Node.js heap-use-after-free via HTTP/2)
    - CVE-2026-9545 (curl SSL session reuse with impostor host)
    - CVE-2026-13608 (curl)
    - Node.js versions 22.x, 24.x, and 26.x
    - curl
    - llama.cpp
    - vLLM
    - HTTP/2 traffic triggering nghttp2_session_mem_send re-entrancy
    slug: initial-access-exploit-public-application
    tactic: initial-access
    techniques:
    - T1190
  - name: Linux Kernel Privilege Escalation
    observables:
    - CVE-2026-64563 (Linux kernel rhashtable stale pointer dereference)
    - rhashtable_walk_start_check restart path
    - rhashtable_walk_next stale pointer dereference
    - Linux kernel panic or rhashtable error messages
    slug: privilege-escalation-linux-kernel-exploit
    tactic: privilege-escalation
    techniques:
    - T1068
  summary: Microsoft's FORGE Lab identified and helped remediate multiple critical
    vulnerabilities in the Linux kernel and open-source runtimes like Node.js and
    curl using AI-driven agentic discovery. These flaws, including a heap-use-after-free
    in Node.js (CVE-2026-56848) and a stale pointer dereference in the Linux kernel
    (CVE-2026-64563), allow for initial access via web exploitation and subsequent
    local privilege escalation.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Exploitation of Core Services and Kernel Vulnerabilities

This hunt targets critical vulnerabilities discovered by Microsoft FORGE Lab affecting core application runtimes and the Linux kernel. The flow identifies hosts running vulnerable versions of Node.js (specifically major versions 22, 24, and 26) and curl, then corroborates this inventory against known vulnerability findings, server-side HTTP instability, client-side network anomalies from libcurl, and specific kernel log patterns indicative of exploitation. An agent weighs these independent signals to identify confirmed compromises.

## vulnerable-software-scoping
<!-- Scoping vulnerable Node.js and curl versions -->
Identify hosts running Node.js versions 22.x, 24.x, or 26.x and libcurl to narrow the behavioral search.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts running vulnerable versions of Node.js or curl. Silence
  means no such software is inventoried.
reads:
- device_hostname
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT DISTINCT device_hostname, package_name, package_version FROM hb_software_inventory WHERE ( (LOWER(package_name) IN ('node', 'nodejs') AND (package_version LIKE '22.%' OR package_version LIKE '24.%' OR package_version LIKE '26.%')) OR (LOWER(package_name) IN ('curl', 'libcurl', 'llama.cpp')) )
```

## fan-out-corroboration
<!-- Corroborate with findings and behavior -->
parallel:
- → scanner-confirmed-vulnerabilities
- → nodejs-http-instability
- → libcurl-network-anomalies
- → kernel-log-anomalies
join: → triage-evidence

## scanner-confirmed-vulnerabilities
<!-- Existing vulnerability findings -->
Prioritize hosts where scanners have already flagged the specific CVEs named in the research.

```sqlite target=endpoint role=enrichment params=(cve_ids=cve_ids)
~~~yaml
expected: Confirmed findings for the target CVEs. This provides a high-confidence
  starting point for the behavioral triage.
reads:
- device_uid
- resource_uid
- cve_uid
- severity
- first_seen
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_uid, resource_uid, cve_uid, severity, first_seen FROM hb_vulnerability_finding WHERE instr(',' || '{{cve_ids}}' || ',', ',' || cve_uid || ',') > 0 AND status != 'suppressed'
```

## nodejs-http-instability
<!-- Node.js server-side errors -->
Identify potential heap-use-after-free exploitation in Node.js causing application-level crashes (5xx errors).

```sqlite target=web role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Spikes in 500 errors on systems identified as running vulnerable Node.js
  versions.
prevalence:
  by: device_hostname
  key:
  - url_path
  - status_code
  rare_below: 3
reads:
- device_hostname
- url_path
- status_code
- user_agent
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, url_path, status_code, user_agent, COUNT(*) AS error_count FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_code >= 500 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code, user_agent
```

## libcurl-network-anomalies
<!-- Libcurl outbound anomalies -->
Monitor for libcurl processes communicating with rare external hosts, potentially indicating session reuse exploitation.

```sqlite target=network role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: Outbound connections from curl-related processes to rare destination IPs
  not seen elsewhere in the fleet.
prevalence:
  by: device_hostname
  key:
  - dst_endpoint_ip
  rare_below: 2
reads:
- device_hostname
- process_name
- dst_endpoint_ip
- dst_endpoint_port
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, COUNT(*) AS connection_count FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%curl%' OR LOWER(process_name) LIKE '%llama.cpp%') AND direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port
```

## kernel-log-anomalies
<!-- Kernel rhashtable errors -->
Find specific kernel error strings related to the rhashtable stale pointer dereference (CVE-2026-64563).

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Syslog entries capturing kernel crashes or errors mentioning rhashtable
  functions. Absence means no such errors were logged.
reads:
- device_hostname
- syslog_tag
- message
- time
silence: not_evidence_of_absence
source: hb_syslog
verified: dry-run
verified_at: '2026-10-08'
~~~
SELECT device_hostname, syslog_tag, message, time FROM hb_syslog WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(message) LIKE '%rhashtable_walk_next%' OR LOWER(message) LIKE '%stale pointer%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-evidence
<!-- Correlate exploitation signals -->
```agent target=hunter
cite: required
context:
- vulnerable-software-scoping
- scanner-confirmed-vulnerabilities
- nodejs-http-instability
- libcurl-network-anomalies
- kernel-log-anomalies
max_iterations: 6
objective: Determine if any host shows evidence of active exploitation of the Node.js
  or Linux kernel vulnerabilities based on the correlated evidence.
success_criteria: A per-host verdict of malicious, suspicious, or benign citing specific
  log rows and software versions.
tools:
- endpoint
- network
- web
```

## routing-decision
<!-- Route on triage verdict -->
if~: "The triage-evidence verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → contain-and-isolate
indeterminate: → analyst-manual-review
unavailable: → analyst-manual-review (blind_spot: no-kernel-log-visibility)
else: → close-out-benign

## contain-and-isolate
<!-- Isolate host and revoke credentials -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the identified host from the network and revoke any application-level API tokens used by the vulnerable service.
```
→ analyst-manual-review

## analyst-manual-review
<!-- Analyst manual review -->
```manual target=analyst
Review the hb_syslog and hb_http_activity rows; for Node.js findings, check for repetitive patterns in the url_path that might indicate an exploit payload.
```
→ close-out-benign

## close-out-benign
<!-- Close out hunt -->
```manual target=analyst
Document any identified vulnerable systems that were not compromised and ensure they are prioritized for patching Node.js and the Linux kernel.
```
→ end