If your Kent business runs Linux servers—whether for file sharing, web hosting, virtualisation, or cloud infrastructure—you need to act this week. Security researchers have disclosed two critical Linux kernel vulnerabilities in early July 2026 that have existed undetected for over 15 years, and both allow attackers with basic local access to gain complete control of your systems.
The first,
dubbed ‘Januscape’ and tracked as CVE-2026-53359, sits in the shadow MMU code that KVM shares across both Intel and AMD
processors.
The flaw went unnoticed for roughly 16 years
, and it’s particularly dangerous for businesses running virtual machines. The second vulnerability,
GhostLock (CVE-2026-43499), is a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched
.
For UK SMEs in Kent and the South East, this matters because Linux underpins a vast amount of business infrastructure—from web servers and file storage to containerised applications and cloud platforms. If you’re running unpatched systems, attackers who gain even limited access can escalate to full administrative control.
What Makes Januscape (CVE-2026-53359) So Dangerous
A use-after-free bug in Linux’s KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it
. In practical terms, this means an attacker who compromises a single virtual machine on your server can potentially “escape” that VM and take control of the underlying host system—and every other VM running on it.
The guest-to-host vulnerability poses a major threat to multi-tenant x86 public clouds running untrusted guests and exposing nested virtualisation
.
The flaw is the first guest-to-host exploit triggerable on both Intel and AMD, to the best of public knowledge
, making it unusually versatile and dangerous.
If your business uses:
- VMware or similar virtualisation platforms on Linux hosts
- KVM-based virtualisation for server consolidation
- Cloud instances on providers using KVM infrastructure
- Development or testing environments with nested virtualisation
…then Januscape is a critical risk.
The public proof-of-concept panics the host; the researcher claims that a separate, unreleased exploit turns the same bug into full host code execution
, meaning exploit code that delivers complete system compromise exists, even if it hasn’t been published yet.
GhostLock (CVE-2026-43499): 15 Years Hidden, Now Disclosed
The second vulnerability disclosed this week is equally serious.
The vulnerable code has shipped by default in essentially every mainstream distribution since 2011
.
The flaw needs no special permission, no unusual settings, and no network access; ordinary threading calls from any local program are enough. A working root exploit is 97% reliable in testing and also escapes containers
.
No one is known to be exploiting it in the wild, but working exploit code has been published, so anyone can now run it
. This is the critical window: the vulnerability is now public knowledge, exploit code is available, but many systems remain unpatched.
What makes this particularly concerning is the attack surface.
VEGA found GhostLock; days earlier, researchers disclosed Bad Epoll (CVE-2026-46242), a close cousin that also turns an unprivileged user into root
. These are part of a broader pattern in 2026 where automated tools are discovering old vulnerabilities in heavily used kernel code.
Why These Old Vulnerabilities Matter Now
Linux kernel CVEs increased 1,117% in 2024 to 3,529 vulnerabilities, with 5,530 recorded in 2025 year-to-date
. This exponential rise reflects improved transparency and better detection tools, but it also means the attack surface is expanding rapidly.
Copy Fail (CVE-2026-31431), another 2026 bug, is already on CISA’s list of vulnerabilities seen in real-world attacks
.
Which UK SMEs Are at Risk Right Now
You should treat this as urgent if your business:
- Runs any Linux servers on-premises (Ubuntu Server, Debian, CentOS, RHEL, SUSE)
- Uses virtualisation platforms with Linux hosts (KVM, Proxmox, oVirt)
- Hosts websites, databases, or applications on Linux infrastructure
- Operates containerised workloads (Docker, Kubernetes) on Linux
- Uses cloud instances where you manage the operating system
- Provides remote access to staff via SSH or similar protocols
Even if your systems are behind firewalls, these vulnerabilities can be triggered by local users—including compromised service accounts, phishing victims who’ve provided credentials, or supply chain attacks that introduce malicious code.
What UK SMEs Must Do This Week
1. Identify Your Linux Systems Immediately
Create an inventory of every Linux server, virtual machine host, and cloud instance your business operates. Don’t forget development servers, staging environments, or legacy systems that may have been set aside but remain connected to your network.
2. Check Your Kernel Versions
The fix reached the mainline stable kernels on July 4 (7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, 5.10.260)
. Run uname -r on each system to check your current kernel version, and compare it against your distribution’s security advisories.
Downstream distributions ship the backport on their own schedules, so confirm status against your vendor’s tracker rather than the upstream version alone
. Major distributions have issued or are preparing updates.
3. Apply Patches Immediately
For production systems, schedule emergency patching within the next 72 hours. Most distributions now have patches available:
- Debian: Fixed in DSA-6381-1 (July 5)
- Ubuntu, Red Hat, SUSE, and other major distributions are releasing updates this week
- Check your distribution’s security mailing list or website for specific advisories
Remember that kernel updates typically require a reboot to take effect. Plan a maintenance window, but don’t delay—
working exploit code has been published
for GhostLock, and the clock is ticking.
4. Review Access Controls
While patches are being applied, audit who has local access to your Linux systems. Remove unnecessary user accounts, disable SSH password authentication in favour of key-based access, and ensure logging is enabled and monitored. These vulnerabilities require local access to trigger, so restricting that access reduces immediate risk.
5. Consider Your Virtualisation Security
If you’re running KVM-based virtualisation, understand that
the guest-to-host vulnerability poses a major threat to multi-tenant x86 public clouds running untrusted guests and exposing nested virtualisation
. If you host multiple clients or projects on shared infrastructure, prioritise those systems for immediate patching.
The Broader Context: Linux Security in 2026
These vulnerabilities are part of a concerning trend. The UK government’s recent Cyber Resilience Pledge, signed by
more than 60 organisations, including M&S, Microsoft UK and Vodafone, aimed at boosting cyber security and resilience across British businesses
, reflects the escalating threat environment.
Meanwhile,
more than 80,000 Fortinet firewalls have been compromised across 194 countries, with more than 86,644 working login credentials verified
in a separate incident disclosed this week. The lesson is clear: vulnerabilities in core infrastructure—whether firewalls, Linux kernels, or virtualisation platforms—are being actively exploited, and UK businesses are in the crosshairs.
As we covered in our recent article on AI-driven cyber threats in 2026, attackers are using automation and AI to discover and exploit vulnerabilities faster than ever. Januscape and GhostLock are examples of how old code can suddenly become a critical risk when modern tools find what manual reviews missed for over a decade.
What Meridian Micro Recommends
For our clients in Saltwood, Hythe, Folkestone, and across Kent, we’re conducting urgent security assessments of all Linux infrastructure this week. If you’re unsure whether your systems are vulnerable, or if you need help planning and executing emergency patches, don’t wait.
This is not a theoretical risk.
Working exploit code has been published
, distributions have released patches, and the window for attackers to strike unpatched systems is wide open right now.
We recommend:
- Immediate patch deployment for all Linux servers and virtualisation hosts
- Security audits of access controls and logging on affected systems
- Regular IT support arrangements that include proactive patch management and vulnerability monitoring
- Backup verification—ensure your cloud backups are current and tested, in case of compromise
The recent surge in container security vulnerabilities and browser security updates we’ve covered this month underscores a fundamental truth: modern IT infrastructure is complex, and vulnerabilities can hide for years before being discovered. When they are found, the race is on between defenders patching systems and attackers exploiting them.
Get Expert Help Securing Your Linux Infrastructure
If your Kent or South East business relies on Linux servers and you need urgent assistance assessing your risk or applying critical patches, Meridian Micro Limited can help. Our team has extensive experience with Linux support and server infrastructure for SMEs across the region.
Don’t let a 16-year-old vulnerability become your next security incident. Call us today on 01303 883111 or contact us online to discuss your server security, patch management strategy, and how we can help protect your business from the latest threats.