Here's a number that should make every Linux sysadmin put down their coffee: 15 years. That's how long a critical privilege-escalation bug sat quietly inside the Linux kernel before an AI tool finally noticed it. Not a human auditor. Not a bug bounty hunter squinting at code at 2am. A machine.
The vulnerability, tracked as CVE-2026-43499 and nicknamed GhostLock, is what security researchers call a use-after-free flaw. The short version: it lets any regular logged-in user — no special permissions, no network access required — take complete root control of an unpatched machine. It shipped by default in virtually every major Linux distribution starting in 2011, meaning the bug has been running silently on servers, desktops, and cloud infrastructure for over a decade and a half.
Nebula Security found it using VEGA, the company's AI-powered bug-hunting tool, which has been systematically combing through old kernel code that most human researchers stopped rereading years ago. That's the quiet but important detail here: the bug wasn't hidden in some obscure corner that was hard to reach. It was hiding in plain sight, in code that millions of systems depend on, simply because nobody had looked closely enough in a long time.
The exploit Nebula published is not theoretical. It works. In internal testing, it was 97 percent reliable, and it can escape containerized environments — which is a particular nightmare for cloud and DevOps teams who assume container boundaries offer meaningful protection. The find earned Nebula a $92,337 payout through Google's kernelCTF program, which exists specifically to reward this kind of deep kernel research.
The fix landed in April, which sounds reassuring until you check the patch status across actual distributions. Ubuntu, as of early July, still listed three of its long-term support versions — 24.04, 22.04, and 20.04 — as either vulnerable or actively being worked on. So if you're running Ubuntu and assuming a patch is already waiting for you, verify that assumption before you move on with your day.
The broader story here is less about this specific bug and more about what AI-assisted security research is starting to look like in practice. GhostLock is not a one-off. Nebula has surfaced a string of Linux privilege-escalation vulnerabilities this year using the same automated approach, and other teams are doing similar work. The pattern is consistent: automated tools are re-reading old, trusted code with fresh eyes and finding things that years of human review missed.
That's both encouraging and uncomfortable. Encouraging because defenders now have better tools to find these problems first. Uncomfortable because the same approach is available to anyone — including people whose intentions are considerably less responsible than publishing a CVE and collecting a bounty. The race between finding and exploiting old bugs just got a significant speed upgrade on both sides.
SPACE
China Recovers Its First Reusable Rocket With a Novel Twist
China just became only the third entity in history to successfully recover an orbital-class rocket booster — and it did it using a method that neither SpaceX nor Blue Origin has ever attempted. That combination of milestone and innovation makes Friday's launch worth paying attention to beyond the usual geopolitical scorekeeping.
The Long March 10B lifted off from Wenchang on Hainan Island just after midnight Eastern time, powered by seven kerosene-fueled engines and standing roughly 209 feet tall. About ten minutes after launch, the booster guided itself back down and descended onto a ship waiting offshore in the South China Sea. What happened next is where things get genuinely interesting.
Instead of landing vertically on deployable legs the way a Falcon 9 does, or getting caught by mechanical arms at the launch tower the way SpaceX's Starship booster now is, the Long March 10B was captured by a net stretched across the recovery vessel in a tensioned grid pattern. The rocket shut down its engines, and the net held it suspended in midair — smoldering, vertical, and intact. It is a genuinely novel approach to a problem the industry has been solving in only a couple of ways until now.
The engineering logic behind the net catch is straightforward once you hear it. Landing legs add mass, and mass is the enemy of payload capacity. By catching the rocket in a net rather than landing it on legs, China's state-owned rocket developer CASC avoids carrying that dead weight on every future flight. Recovering the booster downrange rather than flying it back to the launch site also means burning less fuel during the descent, which preserves more of the rocket's performance for actually getting things to orbit.
SpaceX figured out the landing leg problem years ago by catching Starship's Super Heavy booster with tower-mounted mechanical arms, eliminating legs on that vehicle. China's approach applies similar thinking but executes it differently — on a ship, with a net, for a medium-lift rocket rather than the largest ever built.
The rocket's upper stage continued to orbit and deployed a payload identified only as CX-26, which is the kind of vague designation that tends to invite speculation. CASC described the overall mission as a validation of key reusability technologies, including multiple engine restarts, high-altitude ignition, and the net recovery system itself.
To put the milestone in context: SpaceX first landed a Falcon 9 booster in 2015. Blue Origin returned its New Glenn booster to an offshore platform for the first time last November. China has now joined that club, and it arrived with a different playbook.
Whether the net-catch approach proves more practical than legs or tower arms at scale remains to be seen. But the fact that a third major player is now recovering orbital boosters — and experimenting with the technique rather than simply copying what worked elsewhere — suggests the reusable rocket era is maturing faster than most expected, and in more directions than one.
Source: Ars Technica
The Long March 10B lifted off from Wenchang on Hainan Island just after midnight Eastern time, powered by seven kerosene-fueled engines and standing roughly 209 feet tall. About ten minutes after launch, the booster guided itself back down and descended onto a ship waiting offshore in the South China Sea. What happened next is where things get genuinely interesting.
Instead of landing vertically on deployable legs the way a Falcon 9 does, or getting caught by mechanical arms at the launch tower the way SpaceX's Starship booster now is, the Long March 10B was captured by a net stretched across the recovery vessel in a tensioned grid pattern. The rocket shut down its engines, and the net held it suspended in midair — smoldering, vertical, and intact. It is a genuinely novel approach to a problem the industry has been solving in only a couple of ways until now.
The engineering logic behind the net catch is straightforward once you hear it. Landing legs add mass, and mass is the enemy of payload capacity. By catching the rocket in a net rather than landing it on legs, China's state-owned rocket developer CASC avoids carrying that dead weight on every future flight. Recovering the booster downrange rather than flying it back to the launch site also means burning less fuel during the descent, which preserves more of the rocket's performance for actually getting things to orbit.
SpaceX figured out the landing leg problem years ago by catching Starship's Super Heavy booster with tower-mounted mechanical arms, eliminating legs on that vehicle. China's approach applies similar thinking but executes it differently — on a ship, with a net, for a medium-lift rocket rather than the largest ever built.
The rocket's upper stage continued to orbit and deployed a payload identified only as CX-26, which is the kind of vague designation that tends to invite speculation. CASC described the overall mission as a validation of key reusability technologies, including multiple engine restarts, high-altitude ignition, and the net recovery system itself.
To put the milestone in context: SpaceX first landed a Falcon 9 booster in 2015. Blue Origin returned its New Glenn booster to an offshore platform for the first time last November. China has now joined that club, and it arrived with a different playbook.
Whether the net-catch approach proves more practical than legs or tower arms at scale remains to be seen. But the fact that a third major player is now recovering orbital boosters — and experimenting with the technique rather than simply copying what worked elsewhere — suggests the reusable rocket era is maturing faster than most expected, and in more directions than one.
Enjoyed this?
Get stories like this delivered every Tuesday — free.