Security R&D at Miggo | eBPF, Tracing, OS | Jibril Runtime Creator | Former Tracee Runtime Security Maintainer, Ubuntu Core Dev and Mainframer.

• 

  This is part two of a series (medium.com/@miggo-enginee…). Part one was about detecting CopyFail and DirtyFrag (medium.com/@miggo-enginee…) - if you missed it, same idea applies here. CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The

• 

  “Detecting the nftables Catchall Use-After-Free (CVE-2026–23111) by thinking outside the box” by Miggo Engineering medium.com/@miggo-enginee…

• 

  Okay, as many of my #ebpf and #security colleagues might know, I'm at a new home that has been treating me very well (Miggo Security). They have amazing tech. It has taken me weeks to catch up, and I still haven't finished. SO, I know many engineers have already rushed to write

• 

  Almost there. Nice way to start the week.

• 

  Sorry #security lovers, despite the #litellm and #trivy seriousness and effects, I cannot stop thinking how much more work and cognitive demand an async use after free of a deferred worker pointer of a protocol handler requires. Have fun with the #exploit.