Threadlinqs IntelligenceStart free

Threat video1:00

CVE-2026-3038 FreeBSD Jail Escape Chains: Detection & IOCs

Praetorian's LLM-assisted work chains a FreeBSD stack leak with CVE-2026-3038 to escape VNET jails: 9 detection rules, 8 IOCs and a free Splunk SPL rule.

Read the full threat intel for CVE-2026-3038 FreeBSD Jail Escape Chains: Detection & IOCs →

Chapters

  1. 0:00The hookResearchers LLM-built two kernel exploits.
  2. 0:04The storyLLM-research discovered eight bugs.
  3. 0:11Attack pathConfirmed kernel bugs, gained shell.
  4. 0:24AttributionNo threat actor: this was defensive research.
  5. 0:28Indicators of compromise1 indicator to hunt: 1 path.
  6. 0:34MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to impact.
  7. 0:39Remediation3 steps now: Apply FreeBSD-SA-26:05[.]route via freebsd-update, pkg, or source patch on all.
  8. 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript

0:00Researchers LLM-built two kernel exploits.

0:05LLM-research discovered eight bugs.

0:07Two built jail-escape chains.

0:11Confirmed kernel bugs, gained shell.

0:14Leaked stack and KASLR.

0:16Exploited memory corruption.

0:18Reached root, escaped jail.

0:24No threat actor: this was defensive research.

0:291 indicator to hunt: 1 path.

0:359 ATT&CK techniques, from reconnaissance to impact.

0:403 steps now: Apply FreeBSD-SA-26:05[.]route via freebsd-update, pkg, or source patch on all.

0:519 detection rules, in SPL, KQL and Sigma.

0:56Threadlinqs. The unified security engineering platform.