Vulnerability management
made modern

Affected kernel, algif_aead loaded, and unprivileged AF_ALG access confirmed.

• Kernel assessmentInstalled package affected; vendor fix absent.
• Kernel modulealgif_aead loaded.
• Unprivileged probeUID 1001: AF_ALG authencesn(hmac(sha256),cbc(aes)) bind allowed.
• Mitigation checkPrerequisite checks only; no exploit payload executed.

A local attacker could alter a cached setuid binary and run it as root.

• Execution contextRegistration PHP-FPM workers run as UID 1001. Local code execution is required.
• Target permissions/usr/bin/su: readable, root-owned, setuid.
• Reachable pathThe vulnerable crypto path can overwrite cached executable bytes.

app-server-02 runs travel agent registration. Jira, ServiceNow, and Slack corroborate the host identity and business purpose.

• Jira: TRAVEL-218Deployment record maps travel agent registration to app-server-02.
• ServiceNow: Application CIBusiness service: Travel Agent Registration. Environment: Production.
• Slack: #travel-platformTeam confirmation: app-server-02 serves travel agent registration.

Nginx routes registration requests to PHP-FPM. Running workers and recent access logs confirm activity.

• Sensor heartbeatapp-server-02 checked in successfully.
• Nginx configurationSite root: /var/www/travel-registration/public. PHP requests route to the registration PHP-FPM pool.
• PHP-FPM workersThe registration pool is running as UID 1001 and executes /var/www/travel-registration/public/index.php.
• Recent access logs1,842 requests in the last 5 minutes; registration endpoints are returning 2xx responses.

CrowdStrike rates this host as High criticality.

• Device matchCrowdStrike device identity matched to app-server-02.
• Asset criticalityHigh. Source: CrowdStrike asset classification.

High criticality + exploitable on this host + active exploitation in the wild.

• Acme policy: Section 4.2High-criticality CrowdStrike assets with exploitable, actively exploited vulnerabilities must be patched within 48 hours.
• Hinoki intelligenceActive exploitation reported for CVE-2026-31431; corroborated by CISA KEV, added May 1, 2026.
• Policy matchCriticality: High. Host exploitability: Confirmed. Exploitation in the wild: Yes.
• Required actionPatch within 48 hours. No local exploitation finding is required by this policy.