Maple Grove Report

Maple Grove Report

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.


12-year-old Pack2TheRoot bug lets Linux users gain root privileges

Pierluigi Paganini
April 24, 2026

‘Pack2TheRoot’ flaw lets local Linux users gain root via PackageKit. CVE-2026-41651 (8.8) has existed for nearly 12 years.

The Pack2TheRoot flaw, tracked as CVE-2026-41651, lets unprivileged users install or remove system packages without authorization, potentially gaining full root access.

The vulnerability is rated high severity, CVSS score of 8.8, and has existed for nearly 12 years.

Discovered by Deutsche Telekom’s Red Team, it stems from PackageKit allowing commands like “pkcon install” to run without a password on some systems. Researchers used AI (Claude Opus) to explore the issue, confirmed it manually, and responsibly disclosed it to maintainers, who validated the flaw.

“Today we publicly disclose a high-severity vulnerability (CVSS 3.1: 8.8) – in coordination with distro maintainers – that affects multiple Linux distributions in their default installations. The Pack2TheRoot vulnerability can be exploited by any local unprivileged user to obtain root access on a vulnerable system.” reads the advisory published by Deutsche Telekom. “The vulnerability lies in the PackageKit daemon, a cross-distro package management abstraction layer.

Details of the Pack2TheRoot flaw were disclosed alongside a fix in PackageKit 1.3.5, though exploit code was withheld to allow patching. Deutsche Telekom researchers found that PackageKit could run commands like “pkcon install” without authentication in some cases on Fedora, enabling package installation. The researchers used the Claude Opus AI tool to explore this behavior further and identified the vulnerability as CVE-2026-41651.

All PackageKit versions from 1.0.2 to 1.3.4 are vulnerable, affecting many Linux distributions for over 12 years. Tested systems include Ubuntu, Debian, Fedora, and Rocky Linux, and others using PackageKit may also be at risk, including servers with Cockpit. The issue is fixed in version 1.3.5, with patches released on April 22, 2026.

Technical details of the vulnerability are not yet disclosed and will be shared later. Researchers have developed a reliable proof-of-concept that allows an unprivileged local user to gain root code execution on default Linux systems. However, the PoC code has not been released publicly to prevent abuse while patches are being deployed.

To check if you’re vulnerable, verify if PackageKit is installed using dpkg or rpm, as it may run on demand via D-Bus. Then check if the service is active with systemctl or monitoring tools like pkmon/pkgcli. If active and unpatched, your system may be at risk. Although fixed in version 1.3.5, many distributions have released patched versions separately, so updating via your distro is essential.

You can use the following commands to check whether a vulnerable version of PackageKit is installed on your system:

dpkg -l | grep -i packagekit
rpm -qa | grep -i packagekit

To verify if the PackageKit daemon is active, run systemctl status packagekit or pkmon. If the service is loaded or running, your system may be at risk if it has not been patched.

Researchers released Indicators of compromise (IOCs) for this flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pack2TheRoot)







Source link


Energy prices continue to rise, with bills having increased for most of us in recent years. Using less energy can save you a significant amount of money, and your smart home can help you to do it.

An iPhone showing some smart home scenes with some icons around.


8 Hidden Costs of a Smart Home (and How to Avoid Them)

The cost of your smart home devices is just the tip of the iceberg.

Reducing standby power

Smart plugs can help

Amazon's Smart Plug. Credit: Hannah Stryker / How-To Geek

Some devices running on standby can use more energy than you might suspect. Devices such as PCs, digital TV boxes, and old DVRs can draw several watts of power while on standby. All of this can add up to a significant amount of money that you’re spending to keep devices running when you’re not using them.

The simplest solution is to use energy monitoring smart plugs. These devices can measure the power draw of the device that’s plugged into them, and you can use this to determine when the device is on and when it’s on standby. Instead of leaving the device on standby, you can turn off the smart plug to power down the device completely.

Using a smart plug isn’t right for every device. Shutting off the power to a sleeping PC may not be the best idea, for example. I use SSH to shut down my iMac when I’m not using it, and Wake on LAN to fire it up again when I need it.

Dimensions

2.36 x 2.76 x 1.52 inches

Hub Required

No

The latest Eve Energy HomeKit smart plug supports Matter and Thread networking, a protocol that extends the range of your smart home devices. It can also monitor energy usage.


Load shifting based on price

Use power-hungry devices when it’s cheapest

An Amazon Echo Hub showing a Home Assistant dashboard with electricity usage and prices. Credit: Adam Davidson / How-To Geek

My electricity supplier offers a variable tariff where the price of electricity changes every 30 minutes based on supply and demand. During peak hours, the price is higher, and during off-peak hours, it drops. On good days, the price can even go negative, effectively paying me to use electricity.

As I work from home, I’m better able to take advantage of the cheapest times, but my smart home helps. I can put a load of laundry in the washing machine in the evening, for example, and then let my automation decide when to start the cycle.

I have sensors that give the cheapest one-hour, two-hour, three-hour, and four-hour windows, so I can find the optimal times to do washing, run the dryer, turn on the dishwasher, and more. Shifting heavy loads to the cheapest times has made a big difference to my bills.

Keeping humidity in check

It can cost more to heat a humid home

A dehumidifier in the entrance of a house or office. Credit: Patricia Perez R / Shutterstock.com

My house is old and leaky and doesn’t store heat well. It can often be cold and damp, which is a dangerous combination that can lead to the growth of mold. Another major issue with high humidity is that a damp home can feel colder, making it harder to heat efficiently.

By keeping the humidity down, I can not only reduce the risk of mold, but also heat my home for less. I use humidity sensors to track the indoor humidity and get an alert each morning that tells me to open the windows if doing so will reduce the humidity indoors. I also have a dehumidifier for when the humidity gets too high, which I can run when electricity prices are lowest.

Turning off the heating when windows are open

Why pay to heat the outside?

A contact sensor protecting a window. Credit: 

Philips Hue

When I open my windows in the morning to reduce the humidity, I don’t want my heating to be running. If it is, all I’m doing is paying to heat the outdoors. My smart thermostat has open window detection, which can turn off the heating when it thinks a window is open, but this isn’t particularly accurate.

Using cheap contact sensors, my heating automation can tell exactly when windows are open and when they aren’t. I can then ensure the heating is only running when the windows are all closed.

Room-based heating

Smart TRVs can pay for themselves

Another successful investment in my smart home is smart thermostatic radiator valves (TRVs). These are smart valves that can control the hot water radiators in my home, shutting them off completely or setting them to specific levels.

These devices have already paid for themselves. Instead of either heating every room in my house or none of them at all, I can now choose to heat specific rooms and leave others off. For example, the bedrooms in the house are only heated during the evenings or when the risk of mold begins to get too high.

By only heating the rooms that are being used, you can make a huge dent in your heating costs. In reality, only a handful of rooms are in use during the day, so by heating just those rooms, I’ve been able to save much more than the cost of the TRVs.


Smart homes can save you money

Smart home tech isn’t always cheap, but with the right products and automations, your smart home could save you money. I’ve noticed a significant difference in my energy bills since setting up these Home Assistant automations, and the beauty is that they keep saving money over time.



Source link

Recent Reviews