Daily English Article — July 10, 2026

Tensions between the United States and Iran have escalated dramatically as the two nations exchanged military strikes for a second consecutive day. President Donald Trump authorized new attacks after expressing fury that the Strait of Hormuz remained closed and that Iranian forces had targeted ships transiting the critical oil chokepoint. A US official indicated that Trump's decision came partly while he was attending a NATO summit, where he declared the existing ceasefire effectively finished.

American strikes targeted multiple Iranian ports along the southern coastline, including Bushehr, Bandar Abbas, and Sirik. US Central Command confirmed that American forces had struck ninety Iranian military targets along coastal regions. In addition, reports emerged of strikes on a railway bridge near Aqqala, northeast of Tehran. CNN geolocated Iranian media footage confirming damage to the bridge, though CENTCOM did not specifically acknowledge this target in its official statement.

Iran's Islamic Revolutionary Guard Corps retaliated by launching coordinated drone and missile attacks against US military installations in Kuwait and Bahrain. Targeted facilities included Camp Arifjan and Ali Al Salem Air Base in Kuwait, as well as Shaikh Isa Air Base and the Juffair naval complex in Bahrain. Juffair serves as the home of the US Fifth Fleet. Air-raid sirens sounded across both Gulf nations as local defense forces scrambled to intercept the incoming threats.

Rhetoric from both sides grew increasingly confrontational. Trump warned that strikes would 'get much worse' if Iran continued attacking shipping in the strait. Iran's top negotiator countered that the Strait of Hormuz would only open under Iranian arrangements, firmly rejecting American pressure. The IRGC also threatened to expand its strikes to additional US bases throughout the region should Washington choose to retaliate further, raising fears of a broader regional conflict.

Amid the military confrontation, Iran continued the week-long funeral proceedings for Supreme Leader Ali Khamenei. His body was scheduled to be transported to its final resting place at the Imam Reza shrine in Mashhad. A major point of uncertainty surrounded his son and newly designated successor, Mojtaba Khamenei, who has not appeared publicly. Speculation mounted that Mojtaba may have been wounded in the joint US-Israeli strike that killed his father, mother, and other relatives.

Two high-severity security vulnerabilities have been discovered in the Linux operating system within the same week, raising serious concerns across the cybersecurity community. The more critical of the two, tracked as CVE-2026-53359 and named Januscape, resides within KVM, the kernel-based virtual machine component integrated into many Linux distributions. Researcher Hyunwoo Kim discovered the flaw and revealed that it had gone undetected in the Linux kernel for approximately sixteen years.

Januscape allows a malicious user operating from within a guest virtual machine to compromise the host machine that runs it. In cloud computing environments, guest VMs are typically isolated containers that separate one user's instance from others sharing the same physical hardware. By exploiting this vulnerability using only guest-side actions, an attacker could either crash the host kernel in a denial-of-service attack, taking down all other tenant VMs, or execute code with root privileges to seize control of the entire host system.

Technically, Januscape is classified as a use-after-free vulnerability, a form of memory corruption that injects malicious code into memory regions that have recently been freed. The flaw exists specifically within shadow MMU emulation, a process responsible for translating memory addresses between the guest VM and the host machine. An attacker can corrupt the host kernel's shadow page, a data structure that assists in this address translation, triggering a cascade of harmful effects on the host system.

Kim released a proof-of-concept exploit demonstrating how guest-side actions can crash the host OS. He noted that a more complete exploit capable of fully escaping the guest VM also exists but will not be made public for the foreseeable future. Crucially, the vulnerability operates independently of QEMU, meaning that cloud platforms using custom virtualization stacks remain at risk. Google recognized the severity of the discovery and awarded Kim $250,000 as a bug bounty reward.

The second vulnerability, CVE-2026-43499, lurked in Linux for fifteen years and was uncovered by researchers at Nebula Security using an AI-assisted scanning tool called Vega. Unlike Januscape, this flaw targets users with limited system rights, enabling them to escalate their privileges to root level. It exploits a flaw in the kernel's futex priority-inheritance mechanism, specifically a rare code path activated during lock operations. Together, these two discoveries underscore the persistent challenges of securing widely deployed open-source software.