Post-Exploitation Cache Drop Recovery (CVE-2026-31431)

Elgonad .@elgonad

•updated Apr 30, 2026•5•0•292

Detects commands used to flush system kernel caches via drop_caches. In the context of the CVE-2026-31431 (CopyFail) vulnerability, flushing caches is the primary method to recover the 'su' binary after it has been corrupted by the public Proof-of-Concept exploit.