Indian Cybersecurity Firm Uses Homegrown AI to Discover Three Security Flaws in Enterprise Linux

Bengaluru (Karnataka) [India], August 5: An Indian cybersecurity company has used a homegrown artificial intelligence model to discover three previously unknown security vulnerabilities in one of the most widely used identity management components in enterprise Linux, highlighting a new application of AI beyond chatbots and productivity software.

Bengaluru-based BreachX said the vulnerabilities were identified using Typhon AI Mil v2, its internally developed AI model built specifically for offensive cybersecurity research. The flaws were disclosed to Red Hat under a coordinated vulnerability disclosure process and have been assigned the identifiers CVE-2026-68742, CVE-2026-68743, and CVE-2026-68744.

Red Hat has acknowledged BreachX Zero Day Research Labs, the company’s research division, for reporting the vulnerabilities.

The findings affect the System Security Services Daemon (SSSD), an open-source software component used by enterprise Linux distributions to authenticate users and connect systems to identity services such as Microsoft Active Directory, LDAP, and FreeIPA. Because SSSD underpins authentication and access management across large corporate and government environments, it is deployed on millions of enterprise Linux systems worldwide.

According to Red Hat, affected products include Red Hat Enterprise Linux 7 through 10and OpenShift Container Platform 4.

The vulnerabilities are not remotely exploitable and do not allow attackers to compromise systems over the internet. Instead, they involve weaknesses in how SSSD processes certain requests from local users. Left unpatched, the issues could allow an attacker with local access to crash parts of the authentication service or expose limited portions of process memory.

While the individual flaws range from low to moderate severity, security researchers say such bugs are important because they occur inside software that sits at the heart of enterprise identity infrastructure. Information disclosed through memory exposure can sometimes help attackers exploit more serious vulnerabilities elsewhere, while service crashes can affect system availability.

What makes the discovery notable is the method used to find them.

Rather than relying solely on conventional fuzz testing or manual auditing, BreachX says its researchers used Typhon to analyse SSSD’s source code for subtle programming errors before validating every finding through manual review and laboratory testing.

The company describes Typhon as a domain-specific AI model designed exclusively for cybersecurity tasks such as secure code analysis, vulnerability research and exploit development. Unlike general-purpose language models, it is intended to assist researchers in identifying software weaknesses in complex codebases.

The work reflects a broader trend in which AI is increasingly being applied to software security, not only to automate defensive operations but also to identify vulnerabilities before they are exploited. While much of India’s AI ecosystem has focused on building sovereign language models and enterprise assistants, BreachX is pursuing a specialised approach centred on offensive security research.

“Language models were the obvious first sovereign capability for India to build. Security is the one nobody can afford to outsource,” said Rajshekhar Pullabhatla, founder of BreachX.

“Typhon exists because reviewing the world’s critical infrastructure code is not something you want to do on somebody else’s model, on somebody else’s terms.”

Red Hat has released security advisories for all three vulnerabilities and recommends customers apply updated packages as they become available. At the time of publication, the company said no practical workaround meeting its deployment and stability requirements was available.

For India’s cybersecurity industry, the disclosures also illustrate a shift in how domestic AI is being developed. Rather than focusing exclusively on conversational AI, some companies are beginning to build specialised models for highly technical domains such as vulnerability discovery, where the ability to analyse critical software at scale could become an increasingly important capability.

If you object to the content of this press release, please notify us at pr.error.rectification@gmail.com. We will respond and rectify the situation within 24 hours.