Innovation Heroes: The inside story of how we found a zero-day sudo vulnerability

In the world of cybersecurity, twelve years is an eternity. It’s long enough for entire industries to transform, for new threats to emerge and evolve, and for security professionals to build careers. But sometimes, twelve years is exactly how long a single line of malicious code can sit dormant, waiting.

That’s precisely what happened with sudo — the foundational command that controls access to virtually every Linux system on the planet. Hidden in code that powers millions of servers, routers, and critical infrastructure systems, a vulnerability sat undetected for over a decade. It was invisible, widespread, and potentially catastrophic if exploited by malicious actors.

The stakes were enormous. Sudo isn’t just another piece of software — it’s the gatekeeper for system-wide privileges across Unix-based systems. When this command is compromised, entire networks can fall. The ripple effects could have impacted airlines, hospitals, financial institutions, and government systems worldwide, all without requiring passwords or leaving traditional forensic traces.

This is exactly what Rich Mirch and Quentin Rhoads-Herrera explored in the latest episode of Innovation Heroes. Mirch, Principal Security Researcher at Stratascale, made the discovery that led to not one, but two critical zero-day sudo vulnerabilities being responsibly disclosed. Rhoads-Herrera, VP of Security Services at Stratascale, helped validate the findings and coordinate the disclosure process that prevented a potential global catastrophe.

“When I first started looking at it, I told myself I’m going to find a vulnerability in sudo. No idea, but I have to keep that open mind,” Mirch said.

This mindset — deliberately assuming vulnerabilities exist even in the most battle-tested code — proved crucial to the discovery.

Inside Stratascale’s research methodology

The research methodology that led to this breakthrough offers valuable lessons for security teams worldwide. Rather than relying on traditional static code analysis, Mirch focused on dynamic testing of lesser-known command options. According to a 2024 study by the Cybersecurity and Infrastructure Security Agency, over 60% of critical vulnerabilities are discovered through human-driven testing rather than automated tools, highlighting the continued importance of manual security research.

“The options that we found issues in, probably most people have never used or maybe even never heard of,” Mirch said. The first vulnerability, present since 2013, lurked in sudo’s host option functionality. But the second discovery proved even more concerning — it required no special sudo privileges, just basic system access.

The discovery process wasn’t straightforward.

Unlike simple command-line exploits, these vulnerabilities required multi-step processes that automated testing tools consistently missed. This complexity explains why they remained hidden despite sudo’s rigorous security review processes, which include static analysis, fuzzing, and continuous community scrutiny.

RELATED: Read our blog announcing the vulnerabilities.

“I was really shocked that something that is scrutinized as heavily as sudo had an issue like this,” Rhoads-Herrera noted. The reaction underscores a critical reality in cybersecurity: even the most trusted, well-maintained software can harbor critical flaws.

The timeline between discovery and potential exploitation adds urgency to these findings. Research from security firm Recorded Future shows that the average time between vulnerability disclosure and active exploitation by criminal actors is just 15 days. This narrow window makes coordinated disclosure processes — like the one Stratascale followed — essential for preventing widespread damage.

Working directly with sudo’s maintainer, the Stratascale team ensured patches were available before public disclosure. This responsible approach prevented the typical weaponization window that follows security announcements. For organizations running Linux-based infrastructure, this represents the difference between a managed security update and a potential emergency response situation.

A wake-up call and a roadmap for IT leaders and CISOs

The broader implications extend beyond this single discovery. As Rhoads-Herrera explained, “If we’re always trying to respond to the vulnerabilities that others have found or it’s being exploited in the wild by criminals, we’re already kind of behind the eight ball.” This proactive approach to security research — actively hunting for vulnerabilities before they’re discovered by malicious actors — has become essential for modern enterprise defense.

For IT leaders and CISOs, the sudo vulnerability story serves as both a wake-up call and a roadmap. It demonstrates that automated security tools, while essential, cannot replace human expertise and curiosity. The most effective security postures combine comprehensive automated scanning with proactive human research and strong industry partnerships.

Organizations looking to strengthen their security posture should consider how they can replicate this proactive approach. This includes investing in security research capabilities, establishing relationships with ethical security researchers, and implementing rapid patch management processes that can respond to coordinated disclosures within hours rather than days.

The discovery also highlights the value of offensive security research as a defensive strategy. By actively seeking vulnerabilities in their own systems and commonly used software, organizations can identify and address risks before they become active threats. This approach requires specialized skills and often benefits from external partnerships with firms that maintain dedicated research capabilities.

How SHI can help

When you need qualified, impartial advice on cybersecurity solutions and frameworks to minimize vulnerabilities, SHI’s Field CISOs and security experts provide the guidance organizations need to stay ahead of emerging threats. We help identify critical resilience gaps, consolidate security platforms, and integrate AI into cybersecurity practices. As your vendor-neutral partner, SHI has helped thousands of enterprises optimize their security protection while reducing procurement complexity.

NEXT STEPS

Learn more about strengthening your security posture with SHI, and listen to the full conversation here. You can also find episodes on SHI’s Resource Hub, Spotify, and other major podcast platforms, as well as on YouTube in video format.

Video + audio

Audio only