This has been true for DECADES.

Regular LPEs are not novel. The frequency has just increased a lot.

[delayed]

Id count windows and macos in there because you just need an admin pass and you have full rights. Average users might reuse that password everywhere too, plus no password requirements, no expiration.

So many guides online for various stuff have users typing sudo or run as administrator too, so they don’t look at it with a side eye either if the attack went in via social engineering instead of brute force or using a leaked pass associated with the user.

[delayed]

> people no longer use low-privilege user accounts to sandbox potentially malicious software

Is it the same for containers and VMs? If not, what makes them less vulnerable?