CVE-2026-31431 CopyFail Linux LPE exploit script execution

Detects the execution of Python scripts named 'exploit.py' or 'exp.py', which are common naming conventions associated with proof-of-concept or exploit code.