Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.

while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.

Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.

The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.

You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp

On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.

Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.

As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.

Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.

For anybody assessing risk from CVE-2026-98432, this is good from @malwaretech

tl;dr is basically likely a few million devices are vulnerable, some scanning, no sign of exploitation and no exploits available, development likely in the realms of nation state.

My POV - don't panic, calmly patch.

https://www.linkedin.com/posts/malwaretech_update-on-the-98-cvss-tcpip-rce-in-the-share-7523273340598411264-3rlv/

CVE-2026-98432 means that setting

net.mptcp.enabled = 0

in /etc/sysctl.conf is a very good idea. Then reboot to quash any existing sockets.

IPFire releases Core Update 205 to address CVE-2026-98432, a serious use-after-free flaw in the Linux kernel's TCP stack.
https://linuxiac.com/ipfire-2-29-core-update-205-fixes-serious-linux-tcp-vulnerability/

#opensource

I'm not trying to rush you or anything, #Ubuntu, but could we maybe get a patch sometime this month?

https://ubuntu.com/security/CVE-2026-98432

❯ ssh router /system/package/update/print
            channel: stable
               mode: https
  check-certificate: yes
         ip-version: auto
  installed-version: 7.25
     latest-version: 7.25.1
             status: New version is available

❯

Ubuntu Server Is Cooked | CVE-2026-98432

https://watch.linuxrenaissance.com/w/3ouqDZgMNFM7M6czupnUWz

Ubuntu continues to work on the the fix for CVE-2026-98432.

a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code (CVSS 9.8 score)

Debian released the fix on Oct 16.

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Security

TrueNAS still has no projected release date for a CVE-2026-98432 fix. :/

If we can’t rely on an open port being safe on the internet without the risk of exploitation (CVE-2026-98432), it’s time for us to add another layer of security. Namely, port knocking, or pre-handshake authentication.

And this one is relatively easy to do with what we already have.

Port knocking is an older concept, whereby you monitor logs for a known pattern in attempted connections, then follow up by allowing a connection, or opening a port, for that IP address to connect with a specific service on your machine.

This adds authentication pre-connection, where most vulnerabilities would occur.

You limit access to your tech stack so that anyone in the world can now be treated as if they came from a pre-approved known static IP address.

It’s simple technology, easy to implement, and it removes exploitation a step further away before allowing anyone the chance to communicate with your deeper stack.

Bring port knocking back.

—
And as always: need to secure your agents? Check out what we do at Knostic.

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, CVE-2026-98432, are now available for Red Hat Enterprise Linux 8, 9 and 10, The Hacker News reports. The 9.8-rated flaw can be reached by a remote, unauthenticated attacker; Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date set for a regular update. https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

Ubuntu puts fixes for CVE-2026-98432, a Linux kernel TCP flaw rated CVSS 9.8, in the proposed pocket for 22.04 LTS and newer. Older releases wait.

#CVE202698432 #LinuxKernel #Ubuntu #TCP #RCE #MPTCP #PatchNow #LinuxSecurity

https://securityonline.info/cve-2026-98432-ubuntu-proposed-fix/?utm_source=mastodon&utm_medium=jetpack_social

The IPFire team has released IPFire 2.29 Core Update 205 to address CVE-2026-98432, a serious use-after-free vulnerability located in the Linux kernel's TCP stack.

Due to the nature of the issue, developers urge administrators not to postpone installation until the next regular maintenance window.

This update upgrades the underlying Linux kernel to version 6.18.60 and resolves a separate crash affecting the Broadcom network driver.

A syst…

https://en.hacks.gr/ektakti-enimerosi-asfaleias-apo-to-ipfire-gia-sovaro-provlima-diktyoy/

#IPFire #Linux #Kernel #TCP

Critical Kernel Flaw CVE-2026-98432: How to Patch #Ubuntu #Linux

https://www.ubuntufree.com/linux-kernel-cve-2026-98432-ubuntu-fix/

https://blog.gslin.org/archives/2026/11/04/13323/ubuntu-%e4%b8%8a%e9%80%99%e6%ac%a1-cve-2026-98432-%e7%9a%84%e4%bf%ae%e6%ad%a3%e5%95%8f%e9%a1%8c/

Ubuntu 上這次 CVE-2026-98432 的修正問題

#advisory #cve #Cve202698432 #kernel #linux #mitigation #mptcp #network #proposed #security #ubuntu #vulnerability

rpm -q --changelog kernel-uek | grep -i "CVE-2026-98432"

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under active exploitation, VulnCheck has found, The Hacker News reports. The missing-authentication flaw could let an unauthenticated remote attacker run arbitrary code on the industrial IoT gateways. https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

“If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation,” - VulnCheck researcher Patrick Garrity

https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086

#CVE-2026-58115 #security

A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED is under active exploitation.

Tracked as CVE-2026-58115 with a CVSS score of 10.0, the issue stems from missing authentication in the Node-RED HTTP interface, allowing unauthenticated remote attackers to execute arbitrary code.

Siemens has released updates in version 4.3.4.1 and later.

https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/

#Siemens #NodeRED #IndustrialOS #Vulnerability

Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)

Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation. https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/

A VulnCheck canary has caught the first live exploitation of CVE-2026-58115, an unauthenticated Node-RED admin API flaw with a CVSS score of 10. One HTTP request wires an inject node to an exec node, and the flow downloads and runs a Linux bot. VulnCheck has logged 16 events from one source address.

How many Node-RED instances are still reachable without adminAuth?

https://iottechnews.com/news/node-red-admin-api-flaw-exploited-drop-linux-bots/

#IoT #CyberSecurity #Technology

VulnCheck captured exploitation of Siemens IoT2050 Node-RED flaw CVE-2026-58115 on canaries from October 30. Unauthenticated requests deployed flows that fetched Linux payloads. The malware's capabilities and wider victim count remain unknown.

Siemens fixed it in 4.3.4.1. Patch affected gateways, restrict Node-RED management access and audit unexpected flows.

https://www.vulncheck.com/blog/exploitation-targeting-node-red

#Cybersecurity #Infosec #OTSecurity #PatchManagement

🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin.

CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings.

No known fix. Exploitation attempts observed in the wild.

Full details ↓ https://thehackernews.com/2026/11/attackers-target-unpatched.html

A maximum-severity CVSS 10 vulnerability (CVE-2026-81648) affecting the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2 is seeing in-the-wild exploit attempts.

The flaw stems from missing authorization checks on an AJAX endpoint, allowing unauthenticated users to delete arbitrary files, overwrite configurations, and extract stored wallet credentials in cleartext.

There is no patch available, and the plugin wa…

https://en.hacks.gr/epitheseis-se-istoselides-logo-akalyptoy-kenoy-se-gnosto-prostheto/

#WordPress #CVE #Vulnerability #Plugin

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, tracked as CVE-2026-81648 with a CVSS score of 10.0, according to Defused Cyber. Successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials. https://thehackernews.com/2026/11/attackers-target-unpatched.html

SMS of Death, la vulnerabilità Android che può bloccare le chiamate: rischi e difese

@informatica
Un SMS invisibile può mandare in crash il servizio telefonico di alcuni smartphone Android, interrompendo anche le chiamate di emergenza. La vulnerabilità SMS of Death, identificata come CVE-2026-58882, solleva interrogativi sulla

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Threat actor Gorbag has been targeting Ukrainian law enforcement, local administrations, and the defense sector since February 2025.

Attacks deploy spear-phishing emails with government-themed lures, macro-enabled Excel spreadsheets delivering VBA payloads, and stealers such as BeautyStealer and GIFTEDCROOK.

Operations also utilized a patched WinRAR vulnerability (CVE-2025-8088) and Prime ReverseShell variants featuring prompt inje…

https://en.hacks.gr/rosiki-omada-chaker-stocheyei-tin-oykrania-me-programmata-klopis-dedomenon/

#Phishing #Malware #WinRAR #Ukraine

🚨 Critical zero-click Android RCE patched; CVE-2026-58868

A heap buffer overflow in Android’s Framework component could allow remote code execution without additional privileges or user interaction.

The flaw resides in the onOutputReceived function within FrameDecoder.cpp, where an out-of-bounds write can occur while processing media frames.

• Severity: Critical
• CVSS: Not yet assigned
• Affected: Android 14, 15, 16, 16 QPR2 and 17
• Fixed: Security patch level 2026-11-01 or later
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

Administrators should aim for the 2026-11-05 patch level or later, which includes this fix and the remaining November security updates for kernel and hardware components.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems, CVE-2026-28336

SolarWinds has disclosed a critical command injection vulnerability in Dameware, its remote administration software, carrying a near-maximum CVSS score of 9.9.

The vulnerability could allow authenticated attackers with low-level privileges to execute malicious commands and potentially take control of remotely managed systems.

Given Dameware's role in enterprise IT administration, successful exploitation could put sensitive systems and the data they handle at risk.

CVE-2026-28336 | Critical

• CVSS: 9.9
• Type: Command injection
• Attack vector: Network
• Privileges required: Low
• User interaction: None
• Impact: Potential compromise of remotely controlled hosts

Affected Systems

• Affected: SolarWinds Dameware 2026.3 and earlier
• Fixed: Dameware 2026.3.1
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

SolarWinds recommends that administrators upgrade to version 2026.3.1 to address the vulnerability.

Source: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

SolarWinds Dameware 2026.3.1 fixes Dameware command injection flaw CVE-2026-28336 (CVSS 9.9), plus a buffer overflow and DLL hijacking bug.

#SolarWinds #Dameware #CVE202628336 #CommandInjection #RemoteSupport #CVSS #PatchNow #Vulnerability

https://securityonline.info/dameware-command-injection-cve-2026-28336/?utm_source=mastodon&utm_medium=jetpack_social

CISA added WordPress Core CVE-2026-119977 to KEV on Nov. 3. A weakness in web-accessible staging paths during core upgrades could allow unauthenticated code execution in that window.

Confirm WordPress 7.1.4 or a fixed branch release, and check logs around recent core updates.

https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog

#Cybersecurity #Infosec #WordPress #PatchManagement

CVE-2026-121607 – CRITICAL OS command injection in Qihoo 360 D603-2 (6.4.0 – 6.4.9). Remote code execution possible; public exploit exists. No patch available — immediate isolation and network restrictions advised. https://radar.offseq.com/threat/cve-2026-121607-os-command-injection-in-qihoo-360-d603-2-a508182fff399655 #OffSeq #CVE2026121607 #IoTSecurity