Overview
Description
Statistics
- 28 Posts
- 654 Interactions
Fediverse
Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.
while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.
Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.
The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.
You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp
On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.
Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.
As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.
Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.
WTF Ubuntu? https://chalmovsky.com/posts/wtf-ubuntu
In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.
Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".
🚨 Critical Linux kernel flaw could allow remote root code execution; CVE-2026-98432
A use-after-free vulnerability in the Linux IPv4 TCP handshake path allows an unauthenticated attacker to trigger memory corruption by sending specially timed packets to a listening service.
Successful exploitation could crash the system or potentially execute arbitrary code as root.
⠀
• CVSS: 9.8
• Affected: Linux kernel 4.4 and later
• Attack vector: Network
• Privileges required: None
• User interaction: None
• Active exploitation: Not reported
⠀
Fixed kernel branches:
• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.56
• 7.2.10
• 7.3
⠀
Administrators should install their distribution’s updated kernel and reboot to activate the fix.
Advisory: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016
Linux-Kernel: Sicherheitslücke ermöglicht Fernzugriff
Eine Sicherheitslücke im Netzwerk-Stack des Linux-Kernels ermöglicht es Angreifern, aus der Ferne und ohne Benutzerinteraktion beliebige Befehle mit Root-Rechten auszuführen.
https://www.linux-magazin.de/news/linux-kernel-sicherheitsluecke-ermoeglicht-fernzugriff/
#linux #opensource #LinuxKernel #Sicherheitslücke #Fernzugriff #CVE202698432
Bin irritiert, dass für Debian schön länger Kernelpatches bereitstehen, aber man bei Ubuntu irgendwie hängt (CVE Score 9,8).
It's really funny Ubuntu hasn't shipped a fix for CVE-2026-98432 yet because the fix is a +2/-2 diff that applies cleanly to their kernels and the entire reason they haven't been able to get an update out the door is due to deep organisational dysfunction within Canonical.
Reaffirming its commitment to enterprise-grade stability, Canonical announced Monday that CVE-2026-98432, the critical use-after-free in the Linux kernel's IPv4 TCP code, will receive a full 10 years of Long-Term Support on every Ubuntu release it affects.
"Other distros will patch something out from under you in 48 hours, and suddenly your whole threat model is wrong. Canonical is giving CIOs a vulnerability they can actually budget for."
I am having a hard time finding that CVE-2026-98432 [1] is still not fixed in #ubuntu #linux [2] Can someone explain?
[1] www.cve.org/CVERecord?id=CVE-2026-98432
[2] thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
"Linux's stable kernels shipped a fix on October 11 and 15, 2026 for CVE-2026-98432, a use-after-free in the IPv4 TCP handshake that a remote, unauthenticated peer can reach. The kernel's own CVE Numbering Authority (CNA) scores it CVSS 3.1 9.8, Critical. The fixed releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, and the bug goes back to Linux 4.4. The upstream fix is a four-line change, but most servers run a distribution's kernel. Red Hat, which now rates the bug Critical too, shipped fixed kernels for Red Hat Enterprise Linux (RHEL) 8, 9, and 10 on November 1. As of 6:15 PM CST that day, Ubuntu's tracker still reads "Vulnerable" for its kernel on every release.
Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team."
📰 Critical RCE Flaw in Linux Kernel's TCP Module Affects Servers
A critical RCE vulnerability (CVE-2026-98432) with a 9.8 CVSS score has been found in the Linux kernel's TCP module. Unauthenticated attackers can gain root access on systems with exposed MPTCP listeners. #Linux #Kernel #CyberSecurity #RCE
Ubuntu puts fixes for CVE-2026-98432, a Linux kernel TCP flaw rated CVSS 9.8, in the proposed pocket for 22.04 LTS and newer. Older releases wait.
#CVE202698432 #LinuxKernel #Ubuntu #TCP #RCE #MPTCP #PatchNow #LinuxSecurity
Arista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now.
#Arista #VeloCloud #LinuxKernel #RCE #CVE2026111497 #CVE202698432 #Cybersecurity #InfoSec
Bluesky
Overview
Description
Statistics
- 8 Posts
- 5 Interactions
Fediverse
🚨 More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229
The CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular expression inside a CI/CD configuration.
⠀
• CVSS: 10.0
• Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2
• Fixed: 19.2.8, 19.3.5 and 19.4.2
• Active exploitation: Confirmed
⠀
CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks were detected.
Shadowserver is still tracking more than 1,000 vulnerable internet-facing instances.
Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
Karen IT Security Response Center (@ksrc) Advisory
Advisory ID: KSRC-2026-11023
A #critical #vulnerability has been identified in #GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the GitLab server. The vulnerability is tracked as CVE-2026-97229 and has been assigned a CVSS v3.1 score of 10.0 (Critical) — the maximum possible severity.
Bluesky
Overview
- Siemens
- SIMATIC IoT2050 Advanced
Description
Statistics
- 5 Posts
- 1 Interaction
Fediverse
A critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. Secure your exposed instances now.
#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec
A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED is under active exploitation.
Tracked as CVE-2026-58115 with a CVSS score of 10.0, the issue stems from missing authentication in the Node-RED HTTP interface, allowing unauthenticated remote attackers to execute arbitrary code.
Siemens has released updates in version 4.3.4.1 and later.
https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/
Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
A maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under active exploitation, VulnCheck has found, The Hacker News reports. The missing-authentication flaw could let an unauthenticated remote attacker run arbitrary code on the industrial IoT gateways. https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html
Bluesky
Overview
Description
Statistics
- 4 Posts
- 29 Interactions
Fediverse
I published a detailed article:
⚠️Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device⚠️
I managed to make make the PoC exploit absolutely stable, despite the elusive race condition during the attack.
Dangerous Device: Exploiting CVE-2026-31695 in the Linux Kernel via struct device https://a13xp0p0v.tech/2026/11/02/CVE-2026-31695.html
Overview
- Unknown
- CryptoPayment Gateway
Description
Statistics
- 4 Posts
Fediverse
A maximum-severity CVSS 10 vulnerability (CVE-2026-81648) affecting the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2 is seeing in-the-wild exploit attempts.
The flaw stems from missing authorization checks on an AJAX endpoint, allowing unauthenticated users to delete arbitrary files, overwrite configurations, and extract stored wallet credentials in cleartext.
There is no patch available, and the plugin wa…
https://en.hacks.gr/epitheseis-se-istoselides-logo-akalyptoy-kenoy-se-gnosto-prostheto/
Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials
Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, tracked as CVE-2026-81648 with a CVSS score of 10.0, according to Defused Cyber. Successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials. https://thehackernews.com/2026/11/attackers-target-unpatched.html
Bluesky
Overview
- Canonical
- LXD
- lxd
Description
Statistics
- 3 Posts
- 2 Interactions
Fediverse
UWN: A snapshot of what happened this week in Canonical's Ubuntu eco-system. What's happening ? We cite the high impact stuff that over shadows the lil things. Fixed is CVE-2026-112816, Canonical adds back the Ubuntu Core Desktop as a snap only release, 27.04 open for development, linux-firmware-hwe details.
A reminder: Ubuntu Summit 26.10 takes place next week :D
Too:
Circles! activities
Meetings/Reports/Events/ and such
Details: https://ubuntu.com/community/uwn/ubuntu-weekly-newsletter-issue-968
Read, stay informed and enjoy!
Karen IT Security Response Center (@ksrc) Advisory
Advisory ID: KSRC-2026-11021
A #critical #authentication #bypass #vulnerability has been identified in Canonical #LXD and MicroCloud. The vulnerability, tracked as CVE-2026-112816, has been assigned a CVSS v4.0 score of 10.0 (Critical) — the maximum possible severity.
Overview
Description
Statistics
- 5 Posts
- 2 Interactions
Fediverse
CVE-2026-109618 (PHP2Shell) – CRITICAL vuln in WAGO CC100. Attackers can hijack the PHP process via web UI; public exploit exists, no patch yet. Restrict access & monitor for updates. https://radar.offseq.com/threat/wago-multiple-devices-affected-by-php2shell-b21f4d4a82bef247 #OffSeq #Vulnerability #ICS #WAGO
Bluesky
Overview
- Barracuda Networks
- Barracuda Email Security Gateway (ESG)
Description
Statistics
- 4 Posts
- 9 Interactions
Fediverse
CVE-2026-116606: CRITICAL auth bypass in Barracuda ESG (<9.4.0.030). Unauthenticated attackers can import crafted configs, altering appliance settings. Upgrade to 9.4.0.030+ now. https://radar.offseq.com/threat/cve-2026-116606-cwe-288-authentication-bypass-using-an-alternate-path-or-channel-in-barracuda-networks-f64fb8cb7ae70977 #OffSeq #Barracuda #Infosec #CVE2026_116606
Barracuda security advisory:
- CVE-2026-116606 (9.3 critical) Pre-Authentication Authorization Bypass in Email Security Gateway
- CVE-2026-111560 (8.6 high) Command Injection in ESG, ADC, BMA, WCC, WAF, WSGhttps://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection
Patch two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that allow attackers to gain Barracuda root access across multiple appliances.
#Barracuda #EmailSecurity #CVE2026116606 #CVE2026111560 #Cybersecurity #Vulnerability #InfoSec
Overview
- IBM
- Langflow OSS
Description
Statistics
- 3 Posts
- 2 Interactions
Fediverse
IBM disclosed critical Langflow OSS flaws affecting versions 1.0.0–1.12.8, including authentication bypass (CVE-2026-93680) and unauthenticated remote code execution (CVE-2026-110186). Both carry CVSS 9.8.
Upgrade to 1.13.0, checking exposed AI agent/MCP endpoints. IBM lists no interim workaround; back up persistent data before updating.
https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2
IBM has detailed multiple security flaws affecting Langflow versions 1.0.0 through 1.12.8, including two severe issues rated 9.8.
Specifically, CVE-2026-93680 allows improper authentication bypass without an account, while CVE-2026-110186 permits unauthenticated arbitrary code execution.
These vulnerabilities stem partly from default settings where automatic login was enabled.
Users must upgrade to version 1.1…
https://en.hacks.gr/sovara-kena-asfaleias-sto-langflow-epitrepoyn-prosvasi-choris-kodiko/
Overview
Description
Statistics
- 2 Posts
- 1 Interaction
Fediverse
311 IPs have targeted Cisco ISE’s CVE-2026-76460 since October 28.
It’s a CVSS 10 authentication bypass, exploited since mid-September. Most of the traffic comes from rented Amazon cloud in Ireland.
Attacks started well before our first sighting, so check your logs back to September, then patch.
Read the report in the Weekly Threat Alert article: https://www.crowdsec.net/vulntracking-report/cve-2026-76460-cisco-ise-authentication-bypass-exploitation