Es finden heute Reboots statt wegen der Kernel Lücke CVE-2026-98432. Also nicht wundern das Dienste kurzzeitig offline sind.

Patching is taking some time on this potentially serious Linux kernel vulnerability. While we wait, we have a rundown of the partial mitigations for the known attack path.

https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946

#ThreatIntel #ThreatIntelligence

Otra vulnerabilidad... ahora en el kernel de Ubuntu...

https://ubuntu.com/security/CVE-2026-98432

Eine gravierende Sicherheitslücke im #Linux Kernel erlaubt entfernte Root Exploits. Die KI Claude von #Anthropic hat einen funktionierenden Exploit für CVE-2026-98432 geschrieben. Einige Distributoren wie #Ubuntu und #RHEL sind noch ohne Patches. https://www.golem.de/news/linux-luecke-claude-schreibt-root-exploit-ubuntu-und-rhel-ohne-patch-2610-214664.html

⚠️ Linux kernel vulnerability CVE-2026-98432 is a use-after-free in the code that sets up incoming IPv4 TCP connections.

AlmaLinux 8, 9, and 10 are affected.

Patched kernels are available for testing!
https://almalinux.org/blog/2026-10-30-cve-2026-98432/

For all my self-hosting friends using netbird:
There's a Linux kernel bug being tracked as CVE-2026-98432 that can lead to unauthenticated remote code execution when malicious traffic hits a vulnerable TCP socket.

This affects netbird in its standard configuration when Traefik is used, because Go automatically enables MPTCP by default.

Go Security team warns that disabling MPTCP is not a complete fix. Linux kernel update + system restart is necessary.

If you're using Ubuntu there is currently no kernel update available¹.
All Debian Security Releases report that there's a fix version available².

https://www.cve.org/CVERecord?id=CVE-2026-98432

¹ as of 30.10.26 12:24 (https://ubuntu.com/security/CVE-2026-98432)

² https://security-tracker.debian.org/tracker/CVE-2026-98432

#cve #netbird #linux #selfhosting #ubuntu

Hinweise des deutschen Anbieters #Securepoint zur IPv4-TCP-#Schwachstelle #CVE-2026-98432 im #Linux Kernel, in Bezug auf deren Systeme (Securepoint UTM etc).

https://borncity.com/blog/2026/10/31/securepoint-zur-ipv4-tcp-schwachstelle-cve-2026-98432-in-linux/

We have kernels with fixes for CVE-2026-98432 in the production repos and they should be showing up in a mirror near you within the next few hours:
* kernel-4.18.0-553.180.1.el8_10.0.1
* kernel-5.14.0-687.61.1.el9_8.0.1
* kernel-6.12.0-211.69.1.el10_2.0.1
#cve #kernel #rockylinux

Security Bug du jour: CVE-2026-98432

We head towards non-stop patching.

#LinuxKernel-Lücke mit höchster #Risikostufe von #Claude gefunden.

Eine kritische #Sicherheitslücke im #TCP-Stack des #Linux_Kernels sorgt für Handlungsbedarf bei Linux Distrtros und Admins. Die als CVE-2026-98432 geführte Schwachstelle erhält vom Kernel-Team einen #CVSS-Wert von 9,8. Während die Kernel Entwickler die Sache dringlich erachten, stufen einige Distros die Kritikalität geringer ein.

Besondere Aufmerksamkeit erhielt die Lücke, nachdem Anthropic am 27. Oktober demonstrierte, dass das #KI-Modell Claude einen funktionierenden Exploit entwickeln konnte. Unter bestimmten Voraussetzungen soll ein entfernter Angreifer ohne Zugangsdaten Befehle mit Root-Rechten auf einem Server ausführen können. Voraussetzung ist laut Anthropic ein aktivierter Multipath-TCP-Listener ( #MPTCP ), über den mehrere Netzwerkpfade für eine Verbindung genutzt werden können.

https://fosstopia.de/linux-kernel-lucke-claude/

Anthropic says Claude built a remote root exploit for Linux CVE-2026-98432. It targeted servers with multipath TCP listeners, no login required.

Upstream is patched, but as of Oct. 29, Ubuntu and RHEL still had no fixed packages. Debian and others had shipped fixes.

Admins: check vendor advisories and prioritize exposed systems.

https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

#Linux #OpenSource #CyberSecurity

Ope. I guess there are patches to be had today. MPTCP vulnerability with a CVSS rating of 9.8. #Linux #Cybersecurity #Debian #Ubuntu

https://www.cve.org/CVERecord?id=CVE-2026-98432
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

@bitsundso Jetzt hab’ ich grad die “endlich kein PHP mehr, nur noch go”-Feierrede gehört, und jetzt CVE-2026-98432, und go macht per default multipath. Schon gemein, diese neue Welt 🤪

I'm tired, boss.

https://nvd.nist.gov/vuln/detail/cve-2026-98432

related to patching #CVE202698432, we're going to migrate our #DeltaChat server back on-prem from Flokinet, so please expect ~5 minutes of downtime during the DNS migration and data transfer

EDIT: delta.disobey.net has been migrated and patched, downtime was less than two minutes. WAF (port 443) data is now also reporting to security.disobey.net

PSA: Patch your servers for CVE-2026-98432.

CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.

My Debian machines already had the patched kernel installed, but was still waiting for a reboot.

⚠️ Linode Status - Customer Security Advisory: CVE-2026-98432

https://status.linode.com/incidents/nt58zhx3pmgm

#linode #cybersecurity

Just set up DKIM, SPF and DMARC. Hope I did it right.

Also, I updated linux stuff on some servers to try protect them against the security vulnerability announced this week in the Linux kernel (CVE-2026-98432).

So many tech things.

(this is a technical and kinda niche post, sorry about that).

Actually I need to read this better - I'm not sure if the options here are from the wire (headers) or from the application layer setting up the socket (setsockopt).

If the latter, they can all be blocked with seccomp filters. Which is not a solution for devices you don't have root/control-over-boot on. But... I guess you can use CVE-2026-98432 and now you do have root. 🤷 😈

🤘🐧 Si vous cherchez une bonne bande-son pour rester concentrés pendant que vous passez toutes vos box Linux en revue à cause de https://vulnerability.circl.lu/vuln/CVE-2026-98432 … tout en méditant sur le sens de la vie et

sudo apt update && sudo apt upgrade

( sudo sysctl -w net.mptcp.enabled=0 Moins de MPTCP, mais toujours besoin de patcher )

🔥 Le nouvel album d’Inekt – Valýre est parfait !

Du bon (#black) #folk / #ambient/ #experimental / #noise pour accompagner vos journée de triage.
👇
https://inekt.bandcamp.com/album/val-re

#Linux #MPTCP #Infosec #Metalheads #KernelPanic #HeadbangAndPatch #bandcamp

Current state: shift-reloading https://ubuntu.com/security/CVE-2026-98432#status until 26.04 and 24.04 are green...

#ubuntu 14days with no fix, what does HIGH/Critical even mean at that Point https://ubuntu.com/security/CVE-2026-98432

LINODE Customer Security Advisory: CVE-2026-98432 https://status.linode.com/incidents/nt58zhx3pmgm

"Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel.”

Worst. Month. Ever.

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

A flaw in the Linux kernel’s TCP code, tracked as CVE-2026-98432 and rated CVSS 9.8, affects Ubuntu, Red Hat Enterprise Linux and other distributions, The Hacker News reports. Anthropic said on October 27 that its AI model wrote an exploit using the flaw to let a remote attacker with no credentials run commands as root on Linux servers. https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Lazy web why did it take 2 weeks for people to care about https://github.com/CVEProject/cvelistV5/commits/main/cves/2026/98xxx/CVE-2026-98432.json
?

na schon im Wochenende? https://www.cve.org/CVERecord?id=CVE-2026-98432

I was a bit worried hearing today about the serious MPTCP vulnerability CVE-2026-98432, but if you are running the latest Debian kernel, you are safe.

https://security-tracker.debian.org/tracker/CVE-2026-98432

#linux #Debian #mptcp #CVE202698432

Go programs are vulnerable to CVE-2026-98432 (Linux RCE) https://groups.google.com/g/golang-announce/c/PCoQcdxoScw?pli=1

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

CISA on Thursday added two actively exploited flaws to its Known Exploited Vulnerabilities catalog, The Hacker News reports: a GitLab remote code execution flaw, CVE-2026-97229, rated CVSS 10.0, and a Cisco firewall denial-of-service flaw. Both flaws were added citing evidence of active exploitation. https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

GitLab CE/EE, CVE-2026-97229 (CVSS 10.0): integer overflow nel compilatore di regex CI/CD, RCE non autenticata con una regex costruita ad hoc nella configurazione. CISA l'ha aggiunta alla KEV il 29/10 (deadline FCEB 01/11). Alpine Linux ha visto tentativi il 20-21/10 su istanza non patchata: nessuna prova di successo ma non esclusa, istanza ricostruita. Fix: 19.2.8, 19.3.4, 19.4.2.

https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

#cybersecurity #infosec #GitLab

CVE-2026-118539 Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

This vulnerability is being actively exploited in the wild.

https://www.drupal.org/sa-contrib-2026-254

#drupal #CVE #eitw

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal has warned that threat actors are exploiting a highly critical security flaw in its Commerce Core component, The Hacker News reports. The vulnerability, tracked as CVE-2026-118539, is a missing-authorization flaw affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html

Drupal has warned that threat actors are actively exploiting a highly critical security flaw in its Commerce Core component, tracked as CVE-2026-118539.

The missing authorization vulnerability affects Commerce Core versions from 0.0.0 to 2.41 and 3.0.0 to 3.3.13, impacting shopping carts and checkout forms.

Users of 3.x versions are advised to upgrade to 3.3.13, while earlier versions should update to 8.x-2.41.

https://en.hacks.gr/proeidopoiisi-apo-to-drupal-gia-epitheseis-se-prostheto-ilektronikon-katastimaton/

#Drupal #Vulnerability #CommerceCore #WebSecurity

🚨 TeamViewer flaw lets remote hosts attack the computers controlling them

CVE-2026-111585 allows a malicious or compromised host to crash the TeamViewer client used to control it and, depending on the viewer’s operating system, potentially execute arbitrary code.

The vulnerability is triggered after a user establishes a remote-control session. A manipulated screen-size value causes an integer overflow, resulting in memory being written outside its allocated buffer.
⠀
• CVSS: 8.8
• Affected: TeamViewer Full Client on Windows, macOS and Linux, Windows Portable and Android Remote Control before 15.83
• Fixed: TeamViewer 15.83 or later
• Exploited: No known attacks

Researchers demonstrated code execution against a Windows viewer, although the proof required part of the attack data to be supplied locally and was not a fully remote exploit.

TeamViewer has provided no workaround. Users should update immediately.

Source: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

An integer overflow in TeamViewer, tracked as CVE-2026-111585, could let a malicious host execute arbitrary code on a support technician’s machine, SecurityWeek reports. The vulnerability puts the viewer’s system at risk during a support session. https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/

TeamViewer has released version 15.83 to address a high-severity vulnerability tracked as CVE-2026-111585.

The flaw allowed a controlled remote host to attack the viewer computer due to a memory overflow triggered during screen size communication.

It affects TeamViewer Full Client across Windows, Linux, macOS, Portable edition, and the Android app in versions prior to 15.83.

https://en.hacks.gr/i-teamviewer-diorthonei-keno-asfaleias-poy-epetrepe-ston-apomakrysmeno-ypologisti-na-epitethei-se-ayton-poy-syndethike/

#TeamViewer #CVE2026111585 #Vulnerability #Patch

TeamViewer CVE-2026-111585: Integer Overflow Turns the Remote Host Against the Technician

https://thecybersecguru.com/exploits/teamviewer-cve-2026-111585-integer-overflow-heap-corruption/

Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497) #devopsish https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497

📣 Exclusive exploit for #Node2Shell, now available in Pentest-Tools.com.

CISA added CVE-2026-111497 to the KEV catalog after confirmed exploitation in the wild. The Brotli decoder flaw in Node.js, Bun, and Envoy lets unauthenticated attackers run code on the vulnerable server.

With Sniper: Auto-Exploiter, you can confirm which services are actually exploitable, with proof (like in our example 👇), then validate the patch and rule out residual exposure across multiple assets.

KEV status means “patch today,” and validation tells you which services to fix first. The exploit is part of the Exploit plan.

⚡ Vulnerability details: https://pentest-tools.com/vulnerabilities-exploits/node2shell-brotli-decoder-remote-code-execution_29896
📦 Exploit plan: https://pentest-tools.com/pricing

#offensivesecurity #infosec

CVE-2026-111497: CRITICAL buffer overflow in Keycloak Brotli decoder (CVSS 9.8) impacts <26.4.2-r4, <26.7.5-r3. Risk: remote code execution. Update to patched versions ASAP. https://radar.offseq.com/threat/keycloak-buffer-overflow-vulnerability-in-the-brotli-decoder-cdecdecode-cve-2026-111497-8960db3ac889f67b #OffSeq #Keycloak #Vuln #CVE2026111497

lol. lmao.

https://nvd.nist.gov/vuln/detail/cve-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

Yesterday was WS_FTP. Today is vsftpd. What fucking years is this?

https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket

https://nvd.nist.gov/vuln/detail/cve-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

CVE-2026-119568: CRITICAL auth bypass in vsftpd ≤3.0.5. Attackers sharing a victim's IP can hijack FTPS data connections via resumed TLS session ticket. Restrict FTPS to trusted IPs & monitor AUTH TLS. Patch unconfirmed. https://radar.offseq.com/threat/cve-2026-119568-improper-verification-of-source-of-a-communication-channel-in-vsftpd-63d53552c699c224 #OffSeq #vsftpd #CVE2026119568

📰 Cisco Patches Actively Exploited Zero-Day Crashing Firewalls

Cisco patches actively exploited zero-day (CVE-2026-76418) in ASA & FTD firewalls. Unauthenticated remote attackers can cause a DoS condition by crashing devices. Patches are available now. #Cisco #ZeroDay #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/cisco-patches-actively-exploited-firewall-zero-day-cve-2026-76418/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

New in the known-exploited catalogue: CVE-2026-76418. Exploited in the wild — the only phrase in this field that still means exactly what it says.

Patch the edge appliance. It is always the edge appliance.

#KEV #vulnerability

A critical 16-year-old UEFI firmware vulnerability (CVE-2026-97631) in TianoCore EDK II allows pre-boot code execution. Learn how to protect your servers.

#UEFI #CyberSecurity #CVE202697631 #TianoCore #InfoSec

https://dailytechnow.com/uefi-firmware-vulnerability-cve-2026-97631/

Trust problems this week: a backdoor in the official Claude Code extension bundle, the eMudhra CAs macOS kept trusting, and a 16 year old EDK2 PXE bug.

🔒 Claude Code for VS Code 2.1.312/2.1.313: SSH backdoor
🛠 CVE-2026-97631: ring 0 code during PXE boot
🧠 Gemini 4 Carbon, speech in Ollama
💾 Alpine Linux on a Lenovo Smart Clock
📻 FalconSDR and the ATS Mini

https://www.underkube.com/2026-10-31-what-edu-is-reading-this-week-oct-25-31-2026/

#linux #security #ai #homelab

This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump

Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

UEFI network boot bug in most servers

Speaking of broken embargoes, Ars Technica reports on CVE-2026-97631, a CVSS 9.5 code execution bug in TianoCore EDK II, the open source codebase which nearly every firmware vendor builds on. That includes AMI, Insyde, Phoenix, and Microsoft’s own Project Mu fork.

UEFI is the current iteration of what we knew as the PC BIOS: the firmware that runs before your operating system, initializes the hardware, and hands off to the bootloader. It’s also where Secure Boot starts its chain of trust, and where the TPM gets set up. Code running in UEFI runs before any of the operating system’s defenses exist, which makes it extremely attractive to attackers. The Preboot eXecution Environment (PXE) is the UEFI feature that lets a machine boot from an image downloaded over the network, which is common in data centers and labs with large numbers of identical machines.

The bug is a 16-year-old buffer overflow in how the PXE driver stores ICMP error messages: it copies incoming errors into a fixed 504-byte buffer without properly checking the length. An attacker who can send a packet to the machine while it’s network booting can overwrite adjacent memory and, if they know the specific firmware build, run code at the highest privilege level before Secure Boot ever gets a say. Buffer overflows are nothing new, in fact they’re one of the oldest bug classes turned into exploits, but most operating systems today offer protections to reduce the severity.

The pre-boot environment of UEFI has no such niceties, making the attack simple and completely effective. HD Moore told Ars it could be used to break disk encryption for an attacker with short-term network access, and that it will likely be a “forever” bug living on in out-of-support systems. If this sounds familiar, it’s because PixieFail found a similar family of PXE bugs in the same EDK II network code in 2024, and, as Ars notes, the fuzzing projects that followed missed this one.

The disclosure was supposed to wait until January, but AMI published a pull request with the fix last month, and once the researchers noticed, TianoCore had little choice but to publish an advisory. If your machines boot only from local disks, you’re not affected, and that covers most home and small office systems. If you do use network boot, check with your firmware vendor, and consider turning off PXE booting where you don’t need it. Fortunately, this one is largely irrelevant for home users unless your network somehow gives direct access from the Internet to a server pre-boot environment, but it’s got potential to be a real issue for server hardware.

Certificate authority fallout continues

Last week we covered the eMudhra intermediate certificates whose private keys turned out to be tiny integers. This week, eMudhra announced that it is exiting the global SSL/TLS certificate business entirely. The press release insists the company “handled the recent incident diligently”, that its infrastructure was never compromised, and that TLS was only about 1% of revenue anyhow, but that “the level of social media amplification around this incident has brought scrutiny that is out of proportion.” Having your keys guessable by anyone with a few minutes of free time will do that.

Meanwhile, GoDaddy has self-reported to Mozilla that it couldn’t meet the deadline to revoke 404,607 certificates that didn’t match its own published certificate policies. The rules browsers and CAs agree to, the CA/Browser Forum “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.

Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.

Tailscale wormability

Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.

Erica Windisch of Cyberdione Labs has published a report called Tailworm detailing a series of findings in Tailscale and headscale. The most serious is in Tailscale SSH, which runs as root: socket forwarding requests are handled with root privileges and are subject to race conditions, letting an ordinary user with SSH access to a device replace or connect to privileged sockets (like the Docker socket or the init system) and gain root. Combined with capturing the keys used to enroll new devices, Windisch reports that a single compromised device could spread automatically to every device the access policy allows, at under a second per hop, with no passwords or stolen keys required. She also found an experimental app connector feature that can be used to reach destinations the network policy never allowed, including cloud metadata services that hand out credentials. And to top it all off, Windisch discovered unauthenticated memory exhaustion attacks against internet-facing headscale servers.

Notably, the researchers didn’t follow coordinated disclosure, arguing that “infrastructure is vulnerable today” and that rapid awareness will speed up fixes. Whether you agree with that or not (see the first story this week), the mitigations are practical: use per-device access rules for SSH rather than broad tag or group rules, disable SSH forwarding where you can, and expire node keys on servers. Fortunately it doesn’t seem like the bug is vulnerable to the Internet at large. A compromised device inside your Tailscale network could reach other devices in your network, but it won’t melt the Internet, yet.

A One-Byte Typo in Embedded TLS

FoxIO is back with three TLS bugs in GoAhead, a small embedded web server that runs the management interface on an enormous number of devices: routers, printers, firewalls, and industrial controllers from vendors including Palo Alto Networks, D-Link, HP, Canon, Honeywell, Siemens, and Rockwell.

The most severe (CVE-2026-115881, CVSS 9.1) is that GoAhead’s OpenSSL integration loads the configured certificate revocation list, but never actually turns on revocation checking, so revoked client certificates keep working, but the most fun is in the Mbed TLS integration: a copy-and-paste error passes the size of the one-byte Diffie-Hellman generator as the size of the 256-byte prime modulus. The result is a “2048-bit” key exchange using a prime of 255, which leaves exactly eight possible shared secrets. An eavesdropper can simply try all eight. (Clients like OpenSSL reject the broken parameters, but more permissive embedded clients happily accept them.) A third bug (CVE-2026-115884) lets an overly long certificate chain bypass a depth check when built against older LibreSSL. Feels eerily similar to the eMudhra one-number password, and the timing is spooky.

It’s a good reminder of Apple’s infamous “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?

Volt Typhoon’s Chain of Routers

Kim Zetter reports on new research from Lumen’s Black Lotus Labs into how Volt Typhoon, the Chinese state hacking group that US officials say has been “pre-positioning” inside American critical infrastructure, actually gets in and out.

Attackers rarely connect to a target directly from their own systems. Instead, they bounce through chains of compromised devices, often called “ORB networks” (operational relay boxes), so the traffic appears to come from somewhere innocuous. The sudden burst of news about Residential Proxy Network tools in the Spring and early Summer of 2026 could have been related: proxy networks provide a way to appear inside a country, or state, or even specific city.

Volt Typhoon’s version, which the researchers named Silent Train, is unusually disciplined: each chain of compromised servers, home routers, and IoT devices is assembled and used for a single intrusion, then dismantled and wiped. All this often in under two minutes, suggesting automation. Devices outside the US are never the same models as devices inside the US, presumably so no single vendor’s telemetry can see the whole chain. Targets included government agencies, defense contractors, telecoms, emergency communications, satellite operators, and energy, water, and rail operators, clustered in Hawaii, California, and Texas.

The chains included more than 27 classes of devices, including TP-Link and Netgear consumer routers, with a new device type added about once a month. Most of these were compromised through known, already-patched vulnerabilities. If you’ve got an old router or IoT gadget that hasn’t seen a firmware update in years, it may well have spent some time as a train car. Update it, retire it, or upgrade it with OpenWRT or another modern embedded distribution.

Discover-Tech and Starlink

Last week we talked about Citizen Lab’s research showing the Israeli ad-tech company Discover-Tech used targeted ads to deliver Candiru spyware. Gizmodo reports that the same company appears to be the top bidder for ad impressions on Starlink connections in 105 countries.

Research from TrendAI found an entity it labeled SHADOW-EARTH-79 won about 12% of ads shown to Starlink users, compared to a 3% baseline elsewhere, and over 80% of Starlink ad wins in Argentina, the Philippines, and Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, markets where, as TrendAI put it, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Reuters later reported that SHADOW-EARTH-79 was TrendAI’s internal name for Discover-Tech. The company spent about $109,000 on bids over four months with no recorded conversions, which is not how a business that wants to sell things behaves.

Real-time ad bidding shares device and location details with every bidder, whether they win the auction or not. Users of satellite internet are exactly who someone would want to locate in places where it’s restricted or politically sensitive, and the ad market will happily tell you where they are. Ad blockers continue to look less like a convenience and more like a necessity.

Quad9 leaves France

Quad9, the free, privacy-focused DNS resolver run by a Swiss nonprofit, is withdrawing service from France on November 24th, after losing a court case brought by the sports broadcaster beIN.

A DNS resolver turns names like “hackaday.com” into IP addresses. Quad9 doesn’t host any content, but the court ordered it to block resolution of domains beIN says are pirating its broadcasts, for users in France. Quad9 says it can’t comply: it doesn’t track who its users are or where they are, and the only alternatives are blocking the domains for the entire world, applying French law globally, or trying to geolocate users by IP address. It tried geolocation in a similar case brought by Sony in Germany, and was fined for contempt when Sony’s lawyers simply used a VPN. (Quad9 eventually won that case, after several years and six figures of legal costs.) With about 20 similar cases pending in France, it decided to leave.

As the EFF points out, none of this removes a single infringing website from the Internet; it just takes a malware-blocking privacy service away from French users, who can switch to another resolver in about thirty seconds. Making infrastructure providers act as copyright enforcement is a tool that’s very easy to repurpose for blocking other things. A net loss for Internet-savvy users in France, but kudos to Quad9 for standing up for principles.

Crime Stoppers Tips Leaked

The CBC has analyzed data stolen from P3, the tip management platform used by Crime Stoppers programs internationally, and found more than 1.5 million Canadian tips from the past 25 years. More than half contained personal information, including addresses, phone numbers, license plates, and banking details for cash rewards. Over 4,300 tipsters identified themselves by name, and even tips flagged by staff as having exposed the tipster were stored unredacted.

The data was stolen in March by a hacktivist group that said it wanted to disprove the platform’s claims of being “anonymous” and “secure”. After the CBC’s report, Toronto Crime Stoppers paused its program and at least six Ontario police services suspended their partnerships. Toronto’s chair, Sean Sportun, told the CBC, “It clearly seems that you have more data than us, which is a little concerning,” saying the platform’s owner, Navigate360, never provided the text of the stolen tips despite months of requests.

The most fundamental problem here may be retention. A system that promises anonymity kept 25 years of tips, including closed cases, in one place. The safest data is data that you don’t have.

DHS Employee Directory Leaked

WIRED reports that Distributed Denial of Secrets has published records on more than 41,000 Department of Homeland Security employees and contractors, including ICE and CBP. DDoSecrets says the data came from DHS’s Okta login system; Okta told WIRED it has “no evidence our data or systems were compromised.”

Beyond names, emails, and phone numbers, the leak includes over 55,000 access permission groups, which map out which people have access to which internal systems, including groups referencing certified undercover operations, wiretap programs, phone forensics tools, and AI services. A security expert quoted by WIRED called it “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS”. Following ShinyHunters’ claimed theft of personal data on nearly every FBI employee, it’s been a rough autumn for federal identity systems.

FEC filing system knocked offline

The US Federal Election Commission took its electronic filing system offline a week before the November 3rd elections, after what an FEC filing officer described in an email seen by Reuters as “a bad actor attempting to breach FEC systems.”

The FEC doesn’t run elections, so there’s no impact on voting, but the outage blocks the 24- and 48-hour spending reports that show how much super PACs and other groups are spending on specific races in the final days. With the midterms already the most expensive US election ever, that’s a meaningful blind spot, at exactly the moment it matters most.

AI-orchestrated Bank Attacks

Last week we covered an attacker using a swarm of AI agents to break into websites. This week, Straiker published an analysis of CARLIY0S, a system it says the long-running CyberCartel group used to attack more than 400 financial targets across Latin America. CARLIY0S was built on PentAGI, an open source automated penetration testing framework, and assigned different jobs to different commercial AI models, including Kimi, Grok, and Claude. Four Claude-based roles were set up to evaluate attack options, debate targets, and return a decision through a designated “arbiter”.

According to Straiker, the group got around model safety policies by framing requests as authorized red team work or capture-the-flag exercises, and even instructed the models to never output the group’s name to frustrate attribution. Straiker says it accessed the group’s stolen credential database, with thousands of records including API keys, database credentials, JWT signing keys, and backdoors. Anthropic has since revoked the credential the group used to reach Claude, and xAI is investigating.

The “it’s just a pentesting tool” defense is going to get a lot of use in the coming years. Automated offensive frameworks are genuinely useful for defenders, and unfortunately also genuinely useful for anyone else who can convince the model they’re a defender.

Bulletproof Hosting Seized

The DOJ has seized the domain of Virtualine, a “bulletproof” hosting provider. Bulletproof hosts sell servers and domains to criminals with the explicit promise of ignoring abuse complaints and law enforcement requests, and they’re the plumbing behind a lot of phishing, malware, and spam.

Virtualine wasn’t subtle about it. According to the DOJ, it advertised on cybercrime forums that customers could use it “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others)”, offered an “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and bragged that it “ignored more abuse than your last three therapists.” Despite a supposed ban on child abuse material, it continued hosting a site selling exactly that after repeated notices from law enforcement in multiple countries. Marketing copy is evidence, it turns out.

hackaday.com/2026/10/30/this-w…