[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:linux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"linux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning","rapid-alert","Linux kernel TCP RCE CVE-2026-98432: attackers are scanning now, Red Hat patched, Ubuntu fixes in testing","A critical use-after-free in the Linux kernel's IPv4 TCP code lets remote, unauthenticated attackers run code as root. Rated 9.8. Scanning began on 2 Nov. Red Hat has patched RHEL 8, 9 and 10; Ubuntu's fixes are still in -proposed.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flinux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning-b4529a6f-cover.png","Linux TCP CVE-2026-98432 rapid alert: Running a Linux server on 443? One SYN packet gets root, no login.","Marcus Lenngren","2026-11-04T05:18:56.278+00:00","![Linux TCP CVE-2026-98432 rapid alert: Running a Linux server on 443? One SYN packet gets root, no login.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flinux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning-b4529a6f-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nCVE-2026-98432 is a use-after-free in how the Linux kernel sets up IPv4 TCP connections. One CPU frees the IP options of a new connection while another CPU, handling a repeated SYN packet, still reads them when building a reply. That race lets a remote, unauthenticated attacker run code as root with no login and no user action.\n\nThe bug affects kernel versions 4.4 and later. The CVE record was published on 15 October 2026 and is rated 9.8, critical. Ubuntu's own blog uses the word \"High\" for the same score, so you may see both labels.\n\nThe upstream fix delays the free with kfree_rcu() so readers finish first.\n\nRed Hat has released patched kernels for RHEL 8, 9 and 10. Ubuntu's fixes are still in the opt-in -proposed testing pocket, so many Ubuntu servers remain open for now.\n\n## Timeline\n\n- 15 Oct 2026: CVE-2026-98432 published, rated 9.8.\n- 27 Oct 2026: Anthropic's Frontier Red Team reports an unreleased Claude model wrote a working exploit after one prompt. In the lab the leak took 48 minutes and the shell five more. The exploit has not been released and this was a lab test, not a real incident.\n- 30 Oct 2026: A scan found about 2,102,043 servers reachable over MPTCP on port 443, about 762,774 confirmed over TLS.\n- 2 Nov 2026: Marcus Hutchins reports residential proxies and Russia-based VPN servers probing port 443 with MPTCP connections, which he strongly suspects targets this bug.\n- 3 Nov 2026: Red Hat ships fixes. Ubuntu fixes available in -proposed.\n\n## Am I affected?\n\nThe flaw itself is not tied to MPTCP. The MPTCP link comes only from the Anthropic exploit, which targets servers with a multipath TCP listener.\n\nMany kernels enable MPTCP by default, including Debian and others. Go 1.24 and later bind MPTCP sockets when the kernel allows it, so Go-based tools such as Caddy create the needed listener.\n\nUbuntu fixed versions: Jammy (22.04) 5.15.0-203.213, Noble (24.04) 6.8.0-149.149, Resolute (26.04) 7.0.0-43.43, Stonking (26.10) 7.3.0-10.10 (already in updates). Trusty (14.04) is not affected. Xenial, Bionic and Focal fixes are still pending. Focal and Bionic need Ubuntu Pro ESM; Xenial needs the Legacy add-on.\n\n## What to do now\n\n1. Run `uname -r` and compare with the fixed versions above.\n2. On RHEL 8, 9 or 10, apply Red Hat's patched kernel and reboot.\n3. On supported Ubuntu, you can install the -proposed kernel today if you run your own acceptance tests. Packages in -proposed are not upgraded by default, so you must name the pocket. Reboot afterward.\n4. List MPTCP listeners with `sudo ss -Mlnp` to see your exposure.\n5. For hosts you cannot patch yet, Ubuntu's tracker gives an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.\n\n## How to hunt\n\n- Look for inbound MPTCP connections to port 443 from residential proxy ranges or Russia-based VPN servers, dated from 2 Nov onward. Normal scanners do not use MPTCP by default.\n- Enumerate processes holding MPTCP sockets with `sudo ss -Mlnp` and check which services expose them.\n- Note that a lost race only fails the handshake and does not crash the host, so failed attempts leave little trace and attackers can retry.\n\n## What does not help\n\n- Setting `net.mptcp.enabled=0` does not close sockets that are already open, so affected apps must be restarted for it to take effect.\n- Confirming a host is reachable over MPTCP proves exposure only, not that the kernel is unpatched. Updates are the only proper fix.\n\n## Sources\n\n- [Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes](https:\u002F\u002Fcybersecuritynews.com\u002Flinux-kernel-rce-flaw-ubuntu-fixes\u002F), Cyber Security News, 3 Nov\n- [Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fred-hat-patches-98-rated-linux-tcp-rce.html), The Hacker News, 3 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]