International Cyber Digest(@IntCyberDigest):‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit. The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10. The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default. The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable. Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10. Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.

International Cyber Digest@IntCyberDigest

2026.11.01 19:57

‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit. The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10. The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default. The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable. Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10. Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.