A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now.
Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is already fixed in 7.3.0-10.10, and Trusty (14.04) is not affected. Fixes for Xenial, Bionic and Focal are still pending.
Release
Package
Patch status
Fixed kernel version
Trusty (14.04)
linux
Not affected
Not applicable
Xenial (16.04)
linux
Fix pending
Not yet released
Bionic (18.04)
linux
Fix pending
Not yet released
Focal (20.04)
linux
Fix pending
Not yet released
Jammy (22.04 LTS)
linux
Fix available in -proposed
5.15.0-203.213
Noble (24.04 LTS)
linux
Fix available in -proposed
6.8.0-149.149
Resolute (26.04 LTS)
linux
Fix available in -proposed
7.0.0-43.43
Stonking (26.10)
linux
Fixed
7.3.0-10.10
Canonical runs tests on more than 2,000 certified servers and devices before it moves a kernel to the updates pocket. Teams that run their own acceptance tests can install the early builds today, as described in Canonical’s new SRU strategy for faster CVE fixes.
Ubuntu’s CVE-2026-98432 tracker rates the bug 9.8, which is Critical. Its own blog post calls the same score “High,” so readers may see both labels. The record was published on October 15, 2026.
The bug is a use-after-free. In plain terms, the kernel keeps using a piece of memory after it has already let go of it. One CPU frees the IP options of a new connection. Another CPU, handling a repeated SYN packet, still reads them while building a reply. The upstream fix delays that free with kfree_rcu(), so readers finish first.
Anthropic’s Frontier Red Team shared its research on October 27, 2026. It says an unreleased Claude model wrote a working exploit after one first prompt. The exploit targets Linux servers with a multipath TCP (MPTCP) listener.
It works in two stages. First, it makes the kernel send back extra bytes that may hold a kernel pointer, which defeats KASLR, a defense that hides where kernel code sits. Second, it overwrites a callback pointer so the kernel runs a payload and ends in a shell command as root.
A lost race only fails the handshake and does not crash the machine, so the attacker can retry. In the test, the leak took 48 minutes, and the shell took five more.
Researcher Marcus Hutchins says his team has seen what looks like threat actors scanning the whole internet for affected systems. In a post on X, he reports that residential proxies and Russia-based VPN servers began probing port 443 with MPTCP connections as of November 2.
Normal scanners do not use MPTCP by default, so he strongly suspects this activity targets CVE-2026-98432. His scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443.
A deeper TLS scan found about 762,774. He says a valid HTTP request is not needed, so the true exposure is likely closer to 2.1 million. These counts show exposure only and do not prove the kernels are unpatched.
There is no public remote code execution exploit yet. Several denial-of-service proofs-of-concept do exist, and they give attackers a starting point.
Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore…
Some people assumed MPTCP listeners were rare. Hutchins points out that Debian and several other kernels enable MPTCP by default. Go 1.24 and later also bind MPTCP sockets when the kernel allows it, so tools built on Go, such as Caddy, create the needed listener.
Ubuntu emphasizes that the flaw itself is not tied to MPTCP, and the MPTCP link comes only from the Anthropic exploit. Ubuntu’s security team says updates are the only proper fix. Hutchins adds that setting net.mptcp.enabled=0 does not close sockets that are already open, so those apps must restart. You can list MPTCP listeners with sudo ss -Mlnp.
For Admins
Run uname -r and compare the result with the fixed versions above. Ubuntu’s guide to enabling the -proposed pocket explains how to pull in the new kernel, and a reboot is needed afterward. Packages in -proposed are not chosen for upgrade by default, so you must name the pocket when you install.
For hosts that cannot update yet, Ubuntu’s tracker lists an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.
Ubuntu 20.04 LTS and older need Ubuntu Pro. Focal and Bionic fall under Expanded Security Maintenance, while Xenial and Trusty need the Legacy add-on. Ubuntu Pro is free for up to five machines.
Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution. The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel. Critical […]
Details and a Linux kernel vulnerability PoC exploit are public for CVE-2026-31419. Patch this high-severity flaw to prevent local privilege escalation.
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. [...]
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. [...]
A critical Linux kernel CVE-2026-98432 flaw enables remote root execution via MPTCP race conditions, impacting multiple distributions including Ubuntu.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.
CVE-2026-46300 (CVSS score of 2.7) Linux Kernel Missing Initialization of a Variable Vulnerability
In July, Broadcom released patches to address five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion, including CVE-2026-41709. The vulnerability in VMware ESX is caused by insufficient logging. A malicious user with administrator privileges could perform certain operations on the affected system without those actions being recorded in the logs.
This could allow an attacker to hide specific activities and make it harder for security teams to detect suspicious behavior, investigate incidents, and determine what happened. The flaw does not itself grant administrator privileges; the attacker must already have them.
According to CrowdStrike’s 2026 Legal Threat Landscape Report, which said the China-linked threat actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon and VerdantBamboo) exploited CVE-2026-41709 as a zero-day in early 2026 to reduce the visibility of its activities in audit logs.
Warp Panda targets internet-facing edge devices by exploiting zero-day vulnerabilities and deploying custom malware to maintain persistent, covert access. The group also attempts to evade detection by bypassing audit logging, stealing cloud session tokens and registering unauthorized multi-factor authentication (MFA) devices.
The second flaw added to the catalog is CVE-2026-46300, also known as Fragnesia, could let local attackers gain root access through page cache corruption.
The flaw affects the XFRM ESP-in-TCP subsystem and could allow local attackers to gain full root access by corrupting the kernel page cache.
Security experts warn that the issue is dangerous because attackers with low privileges can modify read-only files in memory and take complete control of vulnerable systems. The vulnerability was discovered by William Bowling of the V12 security team, while Wiz published a detailed technical analysis.
“The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache.” reads the report published by Wiz. “Attackers can then achieve root privileges through deterministic page-cache corruption.”
Fragnesia shares similarities with earlier Linux privilege escalation flaws, such as Dirty Frag and Copy Fail. According to researchers, the bug can reliably provide root access on major Linux distributions without requiring race conditions or complicated timing attacks.
Microsoft releases emergency .NET updates to fix a Brotli memory flaw and Linux privilege escalation, while correcting two incomplete October security patches.
Kali Linux 2026.3 has been officially released, bringing six new security tools, updated image-building scripts, KDE Plasma 6.7, and major NetHunter improvements. Announced on October 26, 2026, this third release of the year includes 126 package updates and upgrades the Linux kernel from version 6.19 to 7.1.5.kali. This release focuses on customization, making it easier […]
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211. The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure. Attribution remains unresolved: under Unit 42’s attribution framework, the UNK designation means researchers have not established […]
Entrar
