learned programming when you had to copy a 12 year old stackoverflow code snippet to make things work. sometimes i play games too. sometimes too often.
Joined September 2021
- Tweets1.9K
- Following730
- Followers327
- Likes3.7K
THEY DID IT!
Fixes are available for CVE-2026-109518, a High severity vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The CVE has a CVSS 4.0 score of 7.7.
Remediation details are available on our blog.
ubuntu.com/blog/apt-vulnerab…
CVE-2026-98432 was rated 9.8 by the kernel team. debian fixed it october 16th, redhat 2 days ago but ubuntu still hasnt done it.
its terrible considering ubuntu runs on nearly 10% of servers worldwide according to w3techs.
Close every port you don't need on the internet
and install the kernel update the moment it reaches regular updates, then reboot.
youtube.com/shorts/d9gh4l1yW…
Yeah this is what happened last week in security:
TLDR: Discord, Keystone, PHP2Shell (again), Binance Crypto Heist, A Linux Bug rated 9.8, A trojanized Claude Code Extension inside Cursors Marketplace, France trying to tax every Gigabyte, oh and Polymarket that sold positions
heres a video to sum it up as well that i made:
youtube.com/shorts/J5Pel366N…
companies need to be aware that opening something on the internet without a vpn access could lead to things like this.
cybersecuritynews.com/superm…
ALvantages retweeted
regarding cve-2026-98432: it is a uaf in tcp, mptcp is needed to make the race win and to get the leak and write.
the impact of the bug is bad, its essentially go2shell, caddy2shell etc. go 1.24+ servers are all vulnerable, because mptcp is enabled by default.
BUT:
1. It is extremely hard to win the race reliably, anthropic said it took 40 mins for them to get leak and defeat kaslr
2. It is probably hard to exploit in practice. most routers, lbs and isps drop ip options, without that header you can't race at all, so realistically only a same network attacker can try, which is pretty common in sandbox infra
my mythos worked on this for last 3 days burned ~$2k and couldn't build a reliable poc that can be sprayable. gpt-5.6 sol als exhausted my subscription and couldn't even get a leak.
either anthropic has a unreleased model which is better than their public one or they have a pro exploit dev internally.
A hijacked DebugBear page-speed script sold some Polymarket traders' positions. its insane how quick these things can happen
ALvantages retweeted
ChatGPT in Germany in 2027
Yesterday France announced tax of €0.055 per GB on internet traffic
Today Germany is considering taxing all AI-generated revenue
You will see European countries keep clawing more and more money from foreign companies as they are slowly running out of money themselves to pay for their pensions and welfare state
Add to this the planned wealth taxes and exit taxes on any European who will try to leave (already active in many EU countries)
Europe is running out of money
Readers added context they thought people might want to know
The post inaccurately claims France "announced" a data tax; it was a narrow 11-10 vote on a budget amendment in a near-empty chamber, opposed by the government and far from law. German AI tax ideas remain unadopted ministerial discussions without formal proposals.
stephanelarue.com/taxe-au-gigaoc…
tagesschau.de/inland/ministe…
davemanuel.com/2026/10/30/wha…