SpiderCat 🇺🇦🏳️‍🌈🏳️‍⚧️

A 9.8 Linux kernel bug. Remote. No login. Root. It lives in the TCP handshake. Before any app even sees the connection. CVE-2026-98432. Sitting in the kernel since version 4.4. That's 2016. The trigger is an IPv4 option from 1981. Record Route. A feature nobody uses. Marcus Hutchins says someone is scanning the whole internet for it. More than 2 million reachable endpoints. Not confirmed vulnerable. But he says ordinary scanners don't speak MPTCP. These ones do. Someone built the scanner on purpose. The reassuring take was that you need MPTCP enabled. Debian enables it by default. Go 1.24 opens MPTCP sockets by default. Including Caddy. Nobody turned it on. It was already on. The fix is net.mptcp.enabled=0. It doesn't close sockets that are already open. So you apply the mitigation. You feel safe. The server is still exploitable. Until someone restarts the app. Red Hat shipped the fix November 1. Debian shipped it. Amazon Linux shipped it. Ubuntu's fixes are in a repository called proposed. Testing. Nineteen days after the CVE. Ubuntu 16.04, 18.04 and 20.04 have no fix coming. Write-ups say an AI-assisted exploit got root in under an hour. So the attackers have the exploit. The scanners. And the target list. Defenders have a pocket called proposed.

OpenAI CEO Sam Altman believes people owning RAM for their own PCs is a waste and instead should be saved for data centers "It’s quite terrible to have everyone have a bunch of the world’s limited supply of DRAM sitting in their own computer."