Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.

while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.

Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.

The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.

You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp

On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.

Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.

As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.

Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.

CVE-2026-98432 means that setting

net.mptcp.enabled = 0

in /etc/sysctl.conf is a very good idea. Then reboot to quash any existing sockets.

IPFire releases Core Update 205 to address CVE-2026-98432, a serious use-after-free flaw in the Linux kernel's TCP stack.
https://linuxiac.com/ipfire-2-29-core-update-205-fixes-serious-linux-tcp-vulnerability/

#opensource

Reaffirming its commitment to enterprise-grade stability, Canonical announced Monday that CVE-2026-98432, the critical use-after-free in the Linux kernel's IPv4 TCP code, will receive a full 10 years of Long-Term Support on every Ubuntu release it affects.

"Other distros will patch something out from under you in 48 hours, and suddenly your whole threat model is wrong. Canonical is giving CIOs a vulnerability they can actually budget for."

https://bloatberg.com/2026/11/02/ubuntu-canonical-extends-long-term-support-for-cve-2026-98432-through-2036

#Ubuntu #Canonical #Linux

I'm not trying to rush you or anything, #Ubuntu, but could we maybe get a patch sometime this month?

https://ubuntu.com/security/CVE-2026-98432

I am having a hard time finding that CVE-2026-98432 [1] is still not fixed in #ubuntu #linux [2] Can someone explain?

[1] www.cve.org/CVERecord?id=CVE-2026-98432
[2] thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

❯ ssh router /system/package/update/print
            channel: stable
               mode: https
  check-certificate: yes
         ip-version: auto
  installed-version: 7.25
     latest-version: 7.25.1
             status: New version is available

❯

TrueNAS still has no projected release date for a CVE-2026-98432 fix. :/

Ubuntu continues to work on the the fix for CVE-2026-98432.

a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code (CVSS 9.8 score)

Debian released the fix on Oct 16.

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Security

If we can’t rely on an open port being safe on the internet without the risk of exploitation (CVE-2026-98432), it’s time for us to add another layer of security. Namely, port knocking, or pre-handshake authentication.

And this one is relatively easy to do with what we already have.

Port knocking is an older concept, whereby you monitor logs for a known pattern in attempted connections, then follow up by allowing a connection, or opening a port, for that IP address to connect with a specific service on your machine.

This adds authentication pre-connection, where most vulnerabilities would occur.

You limit access to your tech stack so that anyone in the world can now be treated as if they came from a pre-approved known static IP address.

It’s simple technology, easy to implement, and it removes exploitation a step further away before allowing anyone the chance to communicate with your deeper stack.

Bring port knocking back.

—
And as always: need to secure your agents? Check out what we do at Knostic.

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, CVE-2026-98432, are now available for Red Hat Enterprise Linux 8, 9 and 10, The Hacker News reports. The 9.8-rated flaw can be reached by a remote, unauthenticated attacker; Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date set for a regular update. https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

📰 Critical RCE Flaw in Linux Kernel's TCP Module Affects Servers

A critical RCE vulnerability (CVE-2026-98432) with a 9.8 CVSS score has been found in the Linux kernel's TCP module. Unauthenticated attackers can gain root access on systems with exposed MPTCP listeners. #Linux #Kernel #CyberSecurity #RCE

🔗 https://cyber.netsecops.io/articles/critical-rce-flaw-cve-2026-98432-disclosed-in-linux-kernels-tcp-module/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Ubuntu puts fixes for CVE-2026-98432, a Linux kernel TCP flaw rated CVSS 9.8, in the proposed pocket for 22.04 LTS and newer. Older releases wait.

#CVE202698432 #LinuxKernel #Ubuntu #TCP #RCE #MPTCP #PatchNow #LinuxSecurity

https://securityonline.info/cve-2026-98432-ubuntu-proposed-fix/?utm_source=mastodon&utm_medium=jetpack_social

The IPFire team has released IPFire 2.29 Core Update 205 to address CVE-2026-98432, a serious use-after-free vulnerability located in the Linux kernel's TCP stack.

Due to the nature of the issue, developers urge administrators not to postpone installation until the next regular maintenance window.

This update upgrades the underlying Linux kernel to version 6.18.60 and resolves a separate crash affecting the Broadcom network driver.

A syst…

https://en.hacks.gr/ektakti-enimerosi-asfaleias-apo-to-ipfire-gia-sovaro-provlima-diktyoy/

#IPFire #Linux #Kernel #TCP

Critical Kernel Flaw CVE-2026-98432: How to Patch #Ubuntu #Linux

https://www.ubuntufree.com/linux-kernel-cve-2026-98432-ubuntu-fix/

Arista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now.

#Arista #VeloCloud #LinuxKernel #RCE #CVE2026111497 #CVE202698432 #Cybersecurity #InfoSec

https://securityonline.info/arista-security-vulnerabilities-rce-flaws/?utm_source=mastodon&utm_medium=jetpack_social

A critical 10.0 CVSS Node-RED RCE vulnerability (CVE-2026-58115) is exploited in the wild to deploy Linux bot malware. Secure your exposed instances now.

#NodeRED #RCE #CVE202658115 #Siemens #IoT #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/node-red-rce-vulnerability-cve-2026-58115/?utm_source=mastodon&utm_medium=jetpack_social

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity flaw in Siemens SIMATIC IoT2050 Advanced devices, tracked as CVE-2026-58115 with a CVSS score of 10.0, has come under active exploitation, VulnCheck has found, The Hacker News reports. The missing-authentication flaw could let an unauthenticated remote attacker run arbitrary code on the industrial IoT gateways. https://thehackernews.com/2026/11/attackers-exploit-critical-siemens.html

“If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation,” - VulnCheck researcher Patrick Garrity

https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086

#CVE-2026-58115 #security

A maximum-severity vulnerability in Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED is under active exploitation.

Tracked as CVE-2026-58115 with a CVSS score of 10.0, the issue stems from missing authentication in the Node-RED HTTP interface, allowing unauthenticated remote attackers to execute arbitrary code.

Siemens has released updates in version 4.3.4.1 and later.

https://en.hacks.gr/keno-asfaleias-se-syskeyles-tis-siemens-chrisimopoieitai-se-epitheseis/

#Siemens #NodeRED #IndustrialOS #Vulnerability

Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)

Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation. https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/

A VulnCheck canary has caught the first live exploitation of CVE-2026-58115, an unauthenticated Node-RED admin API flaw with a CVSS score of 10. One HTTP request wires an inject node to an exec node, and the flow downloads and runs a Linux bot. VulnCheck has logged 16 events from one source address.

How many Node-RED instances are still reachable without adminAuth?

https://iottechnews.com/news/node-red-admin-api-flaw-exploited-drop-linux-bots/

#IoT #CyberSecurity #Technology

🚨 More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229

The CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular expression inside a CI/CD configuration.
⠀
• CVSS: 10.0
• Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2
• Fixed: 19.2.8, 19.3.5 and 19.4.2
• Active exploitation: Confirmed
⠀
CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks were detected.

Shadowserver is still tracking more than 1,000 vulnerable internet-facing instances.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11023

A #critical #vulnerability has been identified in #GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the GitLab server. The vulnerability is tracked as CVE-2026-97229 and has been assigned a CVSS v3.1 score of 10.0 (Critical) — the maximum possible severity.

https://ksrc.karenit.net/blog/security-alert/critical-unauthenticated-remote-code-execution-in-gitlab-ce

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin.

CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings.

No known fix. Exploitation attempts observed in the wild.

Full details ↓ https://thehackernews.com/2026/11/attackers-target-unpatched.html

A maximum-severity CVSS 10 vulnerability (CVE-2026-81648) affecting the CryptoPayment Gateway WordPress plugin versions 1.2.1 through 1.2.2 is seeing in-the-wild exploit attempts.

The flaw stems from missing authorization checks on an AJAX endpoint, allowing unauthenticated users to delete arbitrary files, overwrite configurations, and extract stored wallet credentials in cleartext.

There is no patch available, and the plugin wa…

https://en.hacks.gr/epitheseis-se-istoselides-logo-akalyptoy-kenoy-se-gnosto-prostheto/

#WordPress #CVE #Vulnerability #Plugin

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity vulnerability in the CryptoPayment Gateway WordPress plugin, tracked as CVE-2026-81648 with a CVSS score of 10.0, according to Defused Cyber. Successful exploitation could let unauthenticated users delete arbitrary files on the server and extract wallet credentials. https://thehackernews.com/2026/11/attackers-target-unpatched.html

SMS of Death, la vulnerabilità Android che può bloccare le chiamate: rischi e difese

@informatica
Un SMS invisibile può mandare in crash il servizio telefonico di alcuni smartphone Android, interrompendo anche le chiamate di emergenza. La vulnerabilità SMS of Death, identificata come CVE-2026-58882, solleva interrogativi sulla

📰 Android 'SMS of Death' Flaw Allows Zero-Click Remote Device Crash

A proof-of-concept for the Android "SMS of Death" flaw (CVE-2026-58882) is now public. The zero-click exploit can remotely crash phones or block cell service via an invisible text. Update your devices now! #Android #MobileSecurity #DoS

🔗 https://cyber.netsecops.io/articles/android-sms-of-death-flaw-cve-2026-58882-allows-remote-zero-click-dos/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

UWN: A snapshot of what happened this week in Canonical's Ubuntu eco-system. What's happening ? We cite the high impact stuff that over shadows the lil things. Fixed is CVE-2026-112816, Canonical adds back the Ubuntu Core Desktop as a snap only release, 27.04 open for development, linux-firmware-hwe details.

A reminder: Ubuntu Summit 26.10 takes place next week :D

Too:
Circles! activities
Meetings/Reports/Events/ and such

Details: https://ubuntu.com/community/uwn/ubuntu-weekly-newsletter-issue-968
Read, stay informed and enjoy!

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11021

A #critical #authentication #bypass #vulnerability has been identified in Canonical #LXD and MicroCloud. The vulnerability, tracked as CVE-2026-112816, has been assigned a CVSS v4.0 score of 10.0 (Critical) — the maximum possible severity.

https://ksrc.karenit.net/blog/security-alert/critical-authentication-bypass-in-canonical-lxd-https-listener

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

Threat actor Gorbag has been targeting Ukrainian law enforcement, local administrations, and the defense sector since February 2025.

Attacks deploy spear-phishing emails with government-themed lures, macro-enabled Excel spreadsheets delivering VBA payloads, and stealers such as BeautyStealer and GIFTEDCROOK.

Operations also utilized a patched WinRAR vulnerability (CVE-2025-8088) and Prime ReverseShell variants featuring prompt inje…

https://en.hacks.gr/rosiki-omada-chaker-stocheyei-tin-oykrania-me-programmata-klopis-dedomenon/

#Phishing #Malware #WinRAR #Ukraine

The November 2026 Android security update fixes 216 flaws, including zero-click remote code execution bugs CVE-2026-58868 and CVE-2026-58936.

#Android #AndroidSecurity #CVE202658868 #ZeroClick #RCE #MediaTek #PatchNow #MobileSecurity

https://securityonline.info/android-security-update-november-2026/?utm_source=mastodon&utm_medium=jetpack_social

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Rancher CVE-2026-88811 can forward a signed-in user's Rancher session credential or API token to allowlisted third-party hosts through its meta proxy.

Fixed in 2.15.3, 2.14.7, 2.13.11, 2.12.15 and 2.11.19. The vendor recommends upgrading, rotating affected API tokens and invalidating sessions. This is credential exposure, not confirmed remote takeover.

https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

#Cybersecurity #Infosec #CloudSecurity #PatchManagement

SUSE fixed Rancher security vulnerabilities, including Rancher credential leak CVE-2026-88811, an SSRF flaw, and an unauthorized shell bypass. Update now.

#Rancher #Kubernetes #CloudSecurity #CVE202688811 #InfoSec #Cybersecurity #Vulnerability

https://securityonline.info/rancher-security-vulnerabilities-cve-2026-88811/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-77876: OS command injection in Control Web Panel (<1.16) – CRITICAL severity (CVSS 9.3). Remote code execution possible via unescaped POST input. Restrict access & monitor for acc=deletedp abuse. https://radar.offseq.com/threat/cve-2026-77876-cwe-78-os-command-injection-in-control-web-panel-ec9d2cc2044f7ecc #OffSeq #CVE #infosec #vuln

🚨 Rapid Response: Critical Control Web Panel command injection (CVE-2026-77876, CVSS 9.8).

Censys identified 443,734 Internet-exposed web properties running CWP. Versions cannot be confirmed, so not all are necessarily vulnerable.

Read the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-77876/

#Cybersecurity #CensysARC #Vulnerability #CVE202677876 #CommandInjection #ControlWebPanel #AttackSurfaceManagement #ThreatIntelligence #VulnerabilityManagement #WebHosting