For anybody assessing risk from CVE-2026-98432, this is good from @malwaretech

tl;dr is basically likely a few million devices are vulnerable, some scanning, no sign of exploitation and no exploits available, development likely in the realms of nation state.

My POV - don't panic, calmly patch.

https://www.linkedin.com/posts/malwaretech_update-on-the-98-cvss-tcpip-rce-in-the-share-7523273340598411264-3rlv/

CVE-2026-98432 means that setting

net.mptcp.enabled = 0

in /etc/sysctl.conf is a very good idea. Then reboot to quash any existing sockets.

IPFire releases Core Update 205 to address CVE-2026-98432, a serious use-after-free flaw in the Linux kernel's TCP stack.
https://linuxiac.com/ipfire-2-29-core-update-205-fixes-serious-linux-tcp-vulnerability/

#opensource

I'm not trying to rush you or anything, #Ubuntu, but could we maybe get a patch sometime this month?

https://ubuntu.com/security/CVE-2026-98432

Ubuntu Server Is Cooked | CVE-2026-98432

https://watch.linuxrenaissance.com/w/3ouqDZgMNFM7M6czupnUWz

Ubuntu continues to work on the the fix for CVE-2026-98432.

a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code (CVSS 9.8 score)

Debian released the fix on Oct 16.

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Security

If we can’t rely on an open port being safe on the internet without the risk of exploitation (CVE-2026-98432), it’s time for us to add another layer of security. Namely, port knocking, or pre-handshake authentication.

And this one is relatively easy to do with what we already have.

Port knocking is an older concept, whereby you monitor logs for a known pattern in attempted connections, then follow up by allowing a connection, or opening a port, for that IP address to connect with a specific service on your machine.

This adds authentication pre-connection, where most vulnerabilities would occur.

You limit access to your tech stack so that anyone in the world can now be treated as if they came from a pre-approved known static IP address.

It’s simple technology, easy to implement, and it removes exploitation a step further away before allowing anyone the chance to communicate with your deeper stack.

Bring port knocking back.

—
And as always: need to secure your agents? Check out what we do at Knostic.

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code, CVE-2026-98432, are now available for Red Hat Enterprise Linux 8, 9 and 10, The Hacker News reports. The 9.8-rated flaw can be reached by a remote, unauthenticated attacker; Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date set for a regular update. https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

The IPFire team has released IPFire 2.29 Core Update 205 to address CVE-2026-98432, a serious use-after-free vulnerability located in the Linux kernel's TCP stack.

Due to the nature of the issue, developers urge administrators not to postpone installation until the next regular maintenance window.

This update upgrades the underlying Linux kernel to version 6.18.60 and resolves a separate crash affecting the Broadcom network driver.

A syst…

https://en.hacks.gr/ektakti-enimerosi-asfaleias-apo-to-ipfire-gia-sovaro-provlima-diktyoy/

#IPFire #Linux #Kernel #TCP

Critical Kernel Flaw CVE-2026-98432: How to Patch #Ubuntu #Linux

https://www.ubuntufree.com/linux-kernel-cve-2026-98432-ubuntu-fix/

https://blog.gslin.org/archives/2026/11/04/13323/ubuntu-%e4%b8%8a%e9%80%99%e6%ac%a1-cve-2026-98432-%e7%9a%84%e4%bf%ae%e6%ad%a3%e5%95%8f%e9%a1%8c/

Ubuntu 上這次 CVE-2026-98432 的修正問題

#advisory #cve #Cve202698432 #kernel #linux #mitigation #mptcp #network #proposed #security #ubuntu #vulnerability

rpm -q --changelog kernel-uek | grep -i "CVE-2026-98432"

CVE-2026-98432 & Synology Linux Kernel Branch 3.10 NOT AFFECTED / STRUCTURALLY IMMUNE

https://www.synoforum.com/threads/cve-2026-98432-synology-linux-kernel-branch-3-10-not-affected-structurally-immune.16480/

#synoforum #synology #NAS

“If you run Node-RED anywhere, including inside OT environments, check today whether it’s reachable from outside your network, apply updates where available and implement detections to reduce the risk of exploitation,” - VulnCheck researcher Patrick Garrity

https://www.theregister.com/security/2026/11/02/max-severity-bug-in-widely-used-ot-programming-tool-exploited-to-deliver-linux-malware/5307086

#CVE-2026-58115 #security

Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)

Attackers are exploiting an authentication flaw in Node-RED, CVE-2026-58115, to install a Linux bot and backdoors on unprotected servers, Help Net Security reports. VulnCheck found the attacks; Node-RED is a flow-based programming tool built on Node.js, built into some industrial control products and used in manufacturing, healthcare and home automation. https://www.helpnetsecurity.com/2026/11/03/node-red-cve-2026-58115-exploitation/

A VulnCheck canary has caught the first live exploitation of CVE-2026-58115, an unauthenticated Node-RED admin API flaw with a CVSS score of 10. One HTTP request wires an inject node to an exec node, and the flow downloads and runs a Linux bot. VulnCheck has logged 16 events from one source address.

How many Node-RED instances are still reachable without adminAuth?

https://iottechnews.com/news/node-red-admin-api-flaw-exploited-drop-linux-bots/

#IoT #CyberSecurity #Technology

VulnCheck captured exploitation of Siemens IoT2050 Node-RED flaw CVE-2026-58115 on canaries from October 30. Unauthenticated requests deployed flows that fetched Linux payloads. The malware's capabilities and wider victim count remain unknown.

Siemens fixed it in 4.3.4.1. Patch affected gateways, restrict Node-RED management access and audit unexpected flows.

https://www.vulncheck.com/blog/exploitation-targeting-node-red

#Cybersecurity #Infosec #OTSecurity #PatchManagement

CISA added WordPress Core CVE-2026-119977 to KEV on Nov. 3. A weakness in web-accessible staging paths during core upgrades could allow unauthenticated code execution in that window.

Confirm WordPress 7.1.4 or a fixed branch release, and check logs around recent core updates.

https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog

#Cybersecurity #Infosec #WordPress #PatchManagement

On 3 November 2026, CISA added WordPress core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing signs of active exploitation.

The flaw can let an attacker without a site account run code on the system hosting the site.

Exploitation requires a brief window during a full WordPress upgrade.

WordPress released fixes in late October.

Wordfence reported blocking 12,632 exploitation attemp…

https://en.hacks.gr/keno-asfaleias-sto-wordpress-epitrepei-se-tritoys-na-eisvaloyn-se-istotopoys/

#WordPress #WordPressCore #CVE_2026_119977 #Vulnerability

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

CISA has added a WordPress Core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog, confirming active exploitation, The Hacker News reports. The time-of-check time-of-use race condition can let an unauthenticated attacker run code during a full core upgrade, and federal agencies have until November 6, 2026 to apply the fixes. https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html

🚨 Critical zero-click Android RCE patched; CVE-2026-58868

A heap buffer overflow in Android’s Framework component could allow remote code execution without additional privileges or user interaction.

The flaw resides in the onOutputReceived function within FrameDecoder.cpp, where an out-of-bounds write can occur while processing media frames.

• Severity: Critical
• CVSS: Not yet assigned
• Affected: Android 14, 15, 16, 16 QPR2 and 17
• Fixed: Security patch level 2026-11-01 or later
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

Administrators should aim for the 2026-11-05 patch level or later, which includes this fix and the remaining November security updates for kernel and hardware components.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

Google has issued patches for a critical Android flaw, CVE-2026-58868, that could allow an attacker to run code remotely without any user interaction, The Hacker News reports. The flaw affects Android 14 through 17, and fixes are included in devices with the 2026-11-01 security patch level or later. https://thehackernews.com/2026/11/google-patches-critical-android-flaw.html

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Google has released its November 2026 Android security bulletin, detailing 216 vulnerabilities with 23 rated critical.

Key items include CVE-2026-58868 affecting Android 14 through 17, and CVE-2026-58882 allowing remote denial-of-service via WAP Push messages.

Fixes are available through security patch levels 2026-11-01 and 2026-11-05.

https://en.hacks.gr/i-google-diorthonei-sovaro-provlima-se-android-14-eos-17-poy-epetrepe-apomakrysmeni-epemvasi/

#Android #Google #Patch #Mobile

SMS of Death, la vulnerabilità Android che può bloccare le chiamate: rischi e difese

@informatica
Un SMS invisibile può mandare in crash il servizio telefonico di alcuni smartphone Android, interrompendo anche le chiamate di emergenza. La vulnerabilità SMS of Death, identificata come CVE-2026-58882, solleva interrogativi sulla

📰 Android's November Patch Fixes Critical Zero-Click RCE, 'SMS of Death'

Google & Samsung's November Android update patches 200+ flaws, including a critical zero-click RCE (CVE-2026-58868) and the 'SMS of Death' bug (CVE-2026-58882). Update your devices immediately! #Android #CyberSecurity #PatchTuesday #RCE

🔗 https://cyber.netsecops.io/articles/android-november-2026-security-update-patches-critical-zero-click-rce/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Google has released its November 2026 Android security bulletin, detailing 216 vulnerabilities with 23 rated critical.

Key items include CVE-2026-58868 affecting Android 14 through 17, and CVE-2026-58882 allowing remote denial-of-service via WAP Push messages.

Fixes are available through security patch levels 2026-11-01 and 2026-11-05.

https://en.hacks.gr/i-google-diorthonei-sovaro-provlima-se-android-14-eos-17-poy-epetrepe-apomakrysmeni-epemvasi/

#Android #Google #Patch #Mobile

🚨 Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems, CVE-2026-28336

SolarWinds has disclosed a critical command injection vulnerability in Dameware, its remote administration software, carrying a near-maximum CVSS score of 9.9.

The vulnerability could allow authenticated attackers with low-level privileges to execute malicious commands and potentially take control of remotely managed systems.

Given Dameware's role in enterprise IT administration, successful exploitation could put sensitive systems and the data they handle at risk.

CVE-2026-28336 | Critical

• CVSS: 9.9
• Type: Command injection
• Attack vector: Network
• Privileges required: Low
• User interaction: None
• Impact: Potential compromise of remotely controlled hosts

Affected Systems

• Affected: SolarWinds Dameware 2026.3 and earlier
• Fixed: Dameware 2026.3.1
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

SolarWinds recommends that administrators upgrade to version 2026.3.1 to address the vulnerability.

Source: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

SolarWinds Dameware 2026.3.1 fixes Dameware command injection flaw CVE-2026-28336 (CVSS 9.9), plus a buffer overflow and DLL hijacking bug.

#SolarWinds #Dameware #CVE202628336 #CommandInjection #RemoteSupport #CVSS #PatchNow #Vulnerability

https://securityonline.info/dameware-command-injection-cve-2026-28336/?utm_source=mastodon&utm_medium=jetpack_social

One unauthenticated POST to xmlrpc.php can take down a PHP worker on a stock WordPress[…]
 
#Security #WordPress

https://www.wpnews.io/wordpress-doesnt-ship-brotli-its-still-exposed-to-cve-2026-111497/

Rsync 3.5.2, the latest maintenance release of the open-source file synchronisation and transfer tool, is available.

It fixes CVE-2026-119741, where a malicious receiver could trigger excessive checksum calculations by sending weak checks that repeat across consecutive chunks.

The release also fixes an interrupted-transfer issue that could write the final 256 KiB twice when using --append and --inplace, and improves…

https://en.hacks.gr/to-rsync-3-5-2-diorthonei-provlima-poy-epetrepe-se-kakovoylo-paralipti-na-prokalei-epanalamvanomenoys-ypologismoys/

#Rsync #CVE2026119741 #FileTransfer #DataIntegrity