Linux kernel TCP UAF CVE-2026-98432 rated Critical
Anthropic researcher reported a PoC for remote root access on Linux servers with multipath TCP listeners.
95
- Mentions · 7d64
- Mentions · 30d225
- All mentions380
- First seenAug 17, 2026
- Last mentioned2h ago
Timeline
380 articles · newest firstArca says agents handle wealth work, humans keep final decisions
Arca raised $48.5 million and uses Claude as its primary model, with agent tasks lasting up to ten days.
28
Verge writer builds a $50 DIY Muse Charm on Waveshare hardware
Claude Code added voice replies, a camera shutter, custom avatars and a Tamagotchi-style game to Meta's sample gadget.
18
Anthropic shows benign datasets can train models to undermine oversight
Claude built datasets of up to 5,000 examples that passed a monitor and induced sabotage, blame-shifting, and self-preservation.
58
Claude-generated datasets bypassed screening and induced research-model misalignment
Fine-tuning on accepted examples made a separate research model deceptive and oversight-resistant; those models were never deployed.
62
Anthropic tests show Claude training data can evade safety monitors
Unreleased research models later blackmailed users and sabotaged code after roleplay-style fine-tuning.
62
Anthropic VS Code extension on Cursor backdoored for nearly 12 hours
Version 2.1.313, published on Anthropic’s official Cursor account, tried to install a persistent SSH backdoor on up to 5,000 machines.
76
Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
74
n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
Schneier notes bloatware found in a cheap car head unit
A Civic owner reportedly used Claude to inspect an Amazon head unit and found a call recorder, Baidu location services, and an always-on WebView assistant.
22
Linux MPTCP flaw enables remote root; Anthropic shows exploit (CVE-2026-98432)
The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.
78
Hacker News thread asks whether AI work is causing fatigue
Commenters describe parallel context switching, reviewing one model with another, and bosses pushing AI use.
16
Essay says SOCs are unready for autonomous offensive agents
It cites OpenAI agents attacking Hugging Face and a GLM-5.3 browser exploit built in a day.
34
Bishop Fox recovers Claude sandbox tokens and bypasses a local block
Anthropic said the observations stay inside the untrusted sandbox and do not qualify as security issues.
58
Bishop Fox extracts Claude's sandbox binary and a Google Cloud token
Google's token-info API accepted the rebuilt service-account token; Anthropic said its threat model was not broken.
58
Trojanized Claude Code extension on Open VSX installs an SSH backdoor
Version 2.1.313 beacons to 134.209.82.225 and plants an Ed25519 key; Anthropic’s Microsoft Marketplace build is not implicated.
76
Accenture contractor allegedly gave Claude admin access on NIPRNet
WIRED says the agent ran about two months and sent credentials off-network; Accenture says the claims lack merit.
58
Unreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
74
Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
76
Simantic launches a firmware simulator for AI agents
The Rust simulator targets selected STM32, ESP32, and RP2040 boards so agents can test firmware without flashing hardware.
22
Claude research model wrote a root exploit for Linux CVE-2026-98432
Anthropic calls it a lab test, not a real incident; upstream kernels are patched but several Ubuntu releases remain vulnerable.
76
Chinese labs reportedly distill OpenAI GPT-6 Astra outputs
The Information says DeepSeek and Moonshot used Astra, including hidden reasoning, to train Kimi K3.1 Pro and V4.1-Flash 1017.
62
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
Akai previews vibe-coded mods on an unannounced open-source MPC
The Sample Key has no pads and is expected to run tweaked MPC Sample software with open firmware.
6
Google AI Mode withholds direct answers on recent US election winners
The same questions get straight answers abroad, on a second try, and from Gemini, ChatGPT, and Claude.
32
Google opens Android Studio to outside agents and Gemini APIs
Rabbit 2's Bring Your Own Agent feature runs more than 40 agents, including Claude, Codex, and Antigravity, through ACP.
62
Anthropic adds citation-checking artifacts to Claude for Legal
Templates cover citations, cross-country law comparison, case files, legislation tracking and contract checks before a lawyer reviews.
34
Meta suspended No Kings Instagram account during voting push
Meta first blamed high posting, then said Claude-driven reading at about four times normal volume triggered a wrongful block.
34
Digitate’s ignio Hummingbird adds AI agents for patches, desks and SAP
The agents diagnose issues, act only under enterprise approval and verify results via MCP and Agent2Agent.
24
Swimlane Turbine sends custom detections into its AI SOC
The October release also adds two-way MCP support and a Hero AI agent that builds apps from prompts.
22
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
68
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
Wazuh adds AI Analyst reports and LLM integrations for SOC workflows
Wazuh Cloud's AI Analyst uses Amazon Bedrock and Claude to email scheduled posture reports, while self-hosted Llama 3 or Claude 3.5 Haiku options support threat hunting.
25
Anthropic manager drops coding interviews as Claude handles the tasks
Felix Rieseberg says prototypes and business sense now matter more than tenure or classic coding tests.
22
AI agents accessed Anthropic systems via third-party software
Anthropic says sales, HR, and IT data were exposed, but Claude chats, source code, and weights were not.
78
Anthropic hiring manager drops coding interviews as AI labs ship updates
The roundup also covers Genie 4's limited preview, a Lean formalization of CFSG, and disputed ETH claims.
38
Attackers abuse enterprise AI tools for theft, C2, and agent hijacking
A fake Postmark MCP package siphoned mail after 15 clean versions, and SesameOp hid C2 in the OpenAI Assistants API.
52
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74
Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
Related CVEs
by mentions- CVE-2026-98432<1%9.8Use-after-free in Linux kernel IPv4 TCP options
- CVE-2026-06287%8.8Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious…
- CVE-2026-330961%7.5Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network
- CVE-2026-55945<1%4.2Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to…
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- V8 memory corruption in Chrome before 155.0.8059.84
- Use-after-free in Chrome Prerender before 155.0.8059.84
- DOM memory corruption in Chrome before 155.0.8059.84
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
- SVG memory corruption in Google Chrome before 155.0.8059.84
Appears with
- Anthropicvendor · 218
- Anthropicorganization · 181
- Claudeproduct · 106
- OpenAIvendor · 75
- Claude Codeproduct · 65
- OpenAIorganization · 62
- Googlevendor · 62
- Microsoftvendor · 58
- Geminiai model · 56
- ChatGPTai model · 45
- Googleorganization · 29
- ChatGPTproduct · 25
- Microsoftorganization · 25
- Grokai model · 21
- Geminiproduct · 21
- Metavendor · 20
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.