Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
74
- Mentions · 7d0
- Mentions · 30d8
- All mentions16
- First seenSep 7, 2026
- Last mentioned12d ago
Timeline
16 articles · newest firstGo team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
74
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
74
Tech giants block eMudhra certificates tied to 8 compromised keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
78
Go 1.27.3 and Go 1.26.10 released for CA certificate removal
The forwarded note cites crypto/x509; the snippet does not name the removed certificate.
52
Go will reject certificate chains with eight distrusted SPKIs
A reader of the change says 16 certificates, all from eMudhra, appear to match.
52
Go will reject certificate chains containing eight distrusted SPKIs
The Hacker News item only shows 29 points and six comments, with no keys or versions.
50
USN-8883-2: Go vulnerability
Ubuntu fixes a Go 1.23 x/net/idna Punycode flaw that could bypass hostname access controls.
32
Fwd: Go 1.27.2 and Go 1.26.9 are released
Go released 1.27.2 and 1.26.9 with security fixes, including an HTTP/2 net/http server issue.
52
USN-8900-1: Go Networking vulnerabilities
Ubuntu patches Go networking flaws that can hang HTTP/2 connections or exhaust resources via HPACK.
30
USN-8883-1: Go vulnerability
Ubuntu fixed a Go x/net/idna flaw that can bypass hostname controls via Punycode labels.
51
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google paused paid product-vulnerability reports for its open-source bug bounty after a surge of invalid automated submissions.
46
AI slop submissions force Google to freeze its open-source bug bounty
Google paused new OSS VRP vulnerability reports after invalid AI-generated submissions overwhelmed reviewers.
60
Don't couple your Go code to GitHub
A Go blog argues developers should use custom domains so module imports are not locked to GitHub.
4
The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
75
Signing TLS handshakes inside a TPM
Blog post demonstrates signing TLS handshakes in Go with a TPM-held private key; full text was unavailable behind an Anubis challenge.
25
Related CVEs
by mentions- CVE-2026-98432<1%9.8Use-after-free in Linux kernel IPv4 TCP options
- CVE-2022-276643%7.5In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if…
- CVE-2022-417235%7.5A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of…
- CVE-2026-111943<1%6.8On most platforms, Go uses the given system root certificates
Appears with
- Googlevendor · 6
- Canonicalvendor · 3
- Ubuntuproduct · 3
- Chromeproduct · 2
- Linux kernelproduct · 2
- Mozillavendor · 2
- Googleorganization · 2
- Firefoxproduct · 2
- eMudhravendor · 2
- Protocol Buffersproduct · 2
- Angularproduct · 2
- Anthropicorganization · 2
- Applevendor · 2
- OSS VRPproduct · 1
- Canonicalorganization · 1
- Oraclevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.