Go team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
Stories per day · 30 days
4 RSS
Relatedalgorithmic-complexity1botnet1certificate-authority1code-signing1cryptominer1emudhra1html1linux-kernel1mptcp1panchan1pki1rce1rootkit1ssh1tls1use-after-free1worm1x-net1
14 stories, newest first · one card per story
Stories tagged #golang
golang.org/x/net v0.62.0 fixes HTML text-node complexity flaw
The html package change targets quadratic work while coalescing adjacent text nodes in addText.
Weak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
SANS analyzes Panchan, a Golang cryptomining worm that still spreads by stealing SSH keys.
3
Fwd: Vulnerabilities in golang.org/x/net
Go released golang.org/x/net v0.60.0 to fix HTTP/2 server memory exhaustion caused by Trailer headers.
Fwd: Go 1.27.2 and Go 1.26.9 are released
Go released 1.27.2 and 1.26.9 with security fixes, including an HTTP/2 net/http server issue.
USN-8900-1: Go Networking vulnerabilities
Ubuntu patches Go networking flaws that can hang HTTP/2 connections or exhaust resources via HPACK.
USN-8883-1: Go vulnerability
Ubuntu fixed a Go x/net/idna flaw that can bypass hostname controls via Punycode labels.
The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
AI malware just removed the human from the attack loop
Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
1
graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule
Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.
Analyzing a Go-Based IoT Self-Propagating DDoS Botnet
Akamai researchers published an analysis of a Go-based, self-propagating IoT botnet used for DDoS attacks.
The Gopher in the Room: Analysis of GoLang Malware in the Wild
Unit 42 analysis of 10,700 Go-compiled malware samples shows steady growth in the wild, with 92% targeting Windows and top families including Veil, GoBot2, and HERCULES.
Go-Based macOS Malware Steals Crypto and Secrets
Security researchers detected Go-based macOS malware stealing cryptocurrency, passwords, and other secrets from infected systems.
1