Rendered at 11:27:08 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
cadamsdotcom 7 hours ago [-]
Whoever failed to edit this CVE description down owes us all a bunch of our time back
Everyone using LLMs needs to stop shipping their first draft.
walrus01 6 hours ago [-]
"Haven't had enough yet of very junior engineers pasting wall-of-text from chatgpt at you in Slack? Come on down to the CVE announcement emporium, where we have a special treat for you today..."
syshyk 4 hours ago [-]
You know it isn't serious when it doesn't have its own domain name.
LtWorf 5 hours ago [-]
What about senior engineers doing that?
majorchord 8 hours ago [-]
Thankfully the vast majority of servers are not creating MPTCP listeners by default (that I'm aware of).
Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.
I fail to understand / find the gist of this article.
Article describes the technical aspects of the bug, how it got handled by different vendors...AI position on it...
But, one would always ask themselves, why did the author write this article? That part hasn't been clear to me even after going through much of the article.
vikramkr 6 hours ago [-]
I believe the author of this article is in fact most likely a large matrix multiplication and that it is possible that no human even initiated the computation of said multiplication directly. I assume it's not hard to set up some monitor for new CVEs to try and slop out an article as quickly as possible to get as revenue
vips7L 5 hours ago [-]
Because it’s slop.
drum55 7 hours ago [-]
This is a good portion just slop, another 9000 word article that could have been a couple of paragraphs. More text doesn't mean better.
gnabgib 7 hours ago [-]
There's other coverage, this just has most of the comments now
GoogleGroups (slight tangent) Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 (9 points, 3 hours ago, 4 comments) https://news.ycombinator.com/item?id=50298526
walrus01 6 hours ago [-]
It would have been about 50x less annoying if whoever was driving the LLM had simply told it to make a clickable top of page index/headers in markdown and divide it into sections and subsections by logical topic.
walrus01 6 hours ago [-]
The overlaid HTML popup on that page for "Try The World's First Agentic AI Hacker." tool is cancerous and annoying. This should really be a link to a more reputable link for the CVE in question.
It doesn't appear until you've read the page for maybe 10-15 seconds, so if you're not seeing it, just wait.
It even managed to get past ublock origin, since there's no specific rule for it yet.
malux85 5 hours ago [-]
Yes I found it very jarring too
superkuh 8 hours ago [-]
Would dropping these specialized ipv4 syn packets with extra header size beyond 20 bytes (as indicated by options value >5) with the firewall be low enough in the order of things to mitigate the attack? Like, iptables -A INPUT -p tcp --syn -m u32 --u32 "0>>24&0xF=6:15" -j DROP ?
aussieguy1234 7 hours ago [-]
Given these types of security bugs that are being found left and right, I reckon there's going to be an uptick in hiring of software engineers to fix them.
SkyPuncher 7 hours ago [-]
I strongly doubt that. The fixes for most of these are trivial to the point it’s almost automated.
gspr 5 hours ago [-]
The resulting mechanical code change might be trivial. The bugs themselves are often decidedly not.
You're essentially saying that swallowing a pill is trivial, so therefore pharmaceutical engineering is.
aussieguy1234 5 hours ago [-]
There is a push for that, but the fixes (often as little as a one line Dockerfile change in some cases) still have to be tested and verified by a real engineer.
Otherwise everywhere would have patched already with AI.
Incipient 6 hours ago [-]
I suspect a lot of organisations are already on automated AI detect-patch-redeploy loops for a lot of these types of issues.
Rapzid 7 hours ago [-]
[flagged]
schainks 6 hours ago [-]
Debian patched it up
Red Hat says "Fix is deferred"
Pull the network plug
the_dev_stack 7 hours ago [-]
[dead]
tadfisher 7 hours ago [-]
FYI, generating comment text is against HN guidelines.
snvzz 6 hours ago [-]
There's no end to bugs like these in Linux. Millions of Lines of Code can easily hide many, many of these. Code that runs in supervisor mode.
None of this can ever affect seL4[0] nor a system built on it, due to its architecture.
This one is quite serious and the type of vulnerability is once again, a C style memory corruption and a race condition combined; leading to an RCE.
At this point, we seriously need to discuss whether if the major projects still written in C such as Linux, Chromium and even git can even handle the stream of now near infinite bugs being discovered with AI.
Attackers are already rapidly finding and building exploits for those vulnerabilities the moment they are discovered with abliterated frontier-level models.
These sort of vulnerabilities are far to common in those projects and in the future, it will be extremely unsafe for even experts to continue using C or C++ in any way.
spauldo 8 hours ago [-]
Unless someone vibecodes a new OS and convinces everyone to use it, we're stuck with what we got. Reaching feature parity with Linux and then debugging it to the point where it'd be usable is a gargantuan undertaking.
schainks 6 hours ago [-]
Don't tempt DHH. Omarchy works WAY better than expected, and made my 2017 MBP very usable again.
LtWorf 4 hours ago [-]
It just uses the same linux kernel as everyone else. So I don't see what the point of your comment is.
drdexebtjl 7 hours ago [-]
> Attackers are already rapidly finding and building exploits for those vulnerabilities the moment they are discovered with abliterated frontier-level models.
Are they? Distributions are rating this at a lower severity presumably because it can’t be easily exploited.
MithrilTuxedo 8 hours ago [-]
I bet there's a half-life to bugs though. Bugs might be infinite over the lifespan of a project, but the rate that they are produced goes down with our ability to detect them.
A lot are being found _now_ in projects written in C because the backlog of bugs to find is mostly written in C. We haven't yet gotten to the point when we're detecting most bugs before they're released, but we will.
Things won't get worse for too long. If we haven't already surpassed it, we're approaching the point of being able to do static analysis and ensure the mathematical correctness of the most complex C programs ever written so far.
I don't use C or C++, but look how much safer it is to use C or C++ these days.
worthless-trash 8 hours ago [-]
Leading 'maybe' to an RCE, i imagine you need to groom the heap first, unless there is something i'm missing.
Edit: also thanks for using RCE correctly, it seems to be any kind of code execution these days is considered "RCE".. boo.
perching_aix 7 hours ago [-]
You severely underestimate humanity's goalpost moving capabilities.
The state of cope:
- models are still not intelligent, they're just like, uhh, really good semantic fuzzers! so you can just put them in the loop, they'll fuzz your code, and all is good :)
- the number of bugs is "finite", so - esp with agentic help - we'll just catch up and all will be good :)
Annoyingly, the cope frontier is kinda right about both of these, so the joke shall go on. The only real counter to it would be to bring up that this finiteness claim only really applies to a frozen set of security boundaries and attack surfaces, but they'll probably just raise this being "an academic tier concern" and just tell you to ""fuzz"" more.
So ironically, it looks like these practices are rescued once again, and the bare minimum stays winning. It also starts being moved to the territory of the magic box, but I guess nobody cares about that anymore. Local AI will just get really good too, fully competitive and self hostable even. Any day now.
Everyone using LLMs needs to stop shipping their first draft.
Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.
> ListenConfig now uses MPTCP by default on systems where it is supported (currently on Linux only).
This seems to imply basically any golang server built since February 2025 is going to be at least attempting to use it.
Luckily though, ListenConfig lets you override this https://cs.opensource.google/go/go/+/refs/tags/go1.27.3:src/...
Article describes the technical aspects of the bug, how it got handled by different vendors...AI position on it...
But, one would always ask themselves, why did the author write this article? That part hasn't been clear to me even after going through much of the article.
Ubuntu (34 points, 16 hours ago, 3 comments) https://news.ycombinator.com/item?id=50287647
CVE.org (2 points, 7 hours ago) https://news.ycombinator.com/item?id=50295879
GoogleGroups (slight tangent) Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 (9 points, 3 hours ago, 4 comments) https://news.ycombinator.com/item?id=50298526
It doesn't appear until you've read the page for maybe 10-15 seconds, so if you're not seeing it, just wait.
It even managed to get past ublock origin, since there's no specific rule for it yet.
You're essentially saying that swallowing a pill is trivial, so therefore pharmaceutical engineering is.
Otherwise everywhere would have patched already with AI.
None of this can ever affect seL4[0] nor a system built on it, due to its architecture.
0. https://sel4.systems/
At this point, we seriously need to discuss whether if the major projects still written in C such as Linux, Chromium and even git can even handle the stream of now near infinite bugs being discovered with AI.
Attackers are already rapidly finding and building exploits for those vulnerabilities the moment they are discovered with abliterated frontier-level models.
These sort of vulnerabilities are far to common in those projects and in the future, it will be extremely unsafe for even experts to continue using C or C++ in any way.
Are they? Distributions are rating this at a lower severity presumably because it can’t be easily exploited.
A lot are being found _now_ in projects written in C because the backlog of bugs to find is mostly written in C. We haven't yet gotten to the point when we're detecting most bugs before they're released, but we will.
Things won't get worse for too long. If we haven't already surpassed it, we're approaching the point of being able to do static analysis and ensure the mathematical correctness of the most complex C programs ever written so far.
I don't use C or C++, but look how much safer it is to use C or C++ these days.
Edit: also thanks for using RCE correctly, it seems to be any kind of code execution these days is considered "RCE".. boo.
The state of cope:
- models are still not intelligent, they're just like, uhh, really good semantic fuzzers! so you can just put them in the loop, they'll fuzz your code, and all is good :)
- the number of bugs is "finite", so - esp with agentic help - we'll just catch up and all will be good :)
Annoyingly, the cope frontier is kinda right about both of these, so the joke shall go on. The only real counter to it would be to bring up that this finiteness claim only really applies to a frozen set of security boundaries and attack surfaces, but they'll probably just raise this being "an academic tier concern" and just tell you to ""fuzz"" more.
So ironically, it looks like these practices are rescued once again, and the bare minimum stays winning. It also starts being moved to the territory of the magic box, but I guess nobody cares about that anymore. Local AI will just get really good too, fully competitive and self hostable even. Any day now.
From the horse's mouth, in case you were suspecting these descriptions to be in bad faith: https://www.youtube.com/watch?v=NnV_cWeoo5Q