Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.

> ListenConfig now uses MPTCP by default on systems where it is supported (currently on Linux only).

This seems to imply basically any golang server built since February 2025 is going to be at least attempting to use it.

Luckily though, ListenConfig lets you override this https://cs.opensource.google/go/go/+/refs/tags/go1.27.3:src/...

Want a big name? RedHat.

I was vulnerable myself by using Caddy (although MPTCP is not a prerequisite).

Article describes the technical aspects of the bug, how it got handled by different vendors...AI position on it...

But, one would always ask themselves, why did the author write this article? That part hasn't been clear to me even after going through much of the article.

Ubuntu (34 points, 16 hours ago, 3 comments) https://news.ycombinator.com/item?id=50287647

CVE.org (2 points, 7 hours ago) https://news.ycombinator.com/item?id=50295879

GoogleGroups (slight tangent) Go programs enable MPTCP by default, exposing them to Linux CVE-2026-98432 (9 points, 3 hours ago, 4 comments) https://news.ycombinator.com/item?id=50298526

At this point, we seriously need to discuss whether if the major projects still written in C such as Linux, Chromium and even git can even handle the stream of now near infinite bugs being discovered with AI.

Attackers are already rapidly finding and building exploits for those vulnerabilities the moment they are discovered with abliterated frontier-level models.

These sort of vulnerabilities are far to common in those projects and in the future, it will be extremely unsafe for even experts to continue using C or C++ in any way.

A lot are being found _now_ in projects written in C because the backlog of bugs to find is mostly written in C. We haven't yet gotten to the point when we're detecting most bugs before they're released, but we will.

Things won't get worse for too long. If we haven't already surpassed it, we're approaching the point of being able to do static analysis and ensure the mathematical correctness of the most complex C programs ever written so far.

I don't use C or C++, but look how much safer it is to use C or C++ these days.

Obviously Omarchy's kernel, Wayland, and the Hyprland compositor are not Rust and work just fine. If you've seen any of DDH's public speaking, he's willing to burn tokens to Rust all the things, don't tempt him! That was the joke, people.

I am pleasantly surprised to be daily driving Omarchy with minimal friction, by the way. For a relatively new Linux OS, this is no small feat.

Edit: also thanks for using RCE correctly, it seems to be any kind of code execution these days is considered "RCE".. boo.

The state of cope:

- models are still not intelligent, they're just like, uhh, really good semantic fuzzers! so you can just put them in the loop, they'll fuzz your code, and all is good :)

- the number of bugs is "finite", so - esp with agentic help - we'll just catch up and all will be good :)

Annoyingly, the cope frontier is kinda right about both of these, so the joke shall go on. The only real counter to it would be to bring up that this finiteness claim only really applies to a frozen set of security boundaries and attack surfaces, but they'll probably just raise this being "an academic tier concern" and just tell you to ""fuzz"" more.

So ironically, it looks like these practices are rescued once again, and the bare minimum stays winning. It also starts being moved to the territory of the magic box, but I guess nobody cares about that anymore. Local AI will just get really good too, fully competitive and self hostable even. Any day now.

From the horse's mouth, in case you were suspecting these descriptions to be in bad faith: https://www.youtube.com/watch?v=NnV_cWeoo5Q

Are they? Distributions are rating this at a lower severity presumably because it can’t be easily exploited.

On patch validation specifically: the right smoke test is a reproducer that FAILS without the mark being set, not "no crash in syzkaller for N hours." Those are different quality bars, and the article doesn't address which one this patch cleared.

You're essentially saying that swallowing a pill is trivial, so therefore pharmaceutical engineering is.

I’m saying patching is easy because the pill is delivered to you.

Otherwise everywhere would have patched already with AI.

Everyone using LLMs needs to stop shipping their first draft.

"I have made this letter longer than usual, only because I have not had the time to make it shorter"

("Je n’ai fait celle-ci plus longue que parce que je n’ai pas eu le loisir de la faire plus courte").

Also Balzac:

* https://quoteinvestigator.com/2012/04/28/shorter-letter/

  Debian patched it up
  Red Hat says "Fix is deferred"
  Pull the network plug

It doesn't appear until you've read the page for maybe 10-15 seconds, so if you're not seeing it, just wait.

It even managed to get past ublock origin, since there's no specific rule for it yet.

None of this can ever affect seL4[0] nor a system built on it, due to its architecture.

0. https://sel4.systems/