News for hackers. Stuff that matters.

A comment on Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks. Parent comment

Re:Ubuntu still has not released patch for Linux 0day RCE in... by pelagicAustral on Monday November 02, 2026 @07:17PM (#50346227)
Jesus H Christ! the bug is a narrow use-after-free race that needs SYNs carrying ipv4 options to make it to the box. I do not need an army of honeypots to tell you it most likely doesnt to have a way into a classic 443 machine... come one now.
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by ranger_danger on Monday November 02, 2026 @08:13PM (#50346720)
Except I was able to use the PoC to exploit several of my "classic 443 machines" sitting on the internet, like millions of other servers out there.
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by evilDagmar on Monday November 02, 2026 @08:28PM (#50346809)
You had services running that actually use MPTCP?
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by yxhuvud on Tuesday November 03, 2026 @01:09AM (#50348639)
Not uncommon, it is enabled by default in Go.
[ Parent | on HN ]
Re:Ubuntu still has not released patch for Linux 0day RCE in... by GordonS on Tuesday November 03, 2026 @03:13AM (#50349372)
I think it's used internally within Caddy?
[ Parent | on HN ]