Atlas

🚨 Turning off MPTCP does not fix the kernel bug. This is a common misconception I've seen after we published the article on @AtlasumNet. Anthropic's root exploit for CVE-2026-98432 needed an MPTCP listener, but the bug is in plain IPv4 TCP. Turning off MPTCP blocks that exploit but doesn't fix the bug. Nobody has shown RCE without MPTCP, and the Go team says nobody knows whether it's possible. Better safe than sorry... Ubuntu and RHEL still have no fixed kernel. Debian, Amazon Linux and Oracle UEK do. Read more 👇

🚨 CVE-2026-98432: a CVSS 9.8 in Linux's IPv4 TCP handshake. A remote, unauthenticated peer can reach it, before any application code runs. Impact: kernel memory leak or corruption, or a crash. Worst case is remote root. Anthropic says Claude built a lab exploit that gets root on servers with a multipath TCP listener. Fixed in upstream kernels since mid-October. Ubuntu and RHEL haven't shipped fixed kernels yet. Debian and SUSE have. Read more 👇

🚨 Binance: our full on-chain breakdown is live. By our tally, about $5.8B left Binance hot wallets on Ethereum, Bitcoin and Tron within five minutes. Tether and Circle have frozen about $2.6B of it. On Ethereum, the attacker used EIP-7702 to point Binance's main hot wallet at their own contract. That took a valid signature from the wallet's key. Binance hasn't said how. Binance has suspended withdrawals and says user funds remain safe. It hasn't published a cause or a loss figure. Read more 👇

PHP has patched two critical remote code execution bugs (CVE-2026-109618 and CVE-2026-109619) affecting all PHP installs serving web requests, including FPM and mod_php. PHP's own advisory: "There are no complete mitigations, updating is the only safe choice." CISA, the FBI and NSA all say if you can't update now, take the system offline. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 8.1 and older get nothing. Verify your host, and don't forget container images, CI pipelines, and other runners. Here's how to check 👇

Node.js has patched a Brotli decoder bug (CVE-2026-111497) that can lead to remote code execution. It's reachable anywhere untrusted compressed data gets decompressed, including fetch() responses. Plus 9 more vulnerabilities patched. Fixed in 22.23.4, 24.22.1 and 26.12.1. Node 20 and older, plus 23 and 25, are EOL and won't get a patch. Your host isn't the only place Node lives. Container images, CI runners and bundled runtimes need checking too. Review your infra 👇