Making systems talk. @AtlasumNet
Austin, TX
Joined October 2023
- Tweets51
- Following155
- Followers79
- Likes3
Pinned Tweet
This week: PHP2Shell, Node2Shell, Tailscale, WordPress 7.1.4, and more. We covered each as it broke, with fixed versions, remediation steps, and exact exploitation status.
If you'd like us to look at your own setup, request a free security audit: atlasum.net/audit?utm_source…
This weekend, @tobi shared our article on the Linux IPv4 TCP CVE.
Our goal: inform the public on critical security incidents - honestly and transparently. No click bait spin.
Thank you Tobi for getting this in front of and educating the people who needed to see it.
Reach:
- 6M+ impressions across the conversation
- #2 on @hackernews
- Top trending story on X
- Hundreds of thousands of visitors.
Cheers to responsible education and public disclosure. Security is important!
We write these in a timely manner, both in plain English and the technicals for everyone to stay informed.
atlasum.net/blog/cve-2026-98…
🚨 Turning off MPTCP does not fix the kernel bug.
This is a common misconception I've seen after we published the article on @AtlasumNet.
Anthropic's root exploit for CVE-2026-98432 needed an MPTCP listener, but the bug is in plain IPv4 TCP. Turning off MPTCP blocks that exploit but doesn't fix the bug. Nobody has shown RCE without MPTCP, and the Go team says nobody knows whether it's possible.
Better safe than sorry...
Ubuntu and RHEL still have no fixed kernel. Debian, Amazon Linux and Oracle UEK do.
Read more 👇
Trevor Fannin | Atlas retweeted
What a disaster atlasum.net/blog/cve-2026-98…
why is everyone so up in arms about prompting in the terminal?
i run arch btw 🤓
...so it's safe to say i'm always in the terminal.
a bit of a keyboard warrior.
hell, i wrote my own ssh manager. works like a charm.
ssh keys > hosts directory > tmux sessionizer > claude remote control
always on, always available.
it works, and i love it.
stay mad:)
🚨 Binance's main hot wallet ran the attacker's code for 3 hours and 50 minutes.
The attacker swept it repeatedly. Binance only cleared the attacker's code from the wallet at 7:10 PM CT, with its own signed EIP-7702 authorization pointing the wallet at the zero address.
Binance now says it will cover all losses. Deposits and withdrawals are suspended, and it puts the verified frozen total at $2.54B.
Live coverage👇
🚨 Binance: our full on-chain breakdown is live.
By our tally, about $5.8B left Binance hot wallets on Ethereum, Bitcoin and Tron within five minutes. Tether and Circle have frozen about $2.6B of it.
On Ethereum, the attacker used EIP-7702 to point Binance's main hot wallet at their own contract. That took a valid signature from the wallet's key. Binance hasn't said how.
Binance has suspended withdrawals and says user funds remain safe. It hasn't published a cause or a loss figure.
Read more 👇
🚨 Binance says it is investigating a "potential security issue." On-chain, about $2.5B+ moved out of labeled Binance hot wallets to new addresses starting at 3:24 PM CT. Binance has not confirmed a hack, a loss amount or a cause. Tether and Circle are reported to have frozen about $1.8B in stablecoins.
🚨 CVE-2026-98432: a CVSS 9.8 in Linux's IPv4 TCP handshake. A remote, unauthenticated peer can reach it, before any application code runs.
Impact: kernel memory leak or corruption, or a crash. Worst case is remote root.
Anthropic says Claude built a lab exploit that gets root on servers with a multipath TCP listener.
Fixed in upstream kernels since mid-October. Ubuntu and RHEL haven't shipped fixed kernels yet. Debian and SUSE have.
Read more 👇
Distro-by-distro status, how to check your kernel and for multipath TCP listeners, and an interim nftables rule that drops IPv4-options packets until Ubuntu and RHEL ship fixes:
atlasum.net/blog/cve-2026-98…
CISA added Linux kernel CVE-2026-46300 ("Fragnesia") to its KEV catalog yesterday and says it chains with PHP2Shell (CVE-2026-109618/-109619) to plant PHP webshells and run commands as root.
Federal civilian deadline: Oct 31.
Dream Research reports a China-linked operator used the chain to root 25 servers, mostly firewalls.
Read more 👇
We covered PHP2Shell from the start and have updated the story as the picture filled in, including the Fragnesia chain and CISA's KEV listing. Full write-up:
atlasum.net/blog/cve-2026-10…
🚨 WordPress 7.1.4 is out, a security update patching 22 vulnerabilities. The headline bug is a race condition in the core updater that can lead to remote code execution, with no account needed.
Also fixed: stored XSS in blocks and the Interactivity API, and unpublished Customizer changes exposed to logged-out visitors.
The RCE is hard to hit, since it needs a window of seconds during an update. But WordPress runs 39.5% of the web, and the last core bug fixed on Sept 22 (CVE-2026-87902) was probed the same day and in CISA KEV three days later.
The fixes are released. Update now. If you can't yet, block web access to wp-content/upgrade/ first.
Read more 👇
Full breakdown: all 22 vulnerabilities by severity, which sites are exposed, how to check every install type, and the web-server rules to block the updater race.
atlasum.net/blog/wordpress-7…
🚨 Tailscale patched four SSH and Serve flaws (TS-2026-014 to 017) in v1.104.4. They follow "Tailworm," a public report that claimed the flaws could spread like a worm from server to server. We checked its claims against Tailscale's bulletins and the source code.
Confirmed: SSH socket forwarding reaching root-only sockets, SSH memory exhaustion, and two Serve bugs. Overstated: "wormable." That was measured only in the researcher's lab, and it's limited to what your tailnet policy already allows. Tailscale says these aren't self-replicating malware.
Update to 1.104.4, then confirm with
tailscale version --daemon
Read more 👇
Full breakdown: what's true, what's partly true, what Tailscale disputes, which configs are exposed, and how to check every install type. Includes what headscale still can't turn off.
atlasum.net/blog/ts-2026-014…
