Linux multipath TCP bug allows remote root; Go servers use MPTCP by default
CVE-2026-98432 is a race-induced use-after-free reachable by packets alone; the fix frees the structure after an RCU grace period and is in the maintained stable kernels.
Serguey Asael Shinder
Contributing writer
Software engineer, BSc First Class Honours in Computing and Information Systems. Writes about the JVM, build tooling and the parts of a release note that actually change behaviour.
Signed pieces
PostgreSQL 19 slips to November, and a core developer blames LLM-found bugs
Robert Haas counts back-patched commits up more than 60% on last year and late reverts of three large features; the cause, he argues, is that bugs became much easier to find than to fix.
Node.js 27 alpha: V8 15.6, OpenSSL 3 required, a new default heap limit
The first alpha changes the default heap ceiling, counts Buffer memory against it, switches v8.serialize to a format older releases cannot read and removes the bundled FIPS provider.
Rails this week: no CSRF tokens under header_only, lazier test gems
New apps stop loading Capybara and Selenium on boot, the :header_only CSRF strategy no longer renders tokens, and four fixes land for preloading has_many :through associations.
Cloudflare opens private origins to all: WAF and caching without a public IP
A proxied DNS record can now point at an RFC 1918 or CGNAT address and reach the origin over the customer's Cloudflare One link; private-to-private traffic is targeted for a closed beta in early 2027.
OpenAI will honour a shared robots.txt token for opting out of AI training
The signal comes from an Internet-Draft published the same day with the policy token __usage_ai-training; OpenAI says it will implement it in the coming months and keep its own crawler rules.
Ubuntu reissues a Blazor debug proxy fix and patches .NET Brotli flaw
USN-8958-1 says the earlier fix in USN-8942-1 was incomplete; dotnet8, dotnet10 and dotnet11 packages are updated across Ubuntu 22.04 to 26.10.
DoorDash agrees to buy Instacart for about $17 billion, at $65 a share
At least 75% of the price is cash, the offer is a 26% premium to Instacart's 22 October close, and Instacart's board approved it unanimously; the deal still needs regulators and shareholders.
Syncfusion ships a free MIT Blazor toolkit and fixes for ASP.NET Core
The toolkit needs no licence key and is separate from Syncfusion's commercial suite; its engineers also ran more than 60 end-to-end scenarios for .NET 11 Blazor features, Microsoft says.
Kubernetes AI Conformance moves to SIG Architecture at 31 platforms
The working group's leads from Google and Red Hat say it met its first goals, a shared baseline for AI workloads, and the next step is automated conformance verification.