SANS ISC explains how to spot Multipath TCP on a network after a new Linux MPTCP flaw
Johannes Ullrich's diary walks through the MPTCP option, its subtypes and where it shows up in practice, mainly iOS connections to Apple's 17.0.0.0/8 range.
Security
An email address gave code execution on GNU Savannah, home of Bash
Hacktron's write-up shows how a backtick payload in the account email reached a shell, then superuser, maintainer impersonation, root and a backup server; the FSF fixed 26 reported flaws.
Linux multipath TCP bug allows remote root; Go servers use MPTCP by default
CVE-2026-98432 is a race-induced use-after-free reachable by packets alone; the fix frees the structure after an RCU grace period and is in the maintained stable kernels.
Ubuntu reissues a Blazor debug proxy fix and patches .NET Brotli flaw
USN-8958-1 says the earlier fix in USN-8942-1 was incomplete; dotnet8, dotnet10 and dotnet11 packages are updated across Ubuntu 22.04 to 26.10.
Ubuntu fixes authd flaw that could map a cloud identity onto another user's account
USN-8957-1: authd did not properly validate identities when matching provider accounts to local users; after updating, authd must be restarted.
Cloudflare: 155 GLM-5.3 responses leaked other users' prompt data
A KV cache pool smaller than the advertised context plus an SGLang rejection-path bug let decode nodes read stale pages; the model was pulled within 40 minutes of the incident call.
YARA-X 1.22.0 adds 64-bit integer readers to the rule language
The Rust rewrite of YARA ships 11 improvements and nine bug fixes, including int64, int64be, uint64 and uint64be functions for reading 64-bit fields.
Red Hat's first Security Signals report argues for remediation speed over CVE counts
The Q3 2026 report models one reusable JAXB fix at 285,000 affected Java apps and $712.5 million of avoided work; the figures are Red Hat's own model, tied to its Lightwell service.
Ubuntu USN-8933-1 patches 12 RabbitMQ Server flaws, from TLS client-auth bypass to XSS
Canonical's 15 October notice covers six LTS releases; the issues include a trust-store plugin that mis-validated client certificates, credentials in an insecure cookie and several denial-of-service bugs.
Ubuntu USN-8932-1 fixes nine curl flaws, from proxy credential leaks to an FTP use-after-free
Canonical's 14 October notice patches curl and libcurl on six Ubuntu LTS releases; the issues include credentials sent to a proxy, HSTS downgrades, IMAP command injection and a use-after-free in FTP wildcard matching.