decrypted · 1 november 2026 · vulnerabilities and patching · supply chain · ai and llm security

A Linux kernel flaw an AI model turned into remote root

Many UK organisations run Linux kernels with a bug that Anthropic's researchers have shown can be turned into remote control of a server, with no password and no click. The flaw is CVE-2026-98432, and when the vendors last updated on Friday the main distributions were still shipping fixes. There is no confirmed exploitation in the wild, and CISA had not listed it. That gap is the useful part.

How the bug works

The flaw sits in the kernel's code for the opening exchange of a network connection. While a connection is being set up, the kernel keeps a small note of the options the caller sent. The error is a handover: ownership of that note passes to the finished connection, while another processor core may still be reading it. Picture a hotel porter handing your luggage ticket to a guest while the concierge is still reading it aloud. Shred the ticket mid-sentence and the concierge reads rubbish. In kernel terms that is a use-after-free: memory is released, then used anyway.

What Anthropic showed

Anthropic's Frontier Red Team said an AI model wrote the exploit. Against a server listening for MPTCP, a variant of TCP that spreads one connection over several routes, it gave an attacker a root shell with no credentials. It worked in two stages: leaking a kernel address to defeat the randomisation that hides where the kernel lives, then overwriting a pointer to run a command. A lost race only fails the handshake rather than crashing the machine, so an attacker can simply retry. In the proof of concept, the leak took 48 minutes and the command another five. Slow, but patient machines do not mind waiting.

What defenders can do now

Patching was uneven. Ubuntu rates the flaw High with a 9.8 score, and listed 22.04, 24.04 and 26.04 as vulnerable with work in progress. CIQ, which supports Rocky Linux, said it had no patched kernel yet for its enterprise builds. Its interim advice is an nftables rule dropping IPv4 TCP packets that carry IP options. It is not a complete fix, it can block legitimate traffic, and switching off MPTCP alone is not enough, because plain TCP stayed reachable in its testing.

A defender will probably see very little. So start with an inventory: which internet-facing Linux machines, including cloud images, run an affected kernel, and who owns each one? Then ask your distributor daily until the kernel update lands.

The Secure by Design lesson

Memory-safety bugs are among the oldest stories in systems code. The upstream fix is small: CIQ says it frees the memory only after a grace period. The cheaper lesson for a director is about exposure. If nobody can say why a server listens for an exotic protocol, it should not. Switching off unused services costs an afternoon, and it shrinks what an attacker with a patient machine can reach. With models now writing exploits, plan patch windows in days, not weeks.

Also this week

Supply chain. Polymarket halted trading on its international platform on 29 October after unauthorised withdrawals, and said a third-party provider had been compromised. SecurityWeek reports that researchers linked the theft to malicious code served from DebugBear, a UK website performance monitoring firm, which confirmed an ongoing incident and urged customers to remove its monitoring snippet. Hudson Rock says the script reused each logged-in user's own session to sell positions or move tokens, rather than stealing passwords. Loss estimates differ, from about $2.19 million to about $2.71 million, and how the script was tampered with is undetermined. The lesson: any script your site loads from a vendor runs with your users' authority, so ask whether it needs to run on pages where people log in.

AI security. Northflank, a developer platform, said on 30 October that users had reported unauthorised use of AI API keys (the credentials one program uses to call another) supplied to it, and told customers to assume all environment variables had been decrypted and to rotate every key. The cause and number affected are undisclosed. BleepingComputer reports that Wiz counts at least nine AI developer platforms hit in October, and that in two cases stolen enterprise credentials ran about 2.5 million Amazon Bedrock calls worth roughly $100,000. Wiz has not confirmed a single set of attackers. A key in an environment variable is a bearer cheque: scope it, cap its spend and rotate it.

Breach. Chainalysis disclosed that an outside actor "using offensive agentic techniques" reached its internal systems and tools this month. It says the data accessed was user IDs, full names, email addresses and organisation role labels, and that it found no investigation content, clear-text passwords, multi-factor secrets or session tokens touched. It says the incident is unrelated to the Binance theft, and has published no technical detail. Names and job roles are exactly what impersonators need, so staff of customers should expect convincing approaches.

Sources

Want a hand working out what is exposed on your own estate? get in touch.