Solving problems you didn't know you had. โฌข @InfinityBotList ยท @TryByteSend ยท @TryEmberly โฌข Married to @CallMeAByte & @code โฌข CEO @NodeByteLTD ๐ฌ๐ง
In my Igloo
Joined May 2018
- Tweets1.8K
- Following81
- Followers479
- Likes1.5K
I guess Hacktober isnโt over yet
โผ๏ธ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit.
The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10.
The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default.
The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable.
Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10.
Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.
๐งโ๐ป
@shufflebotlol is coming back thank you @CodeMeAPixel for the help with me not knowing how to get spotify stuff to work. โค๏ธ๐คฃ
And somehow this is how I spend most of my days ๐
Security update: Popplio 1.15.2 and Omniplex 1.8.1 fix four issues, including a webhook SSRF and a short-link open redirect.
omniplex.gg is already patched, so there's nothing you need to do. Self-hosting? Please update.
Details ๐
omniplex.gg/blog/security-upโฆ
Pixel ๐จ๐ฆ retweeted
๐จ UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild.
Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64.
Patch now โ 22.23.4 / 24.22.1 / 26.12.1
Read โ thehackernews.com/2026/10/reโฆ
@five_pd kinda wondering what the plans are here now that development has ceased in FivePD v2 ๐ค
Pixel ๐จ๐ฆ retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. ๐ฅ
You canโt be serious, youโre the one that started this entire process and now you just sit back and act like staying in Canada was the plan all alongโฆ. Mad that you didnโt get what you wanted and the people told you to be a better government instead?
Thank you, Alberta!
Iโm very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
ย
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Pixel ๐จ๐ฆ retweeted
Thank you, Alberta!
Iโm very pleased to see the initial results from Elections Alberta show widespread support for remaining in Canada. Albertans have voted for a stronger Alberta in a united Canada.
Thank you to all Albertans who took time to vote on these critically important referendum questions.
ย
Tomorrow evening, October 20, I will address Albertans live at 6:45 p.m. to discuss the results of all referendum questions for which results are available, and where our province goes from here.
Have you ever looked into infisical? They have a CLI that can encrypt and store secrets outside of your env and inject them back into memory when needed
They also have a extremely generous free tier (and are open source if you prefer self hosting)
๐ infisical.com
Make sure you update Node too folks, PHP isnโt the only one having a bad week ๐ซก
๐จ High-severity Node.js flaw could allow remote code execution; CVE-2026-111497
Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
โ
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
โ
Affected:
โข Node.js 22.x
โข Node.js 24.x
โข Node.js 26.x
Fixed:
โข Node.js 22.23.4
โข Node.js 24.22.1
โข Node.js 26.12.1
โ
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.
Administrators should upgrade and restart affected services.
Source:
nodejs.org/en/blog/vulnerabiโฆ
Vercel putting in that work like always ๐ช
