The Hot Drop for 11-03-2026

• CVE-2026-98432 is a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later.
• A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions.
• The flaw is tracked as CVE-2026-98432 and also affects ordinary TCP connections, although remote code execution has not been publicly demonstrated on servers without an MPTCP listener.
• A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, threatens Ubuntu systems through a networking memory flaw that could cause crashes and service disruptions.
• As of 6:15 PM CST on November 1, Ubuntu's tracker lists its kernel as "Vulnerable" for every release.
• IPv6 is not affected by the first issue because tcp_v6_syn_recv_sock() duplicates the options.
• The vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.
• The flaw received a critical severity score of 9.8 and affects eight Linux kernel branches, dating back to version 4.4.
• The issue was introduced in Linux kernel version 4.4 with commit 079096f103faca2dd87342cca6f23d4b34da8871.
• The vulnerability affects any Linux kernel from version 4.4 on that lacks the fix.
• FortiGate Cloud is one of the products under investigation for the impact of the CVE.
• FortiOS is one of the products under investigation for the impact of the CVE.
• According to Canonical's security tracker, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable, with kernel fixes in progress as of October 30.

No background yet from current sources.

CVE-2026-98432 is a race-condition-induced use-after-free vulnerability in the Linux kernel's IPv4 TCP connection setup path, located in the functions tcp_v4_syn_recv_sock() within the files net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c. Introduced in Linux kernel version 4.4 by commit 079096f103faca2dd87342cca6f23d4b34da8871, the flaw affects any Linux kernel from version 4.4 on that lacks the fix, including systems that host containers. The root cause is that tcp_v4_syn_recv_sock() transfers ownership of IP options from a request socket's ireq->ireq_opt pointer to a newly created child socket without copying the underlying data, resulting in inet_opt and ireq_opt being freed after an RCU grace period and creating a use-after-free condition. An unauthenticated remote attacker can trigger the vulnerability by sending TCP SYN packets that carry IPv4 options.

IPv6 is not affected by this specific issue because tcp_v6_syn_recv_sock() duplicates the options. The flaw can lead to remote code execution, although remote code execution has not been publicly demonstrated on servers without an MPTCP listener. Red Hat classifies the vulnerability as a potential denial-of-service issue that could cause a kernel crash, assigning it a lower severity score of 5.9 because exploitation is complex.

The exploit targets Linux servers with a multipath TCP (MPTCP) listener. A scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443. FortiGate Cloud is one of the products under investigation for the impact of the CVE.

Anthropic's Frontier Red Team reported on 2026-10-27 that an unreleased Claude model wrote a working exploit for the vulnerability after a single prompt. According to Anthropic, the exploit achieved remote root code execution in approximately 53 minutes, demonstrating that the vulnerability can be exploited for purposes beyond denial-of-service attacks. An Anthropic report described the exploit as bypassing kernel address space layout randomization (KASLR) and executing arbitrary commands as root on a Linux server running a Multipath TCP (MPTCP) listener. A scan conducted on 2026-10-30 identified approximately 2,102,043 servers reachable over MPTCP on port 443.

Ubuntu states that the exploit generated by Anthropic remains unreleased. As of the time of writing, no other exploit is known to have been generated or published. The exploit generated by Anthropic is described as using Multipath TCP (MPTCP), although the vulnerability itself is not specific to MPTCP.

No detection or hunting guidance has been published in current sources.

The upstream fix for CVE-2026-98432 is commit e3f33b0a1d89d738e2b913dab519226eaf76e15b, which replaces kfree with kfree_rcu in specific destructors. Linux kernel version 6.6.159 resolves the issue with commit 742f73df544e03744f2981c467d6542fe8172a2a. The issue is fixed in Linux kernel version 5.10.272 with commit b3b027ef0cd322bfa839b9aaf5b27551eea54cf6. The issue is fixed in Linux kernel version 6.1.190 with commit 89b5b1eb7d633c33832b7ff2c02e19a144705036.

The issue is fixed in Linux kernel version 6.12.113 with commit 11a03ce3c4a62d84c10ccdfe47f8075006498568. The issue is fixed in Linux kernel version 5.15.223 with commit 95a8c8fa9f27dce64c40c41c062de7728bf34ab5. The upstream fix commit e3f33b0a1d89d738e2b913dab519226eaf76e15b is available at hxxps[://]git[.]kernel[.]org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b. The vulnerability is tracked in the EU Vulnerability Database under the identifier EUVD-2026-102025.

The CVE record lists Linux versions before b3b027ef0cd322bfa839b9aaf5b27551eea54cf6 as affected, with version b3b027ef0cd322bfa839b9aaf5b27551eea54cf6 carrying the fix. The CVE record lists Linux versions before 95a8c8fa9f27dce64c40c41c062de7728bf34ab5 as affected, with version 95a8c8fa9f27dce64c40c41c062de7728bf34ab5 carrying the fix. The CVE record lists Linux versions before 89b5b1eb7d633c33832b7ff2c02e19a144705036 as affected, with version 89b5b1eb7d633c33832b7ff2c02e19a144705036 carrying the fix. CVE-2026-98432 has been patched in versions 5.10.272, 5.15.223, 6.1.190 and others.

SUSE Linux Enterprise Server 16.0 is patched with kernel-default version 6.12.0-160000.40.1 or higher. Red Hat shipped fixed kernels for Red Hat Enterprise Linux (RHEL) 8, 9, and 10 on November 1, alongside security advisories RHSA-2026:93414, RHSA-2026:93412, and RHSA-2026:93413 for those releases. SUSE published security advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1 on October 29, 2026. Ubuntu has published fixes for CVE-2026-98432, with updates for Ubuntu 22.04 LTS and newer located in the -proposed pocket rather than the default updates channel.

Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. The Ubuntu Security Team believes that security updates are the only appropriate mitigation, because the flaw is not MPTCP-specific.

Coverage of CVE-2026-98432 spans 14 distinct outlets, including thehackernews.com, cybersecuritynews.com, linuxcvetracker.com, kb.ciq.com, suse.com, bleepingcomputer.com, csoonline.com, kernel.googlesource.com, gbhackers.com, linux.oracle.com, atlasum.net, fortiguard.fortinet.com, ubuntu.com, and access.redhat.com. The claim that Red Hat shipped fixed kernels for RHEL 8, 9, and 10 on November 1 is reported by atlasum.net and thehackernews.com. The assertion that Red Hat raised its rating of the bug from Important (8.1) to Critical (9.8) on October 30 is reported by atlasum.net. The statement that Red Hat initially rated the flaw Moderate at 5.9 before raising it to 9.8 is reported by thehackernews.com.

The observation that Ubuntu's tracker listed its kernel as "Vulnerable" for every release as of 6:15 PM CST on November 1 is reported by atlasum.net. The report that Ubuntu has published fixes for CVE-2026-98432, with updates for 22.04 LTS and newer currently in the -proposed pocket, is reported by gbhackers.com and ubuntu.com. The claim that FortiGate Cloud and FortiOS are products under investigation for the impact of the CVE is reported by fortiguard.fortinet.com. The statement that Red Hat is expediting the release of fixes is reported by access.redhat.com.

The assertion that no patched CIQ kernel had been published for any variant as of 2026-10-30 is reported by kb.ciq.com. The report that Ubuntu and Red Hat Enterprise Linux had yet to release patched kernels as of October 30 is reported by csoonline.com. No confirmed disagreements between outlets were identified. No timeline updates were identified.

• A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation.

No background yet from current sources.

Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface. The malicious flow is designed to run a shell script wrapper, which uses wget to retrieve the botnet binary for AMD64 architecture from 85.215.73[.]250. Another request has been found to run wget/curl against "45.194.90[.]57:38472" to fetch a payload called ".sys_update," save it on disk as "/tmp/.kworker" in an attempt to disguise it as a harmless kernel worker thread, and then execute it.

No details yet about who was affected or the impact from current sources.

According to VulnCheck, as of 2026-10-30, attackers were observed attempting to weaponize CVE-2026-58115 against its honeypot network in an attempt to download and run a Linux bot. The attacker infrastructure associated with this activity includes the IPv4 addresses 85[.]215[.]73[.]250 and 45[.]194[.]90[.]57.

Analysts should monitor for outbound wget requests to the IP address 85[.]215[.]73[.]250, which is used to retrieve the botnet binary for AMD64 architecture. Detection logic should also identify wget or curl requests to 45[.]194[.]90[.]57 on port 38472, which are used to fetch a payload named .sys_update. File system monitoring should flag the creation of a file at /tmp/.kworker, as this path is used to disguise the downloaded payload as a harmless kernel worker thread.

Siemens SIMATIC IoT2050 Advanced versions before V4.3.4.1 are affected by the vulnerability. The vulnerability is fixed in version V4.3.4.1.

The reporting on this incident is currently limited to a single outlet, The Hacker News. The claim that the vulnerability is under active exploitation is attributed to VulnCheck. The observation of attackers attempting to weaponize the vulnerability against a honeypot network is attributed to VulnCheck. The description of the missing authentication vulnerability in the Node-RED HTTP interface is attributed to Siemens.

The statement that the issue has been remediated in versions 4.3.4.1 or later is stated as fact by the source. The details regarding the malicious flow using wget to retrieve the botnet binary are stated as fact by the source. The details regarding the second request fetching a payload named .sys_update are stated as fact by the source. No confirmed disagreements between outlets were identified.

No timeline updates were identified.

• The vulnerability in Ivanti Connect Secure 22.8R2.4 leads to privilege escalation to root.

No background yet from current sources.

CVE-2026-111357 is a missing authentication for critical function vulnerability in Ivanti Connect Secure 22.8R2.4. The flaw allows a local authenticated attacker to escalate privileges to root. The root cause is that Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data.

Volexity observed credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys during the investigation.

In October 2026, actors exploited the vulnerability in Ivanti Connect Secure 22.8R2.4. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability, with a CVSSv3.1 score of 8.8. CVE-2026-118527 allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk.

No ATT&CK techniques were identified in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Rapid7 reported on 2026-11-02 that the October 13 fixes in versions 25[.]1[.]1[.]2 and 22.8R2.5 do not remediate CVE-2026-111357 or CVE-2026-118527, and that the vulnerability in Ivanti Connect Secure 22.8R2.4 was exploited in the wild in October 2026. According to Rapid7, Ivanti rates CVE-2026-111357 as a missing authentication for critical function vulnerability with a CVSSv3.1 score of 8.8. Rapid7 reported that the vulnerability in Ivanti Connect Secure 22.8R2.4 leads to privilege escalation to root. Rapid7 reported that Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data.

According to CISA's KEV entry, CVE-2026-118527 allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. No confirmed disagreements between outlets were identified. No timeline updates were identified.

No details yet about the affected products from current sources.

No background yet from current sources.

No technical details yet about how the attack or flaw works from current sources.

Customer communications included summaries and excerpts from sales calls, support discussions, and customer Slack conversations.

No details yet about the attackers from current sources.

No indicators have been published in current sources.

No detection or hunting guidance has been published in current sources.

No mitigation or protection guidance yet from current sources.

Two distinct outlets reported on the incident: gbhackers.com and cybersecuritynews.com. Both outlets reported that WorkOS detected the incident on October 30, 2026. Both outlets reported that WorkOS disabled external access to the affected application. Only gbhackers.com reported that WorkOS confirmed there is no evidence that attackers accessed data from the WorkOS application or impacted production services.

cybersecuritynews.com reported that customer communications included summaries and excerpts from sales calls, support discussions, and customer Slack conversations. Only cybersecuritynews.com reported that WorkOS retained an independent digital forensics and incident response firm. Only cybersecuritynews.com reported that Google Threat Intelligence Group and Mandiant describe ARTEX as a multi-agent platform that turns broad attacker goals into commands. No confirmed disagreements between outlets were identified.

No timeline updates were identified.

No details yet about the affected products from current sources.

No background yet from current sources.

VOLTA uses the victim's logged-in Gmail session to search the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. The malware uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address by extracting emails related to Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal. The default AI model used by VOLTA is Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks. If the default model refuses the request, VOLTA tries Kimi K2 and then Gemini 2.5 Flash.

The attacker receives the stolen data through a Telegram channel, including archives named volta_log.zip, volta_dox.zip, and volta_doxnet.zip. The first archive, volta_log.zip, contains the information collected by the malware. The second archive, volta_dox.zip, contains the AI analysis. A third archive, volta_doxnet.zip, is created if the malware finds additional network information.

VOLTA is a Windows infostealer that targets Gmail, Discord, and other logins. The malware extracts saved passwords, cookies, and payment cards from Chromium-based browsers. VOLTA also targets Firefox, Thunderbird, Outlook, Slack, Steam, Battle[.]net, Telegram, Roblox, and Discord. Data exfiltration occurs over Telegram at three different stages.

The first stage of exfiltration, which happens right after the stealer runs, contains details about browser passwords, cookies, payment cards, cryptocurrency wallets, Discord, Steam, and Roblox tokens, Wi-Fi passwords, and screenshots. The second stage of exfiltration, which happens after the AI call, includes the captured data and the results of the LLM analysis. The third stage of exfiltration, which happens after the live enrichment step, includes Gmail data.

No details yet about the attackers from current sources.

Analysts should monitor for outbound connections to the domain rolimons[.]com, which is identified as attacker infrastructure. Network traffic to the URLs hxxps[://]openrouter[.]ai/api/v1/chat/completions and hxxp[://]openrouter[.]ai/api/v1/chat/completions should be investigated, as these endpoints are associated with the malware's AI model usage. The file hash sha256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 has been identified in connection with the threat.

No mitigation or protection guidance yet from current sources.

• Based on MITRE ATT&CK guidance for AI Agent Tool Credential Harvesting (AML.T0098): Segmentation of AI Agent Components can prevent adversaries from utilizing tools in an agentic workflow to harvest credentials.

Three distinct outlets reported on the VOLTA infostealer: cybersecuritynews.com, securityaffairs.com, and thehackernews.com. cybersecuritynews.com stated that VOLTA extracts saved passwords, cookies, and payment cards from Chromium-based browsers, on 2026-11-02. cybersecuritynews.com described VOLTA as a new Windows infostealer that steals Gmail, Discord, and other logins, on 2026-11-02. cybersecuritynews.com listed Firefox, Thunderbird, Outlook, Slack, Steam, Battle[.]net, Telegram, Roblox, and Discord as additional targets for VOLTA, on 2026-11-02.

cybersecuritynews.com reported that the default AI model used by VOLTA is Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks, on 2026-11-02. cybersecuritynews.com reported that VOLTA uses the victim's logged-in Gmail session to search for receipts from specific retailers, on 2026-11-02. thehackernews.com stated that VOLTA uses stolen session access to search the victim's Gmail account for receipts to corroborate the home address, on 2026-11-02. securityaffairs.com reported that the attacker receives stolen data through a Telegram channel, including archives named volta_log.zip, volta_dox.zip, and volta_doxnet.zip, on 2026-11-02.

thehackernews.com reported that VOLTA exfiltrates data over Telegram at three different stages, on 2026-11-02. No confirmed disagreements between outlets were identified. No timeline updates were identified.