Anthropic's Internal Claude Model Writes Exploit for Linux Kernel CVE-2026-98432 Enabling Remote Root Command Execution

An unreleased internal model from Anthropic generated a working exploit that achieves remote command execution with root privileges on a Linux server configured with multipath TCP (MPTCP). The exploit targets CVE-2026-98432, a use-after-free vulnerability in the Linux kernel network stack that occurs during parallel TCP request processing. Researchers first used the model to bypass KASLR address randomization, a process that took 48 minutes, followed by five additional minutes to seize control and execute arbitrary commands. The Linux kernel team rated the flaw 9.8 on CVSS while Red Hat assigned it 5.9, citing exploitation complexity. A patch has already been merged into the mainline kernel and supported stable branches, though users must verify availability through their distribution vendor. Anthropic emphasized that the experiment relied on a non-public model and cannot be reproduced with standard chat interfaces.

AntiMalwareOctober 30, 2026Translated from Russian

Read at source

An unreleased internal model developed by Anthropic has autonomously created an exploit that grants remote root command execution on Linux servers using multipath TCP (MPTCP).

The model was given an initial task and produced working code that leverages CVE-2026-98432, a use-after-free flaw in the Linux kernel network stack. During concurrent TCP processing, one code path can free memory while another continues to reference it, enabling memory corruption.

The attack proceeds in two stages. First the exploit bypasses KASLR kernel address randomization, requiring 48 minutes to locate the necessary memory address. Once the address is obtained, an additional five minutes are needed to hijack control flow and spawn a root shell.

Scoring differences highlight varying risk assessments: the Linux kernel team assigned the vulnerability a CVSS score of 9.8, while Red Hat rated it 5.9, noting the practical difficulties of exploitation in default configurations.

A fix has already been committed to the mainline kernel and all supported stable branches. Administrators are advised to check with their specific distribution vendor for the availability of updated packages.

Anthropic Red Hat CVE-2026-98432 KASLR MPTCP

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram Voice Call Flaw Enables Remote Code Execution on Android Devices

Security researchers disclosed on October 29, 2026 a vulnerability in Telegram for Android that allows arbitrary code execution on a victim's device simply by answering a voice call. The flaw resided in the handling of short MediaState messages exchanged during calls, where missing fields caused the application to read unauthorized memory. Telegram addressed the issue in version 12.10.4 released at the end of September 2026, covering versions from 8.6.2 through 12.10.3 issued between March 2022 and September 2026. The same underlying fix had been deployed earlier in the shared calling library on April 21, 2026, reaching iOS in May, desktop in July, and Android only in September. Researchers confirmed the impact exclusively on private calls running on ARM64 Android devices and found no evidence of exploitation on iOS, desktop, or group calls. Users are advised to check their Telegram version in settings and update immediately, while enterprise administrators should audit device fleets given the four-and-a-half-year span of affected releases.

BoletimSecOct 30, 2026Translated from Portuguese

Vulnerabilities & Exploits

Cisco Talos Details KeyDrift Malware Exploiting Critical CVE-2026-20127 Zero-Day in Catalyst SD-WAN

Cisco Talos published an analysis on October 28, 2026, of the KeyDrift malware set designed to reside inside Catalyst SD-WAN controllers and extract keys protecting inter-site traffic. The initial access vector was the critical CVE-2026-20127 authentication bypass, scored 10.0 on CVSS 3.1, affecting the peer authentication mechanism between the Catalyst SD-WAN Controller, Manager, and Validator. Attackers could obtain administrative privileges remotely without credentials by sending crafted requests. The Cisco patch was released in February 2026 and the CVE was added to the CISA catalog on February 25 with a two-day remediation deadline. KeyDrift consists of two core modules: the memory-resident PolyFlame backdoor injected into vdaemon processes and the LittleFilch component that intercepts decrypted session identifiers and 32-byte AES-256 IPsec keys distributed via the OMP protocol. Observed targets include space and satellite services, defense contractors, aerospace technology firms, and public policy research institutes. Talos assesses with high confidence that the UAT-11473 infrastructure overlaps significantly with the Silent Train access network linked to Volt Typhoon, though the groups are not confirmed to be identical.

BoletimSecOct 30, 2026Translated from Portuguese

Vulnerabilities & Exploits

360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform for Enterprises and SMEs

360 Security Cloud has officially launched a dedicated self-assessment platform for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small and medium-sized businesses. Organizations can use the platform to determine how many of their websites and systems run on PHP, identify which instances are on affected versions, and check whether any have already been compromised. Access is granted after scanning a provided QR code and submitting an application. The announcement emphasizes the need for proactive detection of this PHP-related security issue across production environments. The platform aims to give security teams actionable visibility without requiring external assistance.

安全客Oct 30, 2026Translated from Chinese