Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [ACTIVE] · [TECHNOLOGY]
2 clusters · 16 sources · 3 days · First seen · Last updated
Critical cybersecurity vulnerabilities in server software
Overview
In late October 2026, two major security vulnerabilities were identified in core server infrastructure components.
First, researchers discovered a critical flaw in the TianoCore EDK II open-source codebase, tracked as CVE-2026-97631. This vulnerability, which carries a CVSS score of 9.5/10, involves a buffer overflow in the PXE-Base Code driver. Because the exploit occurs during the DXE phase of the boot process, it can bypass security mechanisms like Secure Boot. The flaw primarily impacts servers and data center infrastructure that utilize the Preboot Execution Environment (PXE) to boot over a network.
Separately, a critical Linux kernel vulnerability, CVE-2026-98432, was disclosed. This flaw involves a race condition during the assembly of SYNACK responses to retransmitted SYN packets, which can lead to a use-after-free error. On October 27, it was demonstrated that this vulnerability could allow remote command execution with root privileges on servers running Multipath TCP (MPTCP).
New details released on October 30 indicate the vulnerability carries a severity score of 9.8/10. On October 27, Anthropic demonstrated a successful exploit using AI-generated code that allowed for remote command execution without authentication or user interaction. While the CVE team announced the issue on October 15 and patches have been integrated into stable kernel versions, remediation progress varies by distribution. Amazon Linux 2023 has released updates for kernels 6.18 and 6.12, while some Ubuntu versions were reported as still being in the process of being patched as of late October. Mitigation efforts include kernel updates and the implementation of firewall rules to block specific TCP packets with IP options.
Entities
Anthropic · Google · EDK II · TianoCore · Linux kernel
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 4 SOURCES] The Linux kernel vulnerability CVE-2026-98432 has a CVSS severity score of 9.8. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 4 SOURCES] Anthropic demonstrated an exploit that achieves remote root command execution without authentication. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 4 SOURCES] The CVE team publicly disclosed the vulnerability on October 15, 2026. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 3 SOURCES] The vulnerability is a use-after-free (UAF) flaw in the IPv4 TCP communication processing. ascii.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 3 SOURCES] The Anthropic exploit targeted servers using Multipath TCP (MPTCP). ascii.jp · dev.classmethod.jp · weekly.ascii.jp
- [○ 1 SOURCE] Amazon Linux 2023 has released security updates for kernel 6.18 and 6.12. dev.classmethod.jp
- [○ 1 SOURCE] As of October 30, no worldwide attacks exploiting this vulnerability have been reported. blog.calil.jp
- [○ 1 SOURCE] Blocking IP options in TCP packets can serve as a mitigation measure. blog.calil.jp
Timeline
-
[TECHNOLOGY] 4 sourcesLinux kernel vulnerability CVE-2026-98432 allows remote root access
A critical Linux kernel vulnerability (CVE-2026-98432) with a 9.8 severity score allows remote, unauthenticated root access via a use-after-free flaw in IPv4 TCP processing.
-
[TECHNOLOGY] 12 sourcesTianoCore EDK II UEFI vulnerability threatens global server infrastructure
A critical 9.5-rated UEFI vulnerability (CVE-2026-97631) in TianoCore EDK II allows code execution on servers during the PXE boot process, bypassing Secure Boot before the OS loads.
Sources
ad-hoc-news.de · ascii.jp · bild.de · breezyscroll.com · cybernoz.com · dev.classmethod.jp · dev.to · developpez.net · econoTimes.com · emarketerz.fr · gae.calil.jp · gamemag.it · newsbytesapp.com · researchsnipers.com · weekly.ascii.jp · wired.com
This summary has been updated 1 time: see revision history