This isn't Linode getting attacked, it is telling customers that this zero click RCE CVE is pretty serious. You should patch ASAP.

Did you know that GO defaults to listening on TCP connections with MPTCP, so anyone running GO programs listening on the internet (Caddy, traffic, etc) and are on an unpatched kernel now have a way to from attackers to get root on that box?

Even if you're not using MPTCP, this functions as a DOS attack.

It's a very bad CVE, so yes. Follow the advisor and patch.

> It feels like we hit an inflection point in the last week or so.

This isn’t a new thing for Linode. A customer service panel vulnerability in the past was the reason Bitcoinica got hacked in the early bitcoin days: https://spectrum.ieee.org/thousands-of-bitcoins-stolen-in-a-...

What if the "inflection point" is just all of the low-hanging fruit that can be detected by agentic vulnerability scanning? If the low-hanging CVEs get patched we might not see a tsunami.

When mythos was released - I guesstimated that we had 6 months until hackers had similar enough capabilities that we would start to see real problems in the wild. Unless there is some change in the trend line things are about to get really quite spectacular.

I'm just waiting for someone to drop a real zero day on openssh or openvpn for before the real pants pooping starts.

Tidal waves are one thing, this is a tsunami.

Its really not that hard to secure your servers, especially if your not a high value target. If you are a high value target, you should have security professionals on staff.

I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.

If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.

Edit:

Damn Im getting mega downvoted for saying this. So are people of just at a consensus that there's nothing you can do? That we're in security armagedon???

Have you ever thought to consider that security took hit along with the general degradation of software because of AI??

It is almost certainly the latter, since it is another “Customer Security Advisory”. There is a currently open report for a tranche of nginx vulnerabilities[0] and a closed report for PwnEscape[1] and the PHP RCE[2] that are identical. The HN topic has been editorialised.

[0] https://status.linode.com/incidents/8dqqkh4d9y2c

[1] https://status.linode.com/incidents/zp71823t318w

[2] https://status.linode.com/incidents/wq8zlhk736fk

Yeah its unclear. Sounds like they are just now patching it and treating it as an incident which is probably the right thing to do.

I am wondering if there is something significant written with Go in their system stack (Go uses MPTCP by default on listening sockets, it seems)

Based on email I got from another big hosting provider, they're all patching for the same checksum metadata vulnerability (the CVE they mentioned is the same). There is however a root RCE PoC according to the researcher so...potentially bad.

Yeah agreed. I actually only noticed because my two boxes are super slow and I've been troubleshooting for about an hour. Finally opened up the Customer Support page and this was the top incident.

I haven't seen any emails about it, so I'd lean towards it being something that doesn't rate sending emails.

Who uses Canonical LXD?

I never even heard of it.

I find it breathlessly funny how people think it's going to be AIs vs AIs fighting it out with light sabers and plasma lasers in the cyber space or some shit.

Your intuition that this can be balanced out is wrong. When you have a CVE in your TCP stack, your vault unlocks and you're fucked, it's done. My dude, there is never going to be AIs scanning every incoming packet for signs of a 0day, and deciding whether to, uhh, cut it up with a lightsaber and shoot it with a laser pistol. Your options are to have a stack so secure that it can't be targeted, or to disconnect all network cables.

Its already happening to classic infrastructure, small and medium size businesses. Absolutely anyone can summon a gremlin capable of exploiting stuff like this or the PHP thing last week. There are clankers probing this stuff all over the place within a day of it going public.

We can call it [SI]

[whoops]

If the large and politically connected banks and brokerages have losses large enough to threaten their survival as institutions then the government will jump in to help secure them and bail them out if needed.

I would stick with a "too big to fail" institution instead of splitting across multiple.

If you want a real "backup" you could ask for physical stock certificates or get physical gold or something else that cannot be taken from you by computer hacking.

Not a full fledged app, but you might wrap something around https://github.com/google/osv-scanner/

I need this.

Mitigation is to retire and wait for the singularity.

Don't use MPTCP is the first mitigation, but my understanding is this might be exploitable without MPTCP.

Debian does have a patch up

Introducing: HNN (Hacker non-news): a list of web domains *not* currently under apocalyptic AI attack. Shorter and more parsimonious.

- Tell HNN: pets.com was *not* owned today

- Tell HNN: about:blank was safe, too

- Show HNN: my new gopher protocol project—no currently known CVE 10's

Better than the usual endless stream of what your agent did today.

Guess who has access to abliterated frontier AI models?

Primeagen went over this in the last episode or two - apparently this sort of defense is costing ... one of the big models or companies hosting them ... $900k/day or something to constantly run the best model and monitor 24/7 to combat the attacks [0]

[0] https://www.youtube.com/watch?v=9OahTki4cPA

What's the future of cybersecurity going to look like? A rapid shift to shoving everything into microvm's to minimize attack surface?

Infrastructure is an FPS now.

More likely we'll just see another shakeup of the layers of abstraction that the average company operates at. Why would you hire specialized people when AWS can do so for you?

As I understand, it's LPE. Cloud hosting was always tough.

You are being downvoted but I agree, any company including openAI, anthropic, google etc... should be closely regulated by goverment to ensure they never run any AI that doesn't follow all the rules defined by governing bodies, nor train them to have any workaround... NO ONE HAS ABLITERATED ACCESS TO ANYTHING.

Thanks god, you are not a wacko thinking qwen3.0-1.5B-abliterated would hack a goverment.

armadin.com?

We need an "ai.ycombinator.com" too.

ironic that "hacks" is a needed subdomain of "hacker news"

/incidents would do

daily sticky post...

Ask HN: Who didn't get hacked today.

Show Hacks: