Anthropic AI finds Linux kernel 9.8 flaw; 319 Chrome extensions hijacked searches

Anthropic AI model crafts remote root exploit for critical Linux MPTCP flaw

Anthropic researchers developed an exploit for CVE-2026-98432, a use-after-free in the kernel’s IPv4 TCP code scored 9.8 out of 10 and affecting kernels back to version 4.4, including Ubuntu, RHEL and Rocky Linux. An unreleased Claude model bypassed KASLR and achieved remote root code execution on a server running an MPTCP listener in about 53 minutes. MPTCP is not usually on by default, but Go 1.24 enables it for TCP listeners on Linux, so some services may be exposed unknowingly. Red Hat rates the race condition 5.9 and calls it a potential denial-of-service. Fixes are rolling out; no in-the-wild exploitation is confirmed.

Critical Linux kernel flaw allows remote root attacks on MPTCP servers →

Topics: AnthropicClaudeZero-day vulnerabilities

319 Chrome extensions with 13.4 million installs hijacked searches

Socket’s John Tuckner reported that 319 Chrome extensions with a combined 13.4 million installations redirected users’ searches through tracking servers to earn referral payments from Bing and Yahoo. The campaign expands his April 2025 finding of 57 extensions with 6 million users, adding 264 add-ons and 8.7 million more installs. The extensions pose as PDF converters, manual finders, safe search and AI tools, are unlisted on the Chrome Web Store and are pushed through shady ads. Many rely on Chrome’s chrome_settings_overrides setting and need almost no code. The largest clusters are Bing-Search with 37 extensions and 2.2 million users and SecuryBrowse with 58 extensions and 4.9 million users. Most were removed when the report published, but new ones keep appearing. Users are advised to uninstall listed extensions and run a full antivirus scan.

Chrome extensions with 13.4 million installs caught hijacking searches →

Topics: Chrome security

Eight-byte SMS crashes Android phones and can block emergency calls

Researcher Mark Blah disclosed CVE-2026-58882 on October 29, 2026, a zero-click flaw in Android’s WAP Push SMS processor. An eight-byte payload (01 06 88 80 80 80 00 BE) triggers an improper data type conversion in decodeWapPdu, causing a NegativeArraySizeException that kills the com.android.phone process and cuts cellular connectivity for one to two seconds. Blah reported 100% reproduction on Pixel and Galaxy devices; roughly 20 messages push Android’s RescueParty into recovery mode, leaving the phone unusable. The message leaves no notification or inbox trace. Google fixed the code in AOSP on June 15, 2026, and the October 2026 update patched Android 14 through 17, but Android 12 and 13 remain unpatched.

SMS of Death: An 8-Byte Message Crashes Android and Blocks Emergency Calls | DeafNews →

Topics: Zero-day vulnerabilities

cPGuard update channel compromised to push backdoor to nearly 3,000 servers

OpsShield said attackers used compromised credentials to breach the update distribution infrastructure for its cPGuard web security suite, pushing a backdoor and data-stealing script from November 2, 2026 at 02:06 UTC. Versions 5.88.12 through 5.88.19 were affected before distribution was stopped within 12 hours. The script targeted Linux password hashes, root database configuration, shell history and SSH files, uploading data to OpsShield’s licensing server through a compromised account. Evidence shows 32 files were retrieved per customer. OpsShield said 2,946 servers were affected and its billing database was copied. Administrators should update to 5.88.25 or later and rotate passwords, database credentials, cloud secrets and SSH keys.

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data →

Topics: Supply chain attacks

Unbranded kids’ camera reverse engineered to run Doom at 30fps

A children’s camera sold as the X9S, with no brand on the box or in the UI, was reverse engineered and made to run Doom while still working as a camera. EXIF data pointed to maker HX-Tech; opening the device revealed an undocumented HX3302B SoC and an 8-pin flash chip. The SD-card updater writes from the start of flash without verifying the header checksum, so changing the header timestamp by one second triggers a flash. Memory was dumped through EXIF space in JPEGs, revealing 2MB of RAM and 4MB of flash. Doom was ported via doomgeneric to the OpenRISC variant, running at around 30fps with sound, music and save/load. The original firmware was restored before the camera was returned.

Reverse Engineering a Children’s Camera (and Making It Run Doom) | Spode’s Abode →