Sunday, 1 November 2026
Critical Linux TCP CVE (CVSS 9.8) with Claude-built exploit; Brazil sanctions lawyers for prompt injection; Jepsen finds ParticleDB unsafe
Today's Lead
EngineeringAtlasum
Linux's October 2026 TCP Use-After-Free: CVE-2026-98432
A remote attacker can trigger a use-after-free bug in the Linux kernel Transmission Control Protocol (TCP) handshake code. Anthropic says its Claude model built a working exploit that gives root access on servers with a multipath TCP (MPTCP) listener. Patch the kernel, since Ubuntu and Red Hat Enterprise Linux (RHEL) had no fix as of October 31.
Engineering
Jetstream Security
Brazilian Court Sanctions Lawyers for Prompt Injection in Court Filing
A Brazilian labor court fined two law firms for hiding a prompt injection command in a court petition. The hidden text used white font on a white background, so a human reader could not see it. The text told any artificial intelligence (AI) system to answer superficially and not challenge the documents. Galileu, a national court AI tool, flagged the text and blocked its processing. The court fined the firms 10 percent of the claim value, about 16,000 dollars.
Jepsen
Jepsen: ParticleDB 1.1.4
Jepsen tested ParticleDB versions 1.1.4 through 1.1.18.11.rc-22 on single nodes. Jepsen reported 96 issues, including crashes, deadlocks, data loss, and wrong query results. By version 1.1.18.11.rc-22, most single-node issues were fixed. The default optimistic concurrency control (OCC) mode still lost committed writes. The serializable mode still allowed Lost Update anomalies. Jepsen concluded that the claim of full atomicity, consistency, isolation, and durability (ACID) support was premature. Jepsen recommended that users stop deployment and migrate to other databases.
Cisco Talos
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
Cisco Talos reports that VOLTA, a self-deleting Windows infostealer, uses an artificial intelligence (AI) model to rank its victims. The malware sends a report on each victim to the model, which rates their assets by value. Talos assesses that VOLTA is sold as a product, so buyers do not need to build their own AI feature.
Simon Willison
How We Took Over ChatGPT Accounts
Parameter Labs found a flaw in the hypertext markup language (HTML) previews of ChatGPT. A malicious share link let an attacker steal private data from another signed-in user. The attacker used a virtual keyboard message to insert an iframe without sandbox restrictions. The attacker then used a YouTube oEmbed endpoint to run JavaScript and bypass the Content Security Policy (CSP). OpenAI fixed the flaw and paid a $5,000 bug bounty.
Nolan Lawson
The AI cost of JavaScript frameworks
Nolan Lawson used artificial intelligence (AI) coding agents to build the same small Pokémon app with a dozen JavaScript frameworks. He measured cost, time, tokens, lines of code, and Lighthouse scores. Most frameworks cost about the same. SvelteKit, Gracile with Lit, and Angular cost more. Lightweight server-rendered setups, such as Astro and Hono with htmx, sent less JavaScript and scored better on load metrics.
Humanities
daemonology.net
The Duty of a Scholar
Colin Percival argues that people with knowledge have a duty to find and share it with those who need it. In 2004, he found that Intel's Hyper-Threading feature could leak data between threads. He privately warned security teams for about six months before public disclosure. In 2009, he reported that Amazon Elastic Compute Cloud (EC2) firewalls broke Path Maximum Transmission Unit (MTU) Discovery, and he later published fixes. He concludes that staying silent because nobody asked fails this duty.