Vulnerability-Management on Andrew Healey

The security industry is doing what it always does with CVE-2026-98432 and turning a narrow Linux kernel bug into a sales pitch

Sun, 01 Nov 2026 11:37:47 -0600

The security industry is doing what it always does with CVE-2026-98432 and turning a narrow Linux kernel bug into a sales pitch.

Anthropic showed that an internal model could produce a remote root exploit against systems listening with Multipath TCP. While it’s interesting research, it’s not evidence that every Linux box on the internet is one packet away from root. IP options have caused network stack bugs for decades. Most of the internet learned to drop them long ago. Your phone is fine. Your laptop is fine. Your web tier behind a load balancer or CDN is also fine. The internet will be fine.

Vulnzero is marketing

Thu, 22 Oct 2026 20:58:56 -0500

Vulnzero is marketing. But that doesn’t mean your board should ignore this warning. Will they hear it from Anthropic or your security leader? Or from the news coverage of the coming wave of breaches and hacks?

Models are getting better and faster at finding bugs. Most risk sits in legacy systems, vendor products, OT and embedded devices, unmaintained code, misconfigurations, poor practices, and process failures.

Discovery is not the constraint and never has been. Remediation capacity and prioritization is. We continue pushing vulnerabilities into prod at high rates. Configuration still misses quite often. The volume of findings will rise faster than most organizations can prioritize and fix them.