Skip to content
Critical Linux Exploit Discovered by Anthropic's Claude AI

Critical Linux Exploit Discovered by Anthropic's Claude AI

First seen 2 Nov 2026, 21:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 21:14 UTC

Anthropic's Claude AI has identified a critical Linux kernel vulnerability, CVE-2026-98432, which allows remote attackers to gain root access without authentication. This flaw, affecting Linux versions since 4.4, scores 9.8 out of 10 on the CVSS scale. The exploit leverages a memory handling error in the networking code, specifically targeting servers using Multipath TCP (MPTCP). While Red Hat has released patches, Ubuntu has not yet addressed the vulnerability in its supported versions. The exploit can be executed in under a hour, making it a significant threat to Linux servers. Cybersecurity experts have labeled this vulnerability as potentially the worst bug in internet history, prompting urgent calls for updates from affected users. As of now, the exploit has been demonstrated but is not confirmed to be in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 7d ago How this analysis works

Timeline

2026-10-15
CVE-2026-98432 published
The vulnerability was officially published, scoring 9.8 on the CVSS scale.
Decrypt.Co
2026-10-29
First public PoC released
Anthropic demonstrated a proof-of-concept exploit that can gain root access in under an hour.
Howtogeek
2026-11-01
Red Hat releases patches
Red Hat issued fixes for RHEL 8, 9, and 10 to address the critical vulnerability.
Decrypt.Co
2026-11-02
Ubuntu remains unpatched
Despite the critical nature of the bug, Ubuntu has not yet released fixes for its affected versions.
Protos

More articles in this cluster (8)

Following this threat?

Track Anthropic and CVE-2026-98432 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which Linux versions are affected?
The vulnerability affects all Linux versions since 4.4, including Ubuntu versions 16.04 to 26.10.
What should I do if I'm using Ubuntu?
Monitor for updates from Ubuntu and consider applying temporary firewall rules as advised by Red Hat.
Is this exploit currently being used in attacks?
There is no confirmation of active exploitation in the wild, but a proof-of-concept exists.