Anthropic said Claude wrote a working attack that could give an outsider full control of a Linux server without a password. Its demonstrated attack requires the server to expose a multipath TCP listener, though the Go Security Team says the underlying bug is not limited to that feature.
Red Hat released fixes for RHEL 8, 9 and 10 on November 1, 2026. Ubuntu’s tracker still listed versions 16.04 through 26.10 as vulnerable, with fixes in progress for some versions but no release dates. Red Hat said its temporary firewall rule reduces exposure but cannot fully prevent an attack; the Go Security Team recommends upgrading to a patched kernel.
