Linode Security Incident
status.linode.com
status.linode.com
If you are running services and don't yet have an easy way to react to these things with swift process defined, I hope you don't like to sleep.
Did you know that GO defaults to listening on TCP connections with MPTCP, so anyone running GO programs listening on the internet (Caddy, traffic, etc) and are on an unpatched kernel now have a way to from attackers to get root on that box?
Even if you're not using MPTCP, this functions as a DOS attack.
It's a very bad CVE, so yes. Follow the advisor and patch.
This isn’t a new thing for Linode. A customer service panel vulnerability in the past was the reason Bitcoinica got hacked in the early bitcoin days: https://spectrum.ieee.org/thousands-of-bitcoins-stolen-in-a-...
And even patching the ‘small’ cves will take us for a spin as it already has. Then there can be specific low hanging fruits that chained together make a splash.
I dont think my security posture is all that much different than it was last year. Use a Secret Manager and or encryption, have backups, strong firewall rules, use canaries of some kind.
If anything llms are making security worse because there's more people offloading their thinking on llms, or people that skipped some steps in their learning journey because they just ask the llm to do everything. I dont think its necessarily because attackers have llms now, but that contributes.
Edit:
Damn Im getting mega downvoted for saying this. So are people of just at a consensus that there's nothing you can do? That we're in security armagedon???
Have you ever thought to consider that security took hit along with the general degradation of software because of AI??
To speak to your edit: this is false equivalency. You can still decrease the odds of being hit. There are still better and worse ways to address security.
I'm not saying mythos didn't find anything new, but several people who should have known better were not using SAST/DAST tools to find potential vulnerabilities before pushing their code into the great unknown. One person I talked to said they didn't bother because GitHub automatically runs SAST tools against pull requests. I looked. Their CICD pipeline had no such tool configured. I'm pretty sure it's more appropriate to say GitHub CAN run SAST/DAST tools, if you configure it, but it won't run SAST/DAST tools by default.
This was a very small sample, but I wonder how common this type of confusion is.
[0] https://status.linode.com/incidents/8dqqkh4d9y2c
Once you declare the incident, the process includes these status page updates, alongside equivalent internal status updates.
In this case, they probably wanted to maximise coordination, so used the process designed for that.
I left because I didn't like the pressure / pager duty, but I seriously respect how smooth and well thought out their operations were.
I never even heard of it.
https://docs.cloud-init.io/en/latest/reference/modules.html#...
And then set up the subcontainers with their own cloud-init:
https://docs.cloud-init.io/en/latest/tutorial/lxd.html
So I am guessing this might appeal more broadly.
Your intuition that this can be balanced out is wrong. When you have a CVE in your TCP stack, your vault unlocks and you're fucked, it's done. My dude, there is never going to be AIs scanning every incoming packet for signs of a 0day, and deciding whether to, uhh, cut it up with a lightsaber and shoot it with a laser pistol. Your options are to have a stack so secure that it can't be targeted, or to disconnect all network cables.
It is possible to write more secure software[0], companies just choose not to prioritize security.
I think that was the joke.
I would stick with a "too big to fail" institution instead of splitting across multiple.
If you want a real "backup" you could ask for physical stock certificates or get physical gold or something else that cannot be taken from you by computer hacking.
I think these banks will probably be able to hire equivalent people in the private sector though and might not need the government help.
Simply put I don't think dropping in smart people in dysfunctional organization is going to have instant results. It will take a pretty long period of time to make them aware of all the systems with holes.
In the meantime hackers would be running off with actual information and money. More than likely I see banks turning off all kinds of systems in a panic and people with their money there being in an even bigger panic.
Don't use MPTCP is the first mitigation, but my understanding is this might be exploitable without MPTCP.
I don't see how web services proceed like business is normal.
- Tell HNN: pets.com was *not* owned today
- Tell HNN: about:blank was safe, too
- Show HNN: my new gopher protocol project—no currently known CVE 10's
(archie and veronica are non-denumerable)
Imagine swarms of abliterated frontier AI models that reach >20,000 TPS. As I said before [0] you are going to have to hire specialized security engineers or technical bodyguards from the senior to senior staff level using AI agents to protect your entire business.
Otherwise you are cooked.
Is that really the best way to do things? I’m not really sure what an agent offers here does it just look at logs and do actions? I would not really feel safe if that’s my service’s answer to security.
I could see it maybe as a really smart filter to block ips that are sending probing requests but I don’t really see that as a good reason to have an agent be sitting 24/7 looking at logs.
I'm hoping goverments take stock of what is online that needn't be.
Thanks god, you are not a wacko thinking qwen3.0-1.5B-abliterated would hack a goverment.
Ask HN: Who didn't get hacked today.