I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux vulnerability. If you're running *BSD or Mac or Windows, not affected.
"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline."
I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller ...
This is still an issue and must be patched but I think it will be rare, very rare.
1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.
What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).
But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.
Congratulations on knowing what a bastion server is though. But that’s extremely common knowledge and doesn’t prove your point either.
Perhaps you can share how a layer 7 inspection tool might mitigate a layer 4 attack an actual networking terms?
I wish I would have received that memo. </sarcasm>
sysctl -a | grep net.mptcp.enabled net.mptcp.enabled = 0
and golang apps would just gracefully downgrade to non mptcp in that case.
"sysctl -a | grep net.mptcp.enabled" gives "net.mptcp.enabled = 1" on Debian 13 (Trixie). That's a non-server desktop install fwiw.
Edit - security advisory is here: (dated Oct 16) https://lists.debian.org/debian-security-announce/2026/msg00...
sudo ss -lnp -A mptcp
godebug multipathtcp=0
> The Go team adds that "the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks"
MPTCP is only required for the known exploit, it isn't necessarily needed.
https://en.wikipedia.org/w/index.php?title=OOM&diff=prev&old...