I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.
That's a very naive view on it (now) and I'll try my best to explain why.
The bad actors can discover multiple 0-days on the fly to gain access to an employer/company infrastructure with valuable data/information, or in the case of Binance, crypto. They could chain multiple such attacks going from one-company/provider to another, to another, to eventually reach their target.
To anyone interested, this is good reading material on the topic:
(1) study the Binance hack in detail
(2) OpenAI huggingface hack - focus on 0-day chaining
So you make of that what you will, but in my experience it means the exploitation comes hand in hand with some far more esoteric chain that is not easy to put in practice.
I accept that one would expect substantially shorter timelines in the age of AI, but given that WannaCry is suspected of being state-funded and even then: 1) it took a month to appear and 2) ETERNALBLUE and DOUBLEPULSAR were essentially already finished, weaponized malware off the shelf.
All of this to say that just because you don't see mass exploitation right this second doesn't mean there isn't a wormable exploit that needs patching. WannaCry didn't exist until it did, and suddenly everyone who failed to patch beforehand looked foolish.
How would you see one? Have you deployed your own army of honeypots that are actively logging and looking for corrupt IP options packets? If you're not already looking for it, I think it's very likely that most people who get hacked will have no way of knowing how it happened, so we can't consider those incidents as being a result of this particular bug.
Are you actually monitoring for this specifically or just trying to use a sample size of 1 group of servers to prove something?
https://access.redhat.com/security/vulnerabilities/RHSB-2026...
> Multipath TCP is not a required condition for this flaw.
I contemplated not even responding to you because of how unbelievably abusive and rude I have watched you be on IRC to me and many others for literally decades, and was a big reason why I quit, but I decided this issue was more important for everyone else's sake that I should still speak up.
Most of the October CVEs we've seen were situations that require an extremely complex chain of attacks - amazing if you want to break into a bank, or fuck up some grocery freezers, not so useful for scanning random public boxes and doing "hacks of opportunity"
Apologies for the lack of links - it's a scattering of random people I've read talking about this, not any coordinated study. But if you read between the lines on all of the threads about these CVEs, you'll notice a lack of "I was hit by this" stories - which is pretty normal for more complex vulnerabilities.
The reason these sat unnoticed for so long is precisely because it's difficult to actually exploit them.
If anyone has anecdotes to the contrary, I'm definitely interested in hearing it, of course!