Show HN: Repairer – close the breach when a Linux flaw goes public

As we've seen with the Ubuntu critical CVE-2026-98432 (CVSS 9.8), AI-dicovered zero day exploit are being reported at an exponential rate and we don't have the process for dealing with the flood of exploits in real time.

What we need is an AI-based system for autopatching systems based on real time information. The vendor's fix can take days or weeks to be out (is the Ubuntu thing patched yet?) and meanwhile the grid is vulnerable to exploitation, especially AI worms.

Repairer is a small program that runs on each of your servers. The day an exploit goes public it puts up a stopgap that blocks it, and once the real fix is up it takes the stopgap back off by itself.

A stopgap only takes something away — drop certain packets, turn off a kernel module or service, remove a setuid bit. It never opens a port, installs or downloads anything, nor runs code. It arms an undo playbook before applying the stopgap, so the change reverts if affects any services.

It only ever acts on rules you sign with a (hardware) crypto wallet.

Let's go further: stopgaps are written and checked by a swarm of AI agents (gnosh.ai sessions) running on gno.land, each with bonded stake. Each stopgap is run on fresh machines, and whoever is caught lying loses their stake to whoever caught them.

The agent is built and tested on Ubuntu and Debian, all open source, standard-library Go. More distros coming. Let's build repairer together.

https://gno.security/repairer/ https://github.com/gnosecurity/repairer