ΛRIΞN👨‍💻 de Groot

CVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity. ubuntu.com/security/CVE-2026… The vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One of the most fundamental components of an operating system used by millions of servers. Now Anthropic reports that Claude discovered this flaw and developed a working exploit that allows remote code execution as root, without authentication, against a server with an MPTCP listener. anthropic.com/research/disco… Think about what that means. For decades, we’ve been building critical infrastructure out of enormous amounts of complex, memory-unsafe code. Humans wrote it. Other humans reviewed it, tested it and searched for vulnerabilities. All working with the same fundamental limitations: limited time, limited attention, incomplete visibility and an inability to reason about every possible interaction and race condition. And perhaps that’s what protected us to some extent. Attackers had the same limitations as the people developing and defending these systems. A vulnerability could remain undiscovered for 11 years, even in such a widely used component. Now AI is changing that balance. The ability to inspect code, identify subtle weaknesses and develop working exploits is becoming less dependent on a small number of highly skilled researchers. These activities can increasingly be scaled with compute, automated testing and tokens. And that’s what worries me about the next few years. We’ve accumulated decades of complex, memory-unsafe code in operating systems, network services, applications and libraries. Much of it has never been assessed with anything close to the capabilities that are now becoming available. We may have massively overestimated the security of our software simply because the people looking for vulnerabilities were as limited as the people who introduced them. That balance is breaking down, and I don’t think we’re prepared for what follows.