2026-11-02
What the fuck, Ubuntu?
In case you missed it: CVE-2026-98432 is a crucial (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so practically all Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a operating utilize that gets base on a server. A total takeover.
Debian patched it on October 16. Ubuntu motionless doesn't have a place additional than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".
Ubuntu's website promises "timely patches for crucial vulnerabilities." Ubuntu hasn't shipped the place nine days following it was rated 9.8 and six days following a operating base exploit. Very fucking timely indeed.
Software is complete of this blabber anywhere words average nothing. Ubuntu uses words akin these: "Timely." "Enterprise-grade." "Production grade." "Enterprise resilience. Developer velocity. Build alongside confidence on Ubuntu."
Somebody, or perchance worse, several particular squad at Canonical is dedicated to penning these........
So I'm asking again... What the fuck, Ubuntu?
I'm moving all my servers off Ubuntu. I've entirely misplaced rely in it. On the desktop I continually hated it anyway. On servers I mostly used it since it's the default on most VPS providers, and I considered it the solid, no-drama LTS distro. Fuck that now.
I can't province how insane this is. I didn't have period to migrate my services and data whenever I learned about this, so I had to obtain all my servers that run Ubuntu offline.
Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu, made by a business that sells safety subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.
