Ubuntu still unpatched for kernel RCE CVE-2026-98432 after nearly three weeks
Themes & analysis
AI agents are now both attack tool and attack surface
ARTEX is being used against 200+ organizations, WorkOS reports a breach tied to it, and stolen LLM tokens cost victims over $100K a day. On the research side, new arXiv papers describe attacks on coding agents (Kerkoporta, Step-Zero, the tool update gap, earn-then-exploit fraud). A Schneier-quoted comment says AI found about 3% of all recorded critical bugs in the last month. Speculation: defenders will need to treat agent harnesses and API keys as production assets, as they already do for servers.
Neglected embedded devices are becoming bulk criminal infrastructure
The XCPE botnet used 1.3 million backdoored TV boxes. Siemens IoT2050 devices are exploited through a missing authentication check, refrigeration controllers are being altered across Europe, and Synology NAS boxes are hit through a flaw patched in December 2024. These devices are rarely patched and often sit outside normal monitoring. The common failure is lifecycle management, not novel exploitation.
Patch latency is the weak point, from Ubuntu to GitLab
Ubuntu has left a critical kernel RCE unfixed for nearly three weeks. Over 1,000 GitLab servers remain exposed to a maximum-severity bug, and BTCPay instances at 2.4.1 or earlier are being drained. AWS engineers are discussing how to cope with kernel CVE volume. As AI-assisted discovery raises disclosure rates (a reasoned inference, not stated in the sources), the gap between disclosure and fix will matter more than the disclosure itself.
AI's capital appetite is straining balance sheets and supply chains
Anthropic reports $900B in commitments and a compute tab that may top $1T. Oracle raised $20B and Marvell is buying Lumentum for $115B, while chip stocks lost roughly $3.5T in a rout. Apple's inventory rose 154% on memory costs, and Raspberry Pi raised prices a second time in a month. xAI throttled Grok on cost grounds, and Gartner says open models do 90% of agentic work at a twentieth of the price. Speculation: the cost gap will push buyers toward cheaper models.
Companies are citing AI as a reason for layoffs
SUSE is cutting about one in ten employees and its CEO attributes the change to AI-driven workflows. Squarespace is cutting 19% in a restructuring. Bloomberg reports that jobless engineers are being left out of San Francisco's AI wealth boom. The attribution may be partly framing, but the pattern is consistent across a vendor, a web host and a regional labor market.
Watch list
Canonical's fix for the Linux kernel RCE CVE-2026-98432, now almost three weeks after disclosure. Until it ships, Ubuntu hosts remain exposed.
Watch for Canonical kernel security update or advisory for CVE-2026-98432
Anthropic's IPO process after the amended prospectus, including the opinion pressure on the SEC and any answers to open questions about its commitments.
Watch for Further S-1 amendments or SEC response
Exploitation of Siemens SIMATIC IoT2050 CVE-2026-58115 (CVSS 10.0). The summary does not say whether a patch exists, so check the Siemens advisory and CISA.
Watch for Siemens advisory or CISA KEV addition
The supermarket refrigeration attacks are in a second wave, with Danfoss involved. Watch for more countries, attribution and vendor guidance.
Binance and Trigger.dev fallout: Binance's final loss figure and tracing of North Korean funds, and Trigger.dev's cause and scale, which are still undisclosed.
Watch for Binance restitution statement or Trigger.dev post-incident report
Carried over from yesterday: Fedora 45 (November 3), the Apple Intelligence China iOS 27.3 beta (November 4), the touchscreen MacBook Pro shipping November 6, and Linux 7.4-rc2. Ivanti Connect Secure CVE details, LXD and MicroCloud, and China's Mofcom No. 48 had no news today.
Watch for November 3 to 6 releases, then Linux 7.4-rc2