Go security team

Stories

Linux kernel patches 11-year-old TCP bug after Claude writes a root exploit

Warned that Go 1.24 enables Multipath TCP by default for Linux listeners

Linux kernels have carried a race condition in their IPv4 TCP code since October 2015, when the faulty commit landed for version 4.4. The kernel's CVE team published it as CVE-2026-98432 on October 15, scoring it 9.8 out of 10.

Updated Nov 1

Go blocks trust in eight eMudhra certificate intermediates

Rule Changes

Released Go 1.27.3 and 1.26.10 with the key block on October 20

Go has released versions 1.27.3 and 1.26.10 that refuse any TLS certificate chain built on one of eight compromised eMudhra intermediate keys. Researchers say the keys were weak enough that an attacker could forge a trusted certificate for any domain and impersonate the site.

Updated Oct 21