critical

CVE

CVE-2026-98432, CVE-2025-34291

CWE

CWE-416, CWE-362, CWE-787, CWE-506, CWE-494, CWE-829, CWE-346, CWE-94, CWE-78

Affected Surface

  • Go 1.24+ network services on unpatched Linux kernels where MPTCP listeners remain enabled
  • Developer workstations that installed `anthropic.claude-code` `2.1.313` from the Cursor marketplace during the 29 October exposure window
  • Langflow deployments with vulnerable refresh-token and CORS settings, especially internet-facing AI workflow platforms that store provider and infrastructure secrets

Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.

This edition covers research published from Wednesday, 28 October through Tuesday, 3 November 2026, following the prior 27 October briefing. No interim weekly briefing landed between those Tuesday editions, so the 33 English-language research posts below are all new to this roundup.

Top Article

CVE-2026-98432: Linux kernel IPv4 TCP options RCU use-after-free exposes Go 1.24+ default MPTCP listeners to remote root RCE

Anthropic’s Frontier Red Team deserves the discovery credit here, especially Xinyang Ge, and the Go Security Team deserves credit for showing why the blast radius reached far beyond one kernel advisory. This leads the week because it turns an old-looking race in Linux TCP option handling into a zero-click remote root path on a very modern deployment shape: Go services on Linux, where net.Listen quietly enables MPTCP by default in Go 1.24+. The practical takeaway is harsh and immediate: patch and reboot the kernel, then disable MPTCP anywhere the reboot cannot happen right away.

Read it beside Corgea’s coverage of Fragnesia’s page-cache local root path, Tailscale’s Tailworm audit, PHP2Shell’s pre-auth runtime compromise, and Node.js’s October security release. Different stacks, same lesson: small defaults in runtime plumbing can decide whether an attacker needs a foothold or gets one for free.

More news

Trojanized anthropic.claude-code 2.1.313 in the Cursor marketplace planted an SSH backdoor on up to 5,000 developer machines

Cursor deserves the disclosure and remediation credit, while OpenSourceMalware, StepSecurity, and Socket produced the clearest public teardown of the implanted loader. This story belongs near the top because no prompt was needed. A marketplace-delivered extension build appended an attacker’s SSH key, wrote persistence, and opened a reverse tunnel from the developer’s own machine. Any team that still treats editor extensions as harmless convenience software should update that mental model.

For adjacent context, pair it with Corgea’s reporting on the testmetest and @iobandamwer/* npm worm, 29 fake-interview Tailwind and Animate.css plugins that hid their real payload in private npm scopes, OpenCode and MCP Inspector’s OAuth URL RCE, the Strands, LangGraph, FastMCP, and MLflow advisory cluster, and @nx/docker’s release-job shell injection flaw.

CVE-2025-34291: Langflow CORS and refresh-token chain reaches RCE

Obsidian Security and VulnCheck produced the clearest public exploit path, CISA supplied the urgency by adding the bug to KEV, and IBM’s late-October CNA wave made it obvious that Langflow’s security problems were not isolated. It stays near the top because it turns an ordinary browser visit into token theft and then into authenticated code execution inside a workflow platform that often holds model keys, database credentials, and internal automation secrets. For teams that let AI sandboxes drift into production, this is the article to read first.

Keep it in the same reading stack as Agno, LiteLLM, Hydra, vLLM, and NVIDIA NeMo, Strands, LangGraph, FastMCP, MCP Python SDK, and MLflow, PraisonAI, Crawl4AI, @sylphx/pdf-reader-mcp, and llama.cpp, OpenCode and MCP Inspector, and n8n queue mode’s Redis package-install issue. The products differ, but the pattern keeps repeating: convenient orchestration features become remote trust boundaries the moment real secrets and code execution enter the picture.

Other news:

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Explore secrets scanning Get Demo

References