Show HN: Kairos – Open-source risk and fraud decisioning platform
Kairos is an open-source platform for real-time event intelligence and fraud and risk decisioning. It focuses on analyzing financial behavior to support risk decisions. (github.com)
Fixes available in -proposed pocket for CVE-2026-98432
ubuntu.com3 points3 comments
CVE-2026-98432 is a critical Linux kernel vulnerability, rated 9.8 on the CVSS 3.1 scale, in the handling of IPv4 TCP connections. It affects kernel versions 4.4 and later and could allow remote code execution. An exploit attributed to Anthropic is described as using Multipath TCP (MPTCP), but the flaw is not limited to MPTCP; no other generated or published exploit is known. Ubuntu says disabling MPTCP is not an adequate substitute for installing the security update, since the underlying vulnerability is broader.
Fixes for Ubuntu 22.04 LTS and newer are undergoing qualification and can currently be installed from the archive’s -proposed pocket by users prepared to test kernel updates. The fixes are listed for Jammy (kernel 5.15.0-203.213), Noble (6.8.0-149.149), and Resolute (7.0.0-43.43); Ubuntu 26.10 is already fixed in kernel 7.3.0-10.10. Trusty is not affected, while fixes for Xenial, Bionic, and Focal are pending. Canonical plans to move the qualified updates to the regular updates pocket after testing across more than 2,000 certified servers and devices. Users can check their running kernel with uname -r; installing a proposed kernel requires explicitly targeting the release’s -proposed pocket, followed by a reboot. Older releases may require Ubuntu Pro and its applicable Expanded Security Maintenance coverage.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
More in Security
DOJ warns FBI data breach likely extends to Justice Department employees
The DOJ warned that a data breach involving the FBI likely also affected Justice Department employees. The warning indicates the breach may extend beyond the FBI. (politico.com)
AI Agents Used by Railway Breach Systems of Rival Primcloud
AI agents were used by Railway to breach systems belonging to rival Primcloud. The incident involved an attack on a competing cloud provider’s infrastructure. (securityboulevard.com)
I Dumped Apple's Fucking Word List
macOS includes a profanity-usage database designed to track swear words by app and recipient so autocorrect can adapt, though the author’s database stayed empty. Apple’s system dictionary privately classifies words across 15 languages by offensiveness and topic, with surprising labels for some names and terms. (helgesver.re)
Apple opens the door to a nightmare world of always-listening tech
Apple plans to add Apple Watch features that continuously listen and turn nearby conversations into transcripts or daily summaries, while saying audio isn’t stored and summaries are encrypted. Privacy experts warn the features could normalize intrusive listening, encourage less secure copycats, and conflict with recording-consent laws in some U.S. states. (this.weekinsecurity.com)
$20M in Fines and Vizio Smart TVs Opt Out of Spying Option Does Nothing
A Northeastern University study found that Vizio smart TVs kept sending the same amount of network traffic after users turned off tracking, while results varied across other brands. The findings raise doubts about whether Vizio’s opt-out controls work, despite $20 million in fines. (pcper.com)