Ubuntu has not released patched kernels for CVE-2026-98432, a vulnerability rated 9.8 out of 10 for severity, nearly three weeks after it became a concern. Ubuntu’s 22.04, 24.04, and 26.04 LTS releases remain without an official kernel update that fixes it. The headline characterizes the issue as a zero-day remote-code-execution flaw, but the available details do not explain its technical mechanism or specify the conditions needed to exploit it.
The delay leaves administrators using those LTS kernels without a vendor-provided fix. The risk is especially significant for internet-facing servers and multi-tenant systems, where kernel security helps enforce boundaries between users and workloads. Ubuntu has given no expected release date, so affected operators must choose whether to continue running stock kernels, use any available mitigations outside the official kernel packages, or move workloads to a kernel or release that already includes a fix. Until an update or reliable mitigation is available, administrators cannot rely on a standard Ubuntu kernel package to close the vulnerability.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Attackers stole enterprise cloud and AI credentials to run up fraudulent model-usage charges, with some companies facing bills near $1 million. Criminal groups resell stolen access through illicit gateways, prompting Google to urge stronger credential security and monitoring. (cloud.google.com)
Milner Mayor Craig Timmons secretly GPS-tracked Police Chief Bunn over timesheet concerns, bypassing city council approval. The chief, five officers, and city manager resigned, leaving the Georgia town without full-time police officers. (gadgetreview.com)
A Google Android partner allegedly infected 1.3 million set-top boxes with malware and turned them into a botnet. Google says the manufacturer intentionally hijacked the devices. (theverge.com)
WorkOS detected unauthorized access to an internal API, exposing data from Salesforce and Snowflake, including customer contact details, business information, and support tickets. WorkOS says it has found no evidence that customer application data or production services were accessed or affected. (news.ycombinator.com)
![I discovered a sound that leaks your exact location (and it's everywhere) [video]](https://hntoday.pixelshot.io/screenshots/20261103/3cae09e1cadc4410_tn.jpeg)
A sound signal found in everyday environments can reveal someone’s exact location. The discovery raises concerns about location privacy. (youtube.com)
The New York Times and several other publishers sued Brave, alleging it scraped and distributed copyrighted content to AI companies without permission. The lawsuits also challenge Brave’s paywall-bypassing feature and ad blocking, and seek damages and an injunction. (techcrunch.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.