root@kryptonwolf:~/writing$

writing — november 2026

Research notes from november 2026. The current month, and the essays, live on the writing page.

A Zero-Click Root Exploit Was Written Against an IPv4 Handshake Race That Has Sat in Every Linux Kernel Since 2015. The Fix Landed Upstream October 15 and the Debian Family Has Already Shipped It. Check Which Kernel Your Box Is Running.

CVE-2026-98432 is a use-after-free in the TCP/IP stack's IPv4 SYN-handshake path: since commit 079096f in kernel 4.4 (October 2015), a retransmitted SYN...

Correction: Gitea Published Twenty-Nine Advisories on October 6 and Twelve on October 18, Not Three and Seven. This Site Counted a Web List Whose Pagination Does Not Sort by Date.

Corrections are cheaper than trust, so here is the one: the October 19 post on this site counted seven advisories published with Gitea 28.2.0 and "ten since...

Forgejo Ended 16.0's Support Three Days After Fixing the Review That Runs Actions as Trusted From an Arbitrary Commit. Git LFS Patched Four CVEs That Fire Near the Clone. The Pull Path Was October's Bug Class.

On October 26 Forgejo shipped 17.0.1, 16.0.7 and 15.0.11 as security releases across all three maintained branches: a pull_request_review event carries a...

The Release You Pinned Was Rewritten in Place: the OVHcloud CLI Swap and the Cursor-Marketplace Extension, Two Channels, One Lesson.

On October 19 between 12:47 and 14:21 UTC, a compromised but real OVHcloud contributor account — keys stolen via a malicious VS Code extension a year...