A penny for every exploit I read about
What a week it has been. And by that, I do not mean a fun one. After the tech Halloween we saw last week, I hoped we would get some better news. Unfortunately, I do not come with better news this time.
I highly recommend reading this while walking your way to a park because you might want to switch your phone off and touch grass after this one.
The exploit affecting IoT, firewall, OT and even military devices
John Althouse, founder of FoxIO, shared critical vulnerabilities in the GoAhead Webserver that were affecting millions of devices. Broken TLS handling, mTLS bypass, and unenforced certificate revocation lists. This just means anyone could pretend to be a trusted source and decrypt the traffic.
John Althouse@4A4133Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-yo…
Private AI has a server problem
Running a model on your own machine is the right move because you don’t want someone else’s company training the model with your data. Tools like IntelligenceMesh, LM Studio and Jan help do the same.
Local AI stays private, though till your data goes to the cloud. Researchers found tens of thousands of Ollama servers sitting on the internet without any authentication that can call tools.
An agent that can talk to other agents nearby, or a local model that can hand work to a phone on the same mesh without going to a cloud, starts to look more interesting once you have watched credentials leak.
French blood bank attacked
I have often heard of hacks for money, hacker groups working their way through vulnerabilities in “secure” software, or AI assistants kept in sandboxes hacking other platforms. Never in my life did I think I’d see a blood bank being attacked.
Attackers raised the temperature and defrost thresholds of plasma cold rooms of Établissement français du sang (EFS), France’s national blood service, on 1 and 2 November. The rooms that were usually held at −30 °C were set to climb to 110 °C.
Where are we headed when we do this? What do we achieve? Loss of lives and a lot of resources?
AI discovering an 11-year-old Linux TCP/IP vulnerability
Last week I read a tweet by Florian Roth that mentioned that Claude discovered a bug in the Linux kernel’s IPv4 TCP handshake code and ran an exploit that gets remote code execution as root without authentication.
The bug remained hidden for 11 years because neither attackers nor defenders were looking for it. And according to Roth, maybe that’s why we are safe. With AI, these subtle bugs and exploits can be found and used maliciously. He doesn’t think the industry is ready for when AI starts finding and exploiting long-lived bugs.
Florian Roth ⚡️@cyb3ropsCVE-2026-98432 is a good example of something that really concerns me about the future of cybersecurity.
ubuntu.com/security/CVE-2…
The vulnerability was introduced in October 2015, more than 11 years ago, by a performance optimization in the Linux TCP/IPv4 networking stack. One of the most fundamental components of an operating system used by millions of servers.
Now Anthropic reports that Claude discovered this flaw and developed a working exploit that allows remote code execution as root, without authentication, against a server with an MPTCP listener.
anthropic.com/research/disco…
Think about what that means.
For decades, we’ve been building critical infrastructure out of enormous amounts of complex, memory-unsafe code. Humans wrote it. Other humans reviewed it, tested it and searched for vulnerabilities. All working with the same fundamental limitations: limited time, limited attention, incomplete visibility and an inability to reason about every possible interaction and race condition.
And perhaps that’s what protected us to some extent. Attackers had the same limitations as the people developing and defending these systems.
A vulnerability could remain undiscovered for 11 years, even in such a widely used component.
Now AI is changing that balance.
The ability to inspect code, identify subtle weaknesses and develop working exploits is becoming less dependent on a small number of highly skilled researchers. These activities can increasingly be scaled with compute, automated testing and tokens.
And that’s what worries me about the next few years.
We’ve accumulated decades of complex, memory-unsafe code in operating systems, network services, applications and libraries. Much of it has never been assessed with anything close to the capabilities that are now becoming available.
We may have massively overestimated the security of our software simply because the people looking for vulnerabilities were as limited as the people who introduced them.
That balance is breaking down, and I don’t think we’re prepared for what follows.
While he is right, I do think that security researchers and teams that audit code and work for code security will be able to find bugs that may be beyond their observation. And maybe that would make systems much more secure.
After some background on the world, let me walk you through some news about Offline.
Introducing subscriptions that work without a server
We just shipped v0.32 of Offline Protocol SDK that lets a device subscribe to a topic on another device’s service and get updates as it’s published. This, of course, is also sealed end-to-end with MLS.
Gokul@bahdotshJust shipped v0.32.0 of @OfflineProtocol mesh SDK!
- Service subscriptions: lease a topic on a peer's service and get every update as it's published, end-to-end encrypted over MLS
- Missed updates come back on the next renewal, no server in between
- New binding: C#
- BLE that holds up in a pocket: a backgrounded iPhone keeps its links, a screen-off Android keeps finding peers
And more bug fixes and optimizations!
github.com/Offline-Protoc…
Offline expense splitting that actually works
Ankush, an engineer from the team, put together a Splitwise-style app that runs without the internet. One person hosts the tab on their phone, and everyone else joins nearby. You add your items and get the split without any sign-up or Wi-Fi.
Your friends cannot say we do not have internet when you are splitting the cheque now.
Offline Protocol@OfflineProtocolCheck out this demo for a Splitwise-style app to manage group expenses, completely offline.
There are infinite ways to implement our infrastructure across any industry, all you need is some curiosity.
We want to support developers building on our SDK, keep sharing your ideas!
0xankush.eth@Ankush_523“I’ll Venmo you when we have signal” — not this trip.
Hosted the tab on one phone. Everyone else joined nearby. Added dinner. Both phones showed the same split.
No Wi‑Fi. No sign-up. Just mesh.
Offline Protocol joins Zebra PartnerConnect
Offline Protocol is now a part of Zebra Technologies’ PartnerConnect program. Zebra’s handhelds, scanners and wearables are used in warehouses, delivery routes, yards and stores. If the Wi-Fi or cellular goes out of reach, these devices won’t stop working now. Offline Protocol will give the devices a network of their own so work never stops even through outages.
Offline Protocol@OfflineProtocolOffline Protocol joins Zebra Technologies' PartnerConnect program.
Zebra's rugged handhelds, scanners and wearables run the world's warehouses, delivery routes, yards and store floors. Those are exactly the places where Wi-Fi ends at the dock door and cellular drops behind concrete and steel.
Offline Protocol gives them a network of their own. Devices sync records, message and hand off work directly over Bluetooth and Wi-Fi Direct, relay across an entire site, and reconcile with your systems the moment any device gets a link. Scans, pick lists, check-ins and proof of delivery keep moving through outages, dead zones and network failures.
Through PartnerConnect we're bringing offline-first operations to Zebra's resellers, integrators and the frontline teams that run on Zebra every day.
Learn more and book a pilot: offlineprotocol.com/partners/zebra
Some offline wins
- The Offline Protocol SDK has passed 70,000 downloads this year.
- Service subscriptions in 0.32 make a lot of the “live state without a server” ideas people have been asking for actually practical.
That’s it for this week. Get your agents to work, but also keep your data safe, and now touch some grass. I will see you next week.