HN

Comments (403)

• Menu

  BoppreH
  Worse yet, the Ubuntu security incident page[0] lists "Ubuntu Priority: High" (as opposed to Critical, which would trigger an out-of-schedule patch). There's a "Why this priority?" link that simply says:> Why is this CVE high priority?> See ubuntu cvss scoreThat's it, we don't even get a period on this TBD of a sentence. It's followed by a generic link that explains what "Ubuntu Priority" is, but that page contradicts their choice. Note that it doesn't offer any mitigations either, and even the (horrendously unclear) description is copied from the NIST page, so there's no actual message from Ubuntu.I already had a bad feeling the first time I saw "Get more security updates through Ubuntu Pro" on `apt upgrade`, this is now the kick I needed to move to a different distro.[0] https://ubuntu.com/security/CVE-2026-98432#priority-reason
• Menu

  throw0101c
  For the record, the kernels with the fixes are in the "proposed" repos for each LTS release:* https://launchpad.net/ubuntu/+source/linuxYou can pull them down with a "-t" added to your apt-get (but will not appear by default).26LTS had the new kernel go to the updates/security repos on October 28.
• mogwire
  Where is my cup to collect all these tears from people upset about free software not getting fixed fast enough?I wonder what is slower, these people pulling out a credit to pay something or ubuntu fixing their issue?
• eyeino
  If anyone is moving away from Ubuntu, I suggest NixOS, especially with LLMs. You will be able to build the machine of your dreams.
• Menu

  vanschelven
  I knew what this is about before clicking the link. While trying to find remediations for vulnerable systems I was also looking for any kind of "official" statement on literally WTF is going on here from the Ubuntu side, but I haven't been able to find one yet. I guess it has to go through the "hacker news puts enough attention on it for someone to care" phase which we all know so well...
• Menu

  paxy
  It’s okay to have criticism, but at least be constructive about it. This “I demand to speak to the manager” energy should be kept out of open source.The post gives no details about what this vulnerability is, how critical it is, how it is impacting them personally, how vulnerable their servers are, how they are working around it.Just a title designed to generate the maximum outrage followed by a few meaningless lines.
• Menu

  StrLght
  Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.Maybe it's time for StealMyBitcoinV2…
• Menu

  strenholme
  Here is Ubuntu’s webpage on this vulnerability:https://ubuntu.com/security/CVE-2026-98432It’s still, over a week after disclosure and patches, unpatched in Ubuntu.As for me, a part of me wants to move over to Rocky Linux 10.
• Menu

  pixelesque
  It's not *just* Ubuntu is it? I think Redhat still hasn't released any patches? (their status still says 'ongoing')
• bortimus
  When AWS is shipping patches for Amazon Linux 2 and Ubuntu is still waiting.. yeah.
• baggy_trough
  Debian is already on 6.12.115, the stable kernel from 3 days ago. Who knows what horrors were fixed?
• Menu

  Gabriel54
  What is keeping people on Ubuntu instead of just using Debian? I'm genuinely curious. What is Ubuntu offering that Debian doesn't provide?
• Menu

  alittlebee
  I get the frustration, but isn't there an iptables rule that is a viable mitigation? Why not deploy that first?
• imjonse
  " Anthropic says it built a working exploit that gets root on a server. A total takeover."From the linked Ubuntu CVE page" Vulnerable system - Confidentiality impact LowVulnerable system - Integrity impact LowVulnerable system - Availability impact High" suggesting it's more of a denial of service. So which is it, there are dozens of kernel CVEs fixed in the linked debian email.
• ethin
  The fact that Ubuntu (still) hasn't patched this (despite the fact that I'm pretty sure Opus 5.5 could figure it out in a few minutes) is pathetic. And it's very annoying for me because I have two servers that I need to consider migrating off of it now because Ubuntu clearly doesn't care all that much about security vulnerabilities like this. Get your shit together, Canonical. We all know you can do way, way better than this.
• Menu

  walthamstow
  All the people working at Canonical have gone through the Canonical hiring process, which is quite possibly the worst in the global industry and I can't imagine anyone competent getting through it.
• lvh
  You get a very different CVSS score depending on the formula you use. Ubuntu's response page lets you select between the two.(I think CVSS is a very poor metric in cases like these; I'm just explaining what I think Ubuntu's process/position is, not making excuses for them. My read is the 9.8 is probably too high but nevertheless more accurate in this case.)
• InsidiousWombat
  Worth noting that RHEL, the Linux version Red Had sells licenses/paid support for, also didn't update it for weeks
• Menu

  curt15
  Did Ubuntu Pro customers get the fix?
• euph0ria
  I migrated all servers off Ubuntu as well due to this and slow PHP patching as well. Now running a mix of AWS Linux 2023 and Debian.
• thatonehack
  I’ve always hated Ubuntu. I simply don’t understand the pitch as to why someone would use Ubuntu over just good ol fashion Debian. Better yet: FreeBSD.
• Menu

  stroebs
  I've switched my default to AlmaLinux. Was a fan of Ubuntu since 8.04 (Hardy Heron) but stopped since Canonical pushed hard on Ubuntu Pro.
• janmo
  Same with the recent PHP vulnerability Debian had the patch ahead of time. Ubuntu had it many hours later...
• HarHarVeryFunny
  This is a valid concern.AI is now capable of, and being applied to, find so many bugs recently that infrastructure providers need to up their game and respond quickly.Hopefully this is a passing phase as bugs are quickly patched, and we'll get past it without too many incidents.
• anon
  undefined
• Menu

  prmph
  I moved over to Debian and haven't looked back, years ago. Why anyone would prefer Ubuntu over Debian, which is a purer, higher quality, more mature distro, is beyond me.
• Menu

  neuropacabra
  What would you recommend to use on servers? Would you host you apps off Arch? Or better to take Fedora or similar? I am genuinely interested in answers not distrowars
• moritzwarhier
  Withholding security-critical open source contributions to collect subscriptions is really low.Bye Ubuntu
• beardog
  They haven't patched pwnescape either, which is like 15+ days old - allows for KVM breakout.https://ubuntu.com/security/CVE-2026-99999
• keymasta
  Article contains the string "hve" which should no doubt be "have"..
• arjie
  It is strange, agreed. I just manually mitigated it using Claude and also blocked ipoptions at the router and in every node iptables.
• Menu

  WorldPeas
  if only other OSes had the same CUDA support as Ubuntu. Now I know how solidworks users feel..
• Menu

  512bitCrypto
  Should we also talk about the snaps when trying to install package in Docker image (such as chromium-browser)?
• Menu

  FinnKuhn
  I have been thinking of moving to NixOS from Ubuntu. Are they any better on security updates?
• thefilmore
  I have fond memories of burning Ubuntu to a CD being my first introduction to Linux. I chose to preserve those cherished memories rather than sully them through actually using Ubuntu.
• gdevenyi
  I used to be a contributor to distros, but I found that Ubuntu simply has no method by which I can fix things and contribute them back.
• Menu

  runjake
  I have the same general feelings, but then I recall my years as an OSS developer and being abused by people who contributed absolutely nothing to my projects. Not money, not code, not documentation, not even grammar corrections. I'm sure anyone who's been involved with reasonably popular OSS can relate.I am not contributing to Ubuntu in any way, and that puts it into perspective.(I still directly contribute to OSS and release OSS projects, but absolutely refuse to engage with the least bit of hostility. Any of that is an insta-block.)Edit: Whoah the downvotes and comments. I'm not saying that Ubuntu is doing well here. I'm trying to point out that a a vast percentage of the complainers are not paying customers, and maybe if they did pay, Ubuntu would have more incentive and resources to work more quickly.
• MarkWayneNewton
  So nice to see people coming back around to Debian.Listened to over a decade of people chirping about the new hotness and calling my Debian servers lame, old and busted. Well look at you now!
• FullMetalBitch
  Good job on moving away from Ubuntu, in the end Debian has been there longer and it's more trustworthy.
• kuriousoranj
  sudo sysctl -w net.mptcp.enabled=0
• pelagicAustral
  > I'm moving all my servers off Ubuntu.I wish life was that easy.
• wltr
  I genuinely want to understand why people use Ubuntu, and especially for servers. I’m not trolling or whatever the proper word for it. It’s not sarcasm either. I must be missing something, I guess. What is the reason? Especially if you’re not paying for it. But if you’re paying for it, I’m still curious.
• notorandit
  Normal Ubuntu approach. Not news. I have personally got a bunch on 10+ year old bug tickets on Launchpad and only lately got a feedback like: "is this still relevant"?Of course, if one hides a bug long enough it will eventually disappear or become irrelevant.Yes, indeed, WTF Ubuntu?
• Menu

  origini
  Its not just Canonical but yes when a few month ago the local root exploit appeared, it wasn't fixed for a few days either.
• Menu

  pizzafeelsright
  In the current age of AI, open source means exploits can discovered directly through the code. The flip side is the patches can also be managed.We are in that period between when software was good enough and when software is certified as secure by the writers.The days of importing frameworks and libraries written by strangers is over. I would say the entire industry is not prepared at this moment for the unpatchable event where the only solution is to power off or disconnect.
• _joel
  Switch to vanilla Debian. What I did, no real issues that weren't easy to fix. Rock solid still.
• account42
  Do most VPSs even use distro kernels rather than kernels from the VPS provider?
• Menu

  rs_rs_rs_rs_rs
  The "WTF" is unwaranted, it's really not that easy to write a weaponized exploit for a bug like that one.I am a bit surprised by the panic...
• Menu

  elevation
  How about WTF linux?The TCP/IP stack has one of the most stable requirements bases of any component -- modern PCs can communicate with decades-old software and hardware, and the composition of layers design means the code can be easily tested, and is a great candidate for analysis via formal methods. And once you have a formally verified implementation, the stable requirements means you can make it safe and then leave it alone.
• egorfine
  They're too busy replacing something else with a Rust rewrite.
• Menu

  worthless-trash
  Its only the media / publicity that drives this one, there were worse within the last year that nobody seems to care about.
• nottorp
  > Anthropic says it built a working exploit that gets root on a server. A total takeover.No offense but Anthropic says that every time.
• midtake
  Ubuntu has always been worse-Debian, I've always said it, now I have the strongest evidence in my favor.
• q2dg
  Why use Debían when you can use Rocky or Alma?
• anon
  undefined
• rewgs
  Given that Ubuntu is downstream from Debian, I can't think of a single good reason why Ubuntu wouldn't just release Debian's patch.
• bojangleslover
  Inflicting some pain to sell Ubuntu Pro maybe?
• Toynbeeidea
  Reminder that Ubuntu used to bundle spyware - I dropped it at that point and never looked back, trust broken.https://www.fsf.org/blogs/rms/ubuntu-spyware-what-to-do
• nekusar
  From the same company that demands high school transcripts and club affiliations for engineers 20+ years out of high school.Creepy as hell company. Had a good free Linux distro, but it's not that good anymore. It's coasting on inertia these days.
• desireco42
  They are rewriting those bugs in Rust.
• hackersnooze1
  Ubuntu seems like it hasn’t been in very good hands for quite a while now
• anthk
  OpenBSD got a recent GeFS (COW FS, but far lighter than BTRFS and not to mention ZFS) update, I wish 8.1 or 8.2 had it stabilized, because the issues with FFSv2 would end in the spot and maybe even steal some server machines to GNU/Linux.
• Menu

  jmclnx
  >Oh and btw, distros run by volunteers (Debian, Arch, Alpine...)And Slackware too: Thu Oct 22 23:04:17 UTC 2026 patches/packages/linux-5.15.223/kernel-generic-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-headers-5.15.223-x86-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-huge-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-modules-5.15.223-x86_64-1.txz: Upgraded. patches/packages/linux-5.15.223/kernel-source-5.15.223-noarch-1.txz: Upgraded. This update fixes bugs and security issues, including the PwnEscape flaw. For more information, see: https://www.cve.org/CVERecord?id=CVE-2026-99999 (* Security fix *) From: https://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change...
• Menu

  siwatanejo
  Did Omarchy patch it? Anyone knows? (Not that I'm using it now, but I'm interested.)
• Menu

  bryan_w
  There seems to be something off about this post. One hour in and hundreds of comments.Either this was used to pop something big, or this is a jia tan situation going down.I thought there was a flamebait automation that was prevent this sort of velocity (unless overridden)
• cynicalpeace
  Debian vs Ubuntu debate officially settled today!
• mring33621
  Yes, this is a fuckup by CanonicalBut it doesn't sound too hard to backport a patch from Debian to Ubuntu yourself.So if it's a critical security concern to your company, open your laptop and get to work.
• shevy-java
  > distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix.Well - Ubuntu sold out to marketing rather than engineering.Happened to Google too. Compare Google Search to 10 or 15 years ago. Totally useless nowadays.
• h1bslop
  you mean to say you didnt review the codebase before putting it in production? you get what you pay for
• prologic
  I've all but stopped using traditional "Linux distributions" honestly.
• Menu

  ktm5j
  I mean.. how many people are using multipath on Ubuntu? This is a big issue for datacenter systems that are using fancy networking features that Ubuntu users probably aren't.
• anon
  undefined
• m3kw9
  i would then give claude/codex full access, and ask it to do a temp patch, if they allow lol.
• baggy_trough
  Debian is, in every way that I know, superior to Ubuntu. - no snap nonsense where you can't turn off upgrades - stays close to upstream LTS kernels - does not carry around some ridiculous kernel patch set - no irritating adware on login I switched after the aforementioned patch set broke containers and destroyed my server instance a couple years ago. Apparently nobody bothered to check containers before releasing the kernel.
• bartread
  Honestly, I agree. I need to provision a new VPS for a personal site and I’m holding off until it’s resolved.Not to mention however many production services teams I work with build and maintain that run on Ubuntu.Ubuntu are dragging their feet and it’s not good enough. Nowhere near good enough.Get it patched NOW!And if you’re on here and you work for Ubuntu, then what the hell are you doing reading this when you should be shipping a patch?Seriously: get on it, will you?
• worksonmine
  > and I considered it the solid, no-drama LTS distro. Fuck that now.There's been lots of drama on Ubuntu which OP either completely missed or ignored. Ubuntu has been getting worse for over a decade now.
• Menu

  linuxftw
  Everyone is just using Ubuntu for free of charge for the most part. You get what you pay for.On another note, you can probably easily install the Debian kernel onto your machine."But we need signed kernels!" Well, that's a big "I told you so" from the people that were against only a handful of distros being able to create signed kernels with MS derived keys like 15 years ago.
• mceachen
  [dead]
• whiterabbit123
  [dead]
• anon
  undefined
• diath
  [dead]
• VimEscapeArtist
  [dead]
• fleroviumna
  [dead]
• cheesy293
  [dead]
• gabucino
  [flagged]
• Menu

  mag7269
  Where is he moving his shit to, then?
• ForHackernews
  This turnaround time is appalling, especially given that Debian shipped a fix weeks ago. Poor show, Canonical.
• Menu

  stackghost
  I suspect at this point that it’s a bunch of techno-bureaucrats at Canonical who are dogmatically sticking with their release cadence because artificial justifications. I have worked in big organizations where The Process, or The $place Way of Doing Things, has become so big that the bureaucracy takes on a life of its own and you end up having a whole team of people who just manage the process so that the people actually doing the work can maybe get something done.I haven’t used Ubuntu for a few years now but I’m glad they’re getting this trial by fire now. This new era of software vulnerabilities is going to reduce the viability of a lot of smaller distros who more or less are entirely dependent on upstream for security and reliability. I sincerely wish the Ubuntu folks well but this is a sink or swim moment, and even if they sink it will be a net positive for Linux as a whole as weaker projects get picked off like the slowest antelope in the herd.
• emrehan
  > I'm moving all my servers off Ubuntu. Well justified.
• Menu

  samiv
  What difference does it make? Version N (TEH LATEST) is considered secure until it isn't and the same show repeats with version N+1 but we already know it's also compromised.
• Menu

  gonzalohm
  "The free operating system that I use is not giving me enterprise level security updates"I believe you can contribute to Ubuntu's source code right? Why don't you fix the issue then?