*sigh*Ber nard @brnrd@bsd.network

https://portstatus.bsdproject.de now writes VuXML entries for you. Tick the unaddressed CVEs on a port page and you get a ready entry: the package names the port really builds, ranges in pkg notation with epoch and revision, one range per epoch the port had, every bound checked with libpkg.

The limit is CPE. Only 3,331 of 34,927 ports carry one, the rest never get matched. Ports sharing a CPE can get a version that never existed for them, so check before you commit.

https://blog.bsdproject.de/vuxml-generator-portstatus-en/

#FreeBSD #Vuxml #CVE

Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.

while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.

Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.

The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.

You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp

On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.

Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.

As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.

Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.

I built a site that shows which known CVEs affect the FreeBSD Ports, and whether there is already a fix and a VuXML entry (the database behind pkg audit):

https://portstatus.bsdproject.de

Every hour it matches NVD and CNA data against the packages and VuXML, and shows whether a fix has reached the quarterly branch.

“Unaddressed” does not mean exploitable, just worth a second look.

Private project, not an official FreeBSD service.

#FreeBSD #infosec #CVE

Hi @brnrd, for years I have been using your how-to for "Secure sudo without password" via pam_ssh_agent_auth. Many thanks, it has been very helpful!

Just wanted to let you know that FreeBSD's daily security audit now warns that pam_ssh_agent_auth is deprecated and one should consider security/pam_rssh or security/pam_ssh_agent instead.

So, maybe it is time to retire that old how-to (or to updated it for the newer pam options).

Quantum-PKI-nerd blogje.

De toekomst is Quantum dus ik ben vast begonnen om mij daarin te verdiepen en dat ook daadwerkelijk te bouwen.

Een leuk projectje die tot een goed einde is gekomen maar nog totaal niet bruikbaar is voor de normale wereld. 😎

"Volledig Post-Quantum Cryptografie website"

https://www.cryptophobia.nl/blogs/213-volledig-post-quantum-cryptografie-website.html

#PQC #Quantum #Apache #Ubuntu

Onze dagvaarding tegen Meta staat nu online. De Meta-bril is ontworpen voor privacy-inbreuken en ondermijnt onze democratie. De Meta-bril tast namelijk de voorwaarden aan waaronder burgers hun grondrechten in de openbare ruimte kunnen uitoefenen. De Meta-bril kan worden gezien als een nieuwe stap in de normalisering van massasurveillance door Big Tech. We kunnen dat nu nog stoppen. Offlimits en The Firewall eisen daarom dat het onding onmiddellijk wordt verboden.
#StaOpTegenBigTech
https://www.thefirewall.eu/metabril