Wednesday's lead has been sitting in the internet's plumbing since 2016: a critical flaw in the code Linux uses to answer every incoming connection. No attacks confirmed yet, and the fixes are arriving one distribution at a time, which makes this a patching story with a clock on it. Here is the longer version of today's five, with the version numbers and links that do not fit in three minutes.
Linux: a 9.8 in the TCP handshake, fixed on some distros, pending on others
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP connection handling: when a connection is set up, the IP options pointer moves to the new child socket without a copy, and a retransmitted SYN processed on another CPU can read that memory after it has been freed. The kernel security team scores it 9.8, it is remotely reachable with no sign-in, and the bug dates back to kernel 4.4, released in January 2016. Red Hat published fixed kernels for Red Hat Enterprise Linux 8, 9 and 10 on November 1. Ubuntu's own tracker rates it Critical and, as of this morning, lists 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 all as "Vulnerable work in progress": no fixed Ubuntu kernel has shipped yet, whatever some headlines say. The interim defense on hosts that cannot wait is a firewall rule dropping incoming IPv4 TCP packets that carry IP options, which the exploit path needs, but every writeup agrees on the real answer: a patched kernel and a reboot. No exploitation has been confirmed in the wild and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, so this is the rare chance to patch ahead of the attack instead of behind it.
The fix watch: quiet, with a date circled
Microsoft has posted no new fixes since the October 27 updates, which carry the Smart App Control repair and the Remote Desktop 0xC000000D fix in KB5127653 and KB5127936. The next Patch Tuesday is November 10, six days out.
Exchange: Outlook on the web sign-in, day twenty-two
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016 through 2025, unchanged since October 16. The affected updates include KB5126646, KB5126655 and KB5126651, and those three sit among the most-searched update pages in our search-demand data this week, so plenty of admins are living with this one.
The install watch: still quiet
No new "this update fails to install" issues from Microsoft; the most recent known-issue changes remain the October 28 fix entries above. If an update fails at your place anyway, note the error code before calling IT: a quiet week means the cause is more likely local than a known problem.
Node-RED: a maximum-severity flaw, now being used
CVE-2026-58115 is missing authentication on the HTTP interface of Node-RED, the drag-and-drop automation tool embedded in industrial products and popular in labs and home setups. Siemens disclosed it on August 11 in advisory SSA-834709 at CVSS 10.0, for SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED, fixed in V4.3.4.1. Researchers at VulnCheck observed exploitation beginning October 30: one HTTP request deploys a flow that runs a command on arrival, fetching a Linux bot saved as a hidden file, and some payloads instead plant a Node-RED backdoor that survives a reboot. They counted 16 attempts from one source address between October 30 and November 1, as Help Net Security reported on November 3. The flaw is not in CISA's KEV catalog yet. The fix on Siemens gear is the V4.3.4.1 update; everywhere else, switch on Node-RED's admin login (adminAuth in settings.js), and if a box was exposed without one, treat the credentials stored in its nodes as burned.
If you do three things this week
- Ask which Linux distributions you run and when the kernel fix for the TCP flaw lands on each; Red Hat shipped November 1, Ubuntu is still in progress, and the patch needs a reboot.
- If you run Exchange, read Microsoft's OWA release health entry before next week's Patch Tuesday window.
- If Node-RED runs anywhere in your shop, confirm today that its editor has a login, and update Siemens IoT2050 Advanced boxes to V4.3.4.1.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.