← Back to context

Comment by solyin

19 hours ago

How does that help with CVE-2026-98432? Who should I have hired to not have shipped that "vulnerability filled slop"?

3 comments

solyin

Reply
cyberpunk  19 hours ago 

    1. Good engineers should have had a firewall/waf/nat/thingy infront of their linux systems, and alerting at least on those directly exposed to reduce/eliminate blast radius
    2. Good engineers don't enable MTCP (which as far as I can tell is largely a desktop feature) on firewalls
    3. ???
    4. Profit!

  • solyin  9 hours ago

    Is step 3 reading the CVE for long enough to understand that disabling mptcp is an incomplete mitigation? What happens if someone discovers a bug in the particular firewall software you're running?

acedTrex  18 hours ago

That was preventable the same way the big corps prevented. You have competent process in place to block at the edge and fan out rollout asap.

Combined with defense in depth across the perimeter. Come on yall, we've only had these tools at a high level for maybe a year and we have already forgotten the basics?