An AI wrote the attack in under an hour. How long does your server take to get the patch?

The flaw sits in the part of Linux that accepts new connections, before the program behind it sees anything. No password is needed and nobody has to click anything: it's enough for the server to have something open to the internet, such as a website, email or remote access.

It was found by a researcher at Anthropic, the company behind the Claude AI, and the fix went into Linux in early October. On 27 October Anthropic said that one of its models, not yet released, had written an attack that took full control of a server in under an hour. It hasn't published that attack and nobody has reproduced it independently, so I take it for what it is: a warning.

What changes

Until now, weeks usually went by between a flaw becoming known and a working attack appearing. If an AI can do it in an hour, what counts is how long your server takes to have the patch installed.

And those timescales aren't up to you, but to whoever makes your Linux. With the same fix out in the open, Oracle released its patch the day after the advisory and Debian within a week. Red Hat took 17 days: it first rated the flaw as moderate and raised it to critical after Anthropic's announcement.

Ubuntu, one of the most widely used on servers, fixed its short-support release first. On 3 November, 19 days in, the long-term releases, which are what almost every server runs, were still in testing. And for NAS boxes and routers, which run Linux too, I found no advisory from either Synology or QNAP.

That same 3 November I checked the servers we look after. One was already fixed, because its distribution had released the patch within days. The others run Ubuntu and are still waiting for theirs, so in the meantime we blocked the kind of connection this flaw uses and switched off the feature the attack comes in through. As soon as the patch is out, it goes in and they get rebooted.

Three questions for whoever looks after your server

1. What do we have that runs Linux? The website, the office server, the backup NAS, the router or the phone system.
2. When was the last kernel patch installed, and was the machine restarted afterwards? Without a restart, the patch does nothing.
3. What is open to the internet that doesn't need to be? What isn't open can't be attacked from outside.

If the answer to the second one is «I don't know», you already have your answer.