Claude’s newly-discovered zero-click Linux vulnerability was branded “the worst bug in the history of the internet” over the weekend after it earned a 9.8 out of 10 on a common vulnerability scoring system, and spooked Ubuntu Linux users who suffered a delay on code patches.
The bug, CVE–2026-98432, escalated in severity after Claude strung together a series of operations that upgraded a relatively niche error into an easy-to-exploit vulnerability, allowing hackers to remotely execute code on other people’s servers without them clicking a button.
“I can’t think of a more severe bug,” concluded an Anthropic staff member. A senior editor at ZDNet described the feeling, saying, “When I used to work with network security, we called this a ‘shoot me now’ bug.”
Shopify’s CEO earned three million views pointing out the disaster on Saturday. A cybersecurity researcher described the “working exploit that allows remote code execution as root, without authentication.”
Crypto influencers piled on. “This is the worst bug in the history of the internet,” claimed Kyle Samani, while ex-Coinbase engineer Mert Mumtaz wrote, “It’s worse than that. Think about it again. It’s still worse than that. You think you thought about it? Nope, even worse.”
AWWWWOOOOOOOGAAAAAAA
9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed
Time to patch!https://t.co/Y3AFq7Z4rk pic.twitter.com/XPXgtnNWmE
Amazon was still working on upgrading its infrastructure in the last 24 hours. Red Hat reiterated the critical level of the bug.
By late last week, Anthropic wrote that its researchers could take over certain Linux machines within 53 minutes.
Source link







