Linux zero-click flaw scores 9.8 as patches lag

A zero-click Linux vulnerability that Claude has just uncovered was labelled “the worst bug in the history of the internet” at the weekend, after it scored 9.8 out of 10 on a widely used vulnerability scoring system. It also rattled Ubuntu Linux users, whose code patches arrived late.

Tracked as CVE-2026-98432, the flaw climbed in severity once Claude chained a series of operations together, turning a fairly niche error into a vulnerability that is simple to exploit. Attackers can use it to run code remotely on other people's servers with no button click required.

An Anthropic staff member concluded, “I can’t think of a more severe bug.” A senior editor at ZDNet put the mood this way: “When I used to work with network security, we called this a ‘shoot me now’ bug.”

Shopify's chief executive drew three million views on Saturday when he highlighted the disaster. One cybersecurity researcher described a “working exploit that allows remote code execution as root, without authentication.”

‘Worst bug in the history of the internet’

Voices from crypto piled on. Kyle Samani claimed, “This is the worst bug in the history of the internet,” while former Coinbase engineer Mert Mumtaz wrote, “It’s worse than that. Think about it again. It’s still worse than that. You think you thought about it? Nope, even worse.”

AWWWWOOOOOOOGAAAAAAA

9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed

Time to patch!

— AJ Stuyvenberg (@astuyve) October 29, 2026

Within the past 24 hours Amazon was still upgrading its infrastructure. Red Hat restated that the flaw is critical.

Late last week Anthropic said its researchers were able to seize control of certain Linux machines in 53 minutes. The AI company was already assisting businesses with applying patches and urging partners in the Linux ecosystem, Ubuntu among them, to repair their faulty code.