SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaign
MentionsLinux kernelAnthropic
Runs 7:43. Streams from traffic.libsyn.com only when you press play.
Today's episode covers deploying a local Ghidra Server so malware analysis work survives virtual machine snapshot reverts, a Claude-discovered zero-click Linux kernel remote code execution flaw in Multipath TCP, and a returning Hugging Face malware campaign that abuses trust_remote_code to mine cryptocurrency on GPU hosts.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- TechnologyLinux kernelThe core of Linux and Android: it controls hardware, memory and what every program is allowed to do.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.