WTF Ubuntu?

In a surprising turn of events, the Linux distribution Ubuntu has been hit with a critical vulnerability in its TCP code, CVE-2026-98432, which has been present since 2016 and can be exploited remotely. This vulnerability, rated a 9.8 on the CVSS scale, allows for a total takeover of a server. While Debian, Arch, and Alpine have already patched the issue, Ubuntu has been notably slow to release a fix.

As of November 2, 2026, Ubuntu's website still lists the server as vulnerable. Canonical, the company behind Ubuntu, has been accused of not providing timely patches, despite promising "timely patches for critical vulnerabilities" and claiming to offer enterprise-grade services. The company's website boasts claims such as "Timely," "Enterprise-grade," "Production grade," "Enterprise resilience," and "Developer velocity."

With Ubuntu's trustworthiness now called into question, the author has decided to move all their servers off the platform.