At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.
> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...
I'm more worried about my consumer-grade router.
I switched to OPNsense last week. Consumer grade WiFi AP is behind it. I’m not depending on firmware updates from a company that has no incentive to make them.
I blocked packets arriving externally on my firewall with ip-options a couple of days ago. Firewall rule has zero hits, and I've got a very open ISP (andrews+arnold), if I want I can host SMTP, DNS, whatever
The timeline says the CVE was reported over 2 weeks ago, so why are the alarms sounding now?
Anthropic published a blog post claiming RCE with it [0].
[0]: https://www.anthropic.com/research/discovering-vulnerabiliti...
Which was 4 days ago.
Note: AWS NLB doesn't terminate TCP for TCP listeners.
It would be great if they introduced mitigations for this vulnerability though.
Another reason hyperscaler cloud providers will continue to grow (IMO)!
My FreeBSD loadbalancers block packets with IP Options with default config. It’s not rocket science, no matter how Cloud providers are trying to tell us.
If I'm not mistaken, looks like pfSense (based on FreeBSD) firewall rules also block IP Options by default too.
Unless they themselves (underlying services) get hacked...
My VPS was auto-updated and restarted more than 14 days ago. The logs have rolled already. Probably October 12 early morning.
Another reason NixOS will continue to grow :)