November 2, 2026 —
Anthropic reports zero-click Linux root access under specific conditions
Anthropic says an unreleased model turned a Linux networking flaw into a zero-click attack with root privileges. The demonstration has specific conditions, but it sharpens the gap between a published fix and a running, protected server. Figma’s reusable workflows, ChatGPT account switching and an AI-key incident round out this issue.
Anthropic reports zero-click Linux root access under specific conditions
Anthropic says an unreleased model built an exploit for CVE-2026-98432 that ran commands as root without credentials or user interaction. Its demonstrated target accepted Multipath TCP connections. The reported proof of concept took 48 minutes to obtain a kernel pointer and another five to execute a command; those timings are not a universal compromise estimate.
Vendor guidance makes the response broader than copying the demonstration’s prerequisites: assess exposed IPv4 TCP services, follow the distribution’s advisory and verify the fixed kernel is running. AWS reported updates and reboot guidance; its statement that it knew of no exploitation in the wild describes its awareness at that time, not proof that every host was safe.
Today we’re with Photo to Video: animate still images — Sponsored
Turn a photo, illustration or product image into a short clip with selectable AI video models.
Eligible new accounts get welcome credits; additional generations use prepaid packs, with no subscription advertised.
Model choice determines credit cost, clip length, aspect ratio and available resolution.
Prepare images in the editor; optional upscaling is available on supported outputs.
Figma Weave packages a creative process colleagues can run again
Figma’s October 31 overview connects prompts, generation and edits as visible node workflows. Authors can package a workflow as a tool so colleagues use selected inputs without navigating every node. This builds on June’s product connections and September’s community publishing, rather than marking a first launch.
ChatGPT brings two-account switching to iOS and Android
OpenAI’s October 30 release entry extends account switching to its mobile apps after the earlier web rollout. Users can keep two accounts signed in, while conversations, memory, subscriptions and work data stay separate. Availability was still gradual in the completed source report.
Northflank warns of AI-key misuse after its security incident
Northflank disclosed an October 30 incident and told customers to assume environment variables had been decrypted and rotate credentials. Later that day it reported customer accounts of unauthorized AI API-key use. The entry method, full exposure window and affected-customer count remained unresolved in the completed report.
OpenRouter’s scheduled agent remembers stories and asks before alerting
An October 31 Agent SDK 0.11.0 tutorial builds a TypeScript Hacker News watcher with a default 15-minute interval. It saves story IDs, starts a fresh conversation for each check and asks for human approval before a team notification. The notification function only logs a message; real delivery is left to the application.