Watch the video, transcript and sources
+ HackerTube (Oct 31): Karpathy's 6,454-video YouTube clone built from Hacker News recommendations in about two hours
- ParticleDB (Jepsen, Oct 31): 96 issues; default mode lost committed writes; Jepsen says halt deployment
- Lenovo FU100: fingerprint USB stick sold as AES-256 encrypted held a plain SD card (Tom's Hardware, Nov 1)
- Linux CVE-2026-98432: CVSS 9.8 TCP use-after-free; Ubuntu and RHEL had no fixed kernel on Saturday eveningA database that advertises Full ACID is supposed to keep what you write. Jepsen tested one and found ninety six issues, including a where clause that said four equals five and still returned rows. One of those bugs comes with a stopwatch. I will read it to you at the end. Jepsen is Kyle Kingsbury's testing lab. It runs a database through real workloads and failures and checks whether the guarantees on the website hold. Think of an inspector who actually opens the fridge.
Story one. On Saturday Jepsen published its report on ParticleDB, a Rust database from Orkes aimed at AI agents. Orkes paid for the work. The home page said Full ACID, one hundred fifty nine thousand transactions per second. Jepsen tested ParticleDB from its first one point one build to a late release candidate. The site called it formally proven, with a TLA plus proof. Jepsen says no TLA plus specification was available during the work. Under the Full ACID line, the same page said snapshot isolation, which is not fully isolated. The bugs were not subtle. Most needed one server, one client and no failures injected. A where clause that said four equals five returned rows. A where clause that said true matched nothing. Updates left two rows with the same primary key.
The last release Jepsen tested, release candidate twenty two, was much safer. Even so, the default transaction mode lost committed writes during normal operation. The strictest mode still allowed lost updates after a process kill. Orkes says its next release fixes all of this. Jepsen has not tested it. So in that last release a database that promised Full ACID could lose a write it had already committed. The speed, I assume, was excellent. Jepsen's advice is plain. Halt further deployment of ParticleDB and migrate to another database as soon as possible. Orkes blames a spring refactor and says its own customers, on an older version, were likely unaffected. The stored procedure docs even invented an email address for Kyle Kingsbury.
Story two. The Lenovo ThinkPlus FU one hundred is a fingerprint USB stick marketed as hardware encrypted with AES two fifty six. Security researcher Xusheng Li took one apart and found an ordinary SD card, with nothing on it encrypted. The fingerprint reader decided one thing, whether the stick connected to the computer. The files on the card never depended on it. Li reported the flaw to Lenovo in August twenty twenty five. The first fix was a layer of epoxy over the SD card. So the files were never encrypted. Wait, it is just an SD card? Always has been.
Lenovo rated its own advisory high. The later fix, for the FU one hundred and three related drives, means calling a service line in China, then either sending the drive back or getting an on-site firmware upgrade. Lenovo advises wiping the drive first. Last week Li pointed OpenAI's Codex, plus his employer's reverse engineering tool, at other makers' USB protection software. Netac's took about seven minutes, because it had a fixed key built in and wrote the password to diagnostic logs. One drive had two hidden accounts that Li calls backdoors. If a drive's security is the hardware, check it yourself. Encrypt the files with software you control before they reach the stick, and treat the fingerprint as a convenience.
Story three, the light one. On Friday night Andrej Karpathy opened YouTube, saw what he called an enshittified wall of slop, and on Saturday morning told his coding agent to build a replacement from whatever Hacker News recommends. The agent downloaded the Hacker News comments, filtered out spam, and kept about forty thousand that recommend a YouTube video. That left six thousand four hundred fifty four videos, from two thousand seven to now, in a hundred fifty topics. The site is hackertube dot org. It shows the frame from the halfway mark instead of the thumbnail the uploader chose, which stings a little. Karpathy says the whole build took about two hours.
His only manual steps were a Google API key, a server and a domain. On October twelfth I told you Karpathy thinks access and tasks create a gap in how people understand these tools. Two hours of work is a decent data point. Story four, the one to act on. CVE twenty twenty six, ninety eight four thirty two is a use-after-free in the Linux kernel's I P v four TCP handshake, scored nine point eight out of ten. A remote peer with no login can reach it. Eric Dumazet wrote the fix on October first. The fix reached stable kernels on October eleventh and fifteenth, and the bug goes back to Linux four point four. Red Hat raised its rating from important to critical on October thirtieth. On Saturday evening, Ubuntu and Red Hat Enterprise Linux still listed no fixed kernel.
Anthropic says Claude wrote a working exploit for servers with a multipath TCP listener, and Go programs have opened those by default since Go one point twenty four. The Go team warns that systems without that listener may be vulnerable to similar attacks, and says the best fix is a patched kernel. If your distribution has no fixed kernel yet, Red Hat and AlmaLinux publish a firewall rule that drops I P v four TCP packets carrying IP options. Red Hat says it reduces exposure and cannot fully prevent it. After that, you wait. What to do today. Install your distribution's fixed kernel and reboot, on container hosts and Kubernetes nodes too, because containers share the host kernel. Debian, Suse and Amazon Linux already have fixes. If you cannot patch yet, start with hosts that run multipath TCP listeners.
Now the stopwatch I promised. In Anthropic's own proof of concept, it takes forty eight minutes to leak a kernel pointer, then five more minutes to run a shell command. Anthropic has not published the exploit.
Verdict: REVERT — Halt ParticleDB. Patch the kernel.
Sources
https://jepsen.io/analyses/particledb-1.1.4
https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products
https://hackingpassion.com/lenovo-thinkplus-encrypted-usb-sd-card/
https://news.ycombinator.com/item?id=50326099
https://karpathy.bearblog.dev/hacker-tube/
https://hackertube.org
https://news.ycombinator.com/item?id=50319510
https://ubuntu.com/security/CVE-2026-98432
https://access.redhat.com/security/vulnerabilities/RHSB-2026-016
https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b
https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
https://www.openwall.com/lists/oss-security/2026/10/30/1
https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
https://almalinux.org/blog/2026-10-30-cve-2026-98432/
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.
YouTube · Newsletter · thedailydiff.dev · forward this to the intern who deployed on Friday.