Anthropic’s AI discovered a flaw in Linux that allows an external attacker to take control of a server over the internet without any password. Linux powers 63% of websites where the operating system can be identified, and this vulnerability remained hidden in the code for about ten years. The severity rating is 9.8 out of 10, and Red Hat classified it as critical. In Anthropic’s test, the attack requires about 48 minutes of preparation and an additional 5 minutes to fully compromise the machine. A fix for Linux has been available since October, but until yesterday, Ubuntu still listed all versions as vulnerable. Now, the weakest link is those who delay updating and rebooting their servers. The flaw lies in how Linux handles new internet connections—the most common type. The attack demonstrated by Anthropic exploits a feature called MPTCP, which allows a single connection to use multiple networks simultaneously. Go-language programs have had this feature enabled by default since version 1.24, when the system permits it. Server administrators: update your kernel as soon as your system releases it and reboot immediately. Disabling MPTCP helps in the meantime, but only reduces risk—the vulnerability still exists in standard connections. Anthropic has not publicly released the exploit, and no real-world usage had been reported until yesterday—so those who update today are ahead of the curve. Imagine how many other hidden flaws are still out there.