The Sandbox Held, but a ChatGPT Link Still Got In

Today is Sunday, November first, twenty twenty-six, and welcome to The Daily Reboot.

Here's what happened in tech on Saturday, and this is Builder's Weekend.

A ChatGPT share link that ran code, a Linux TCP bug scored nine point eight, and a database that found a row nobody asked for.

Let's get into it.

In the later automatic-preview version, the alert appeared after about four and a half seconds.

Researchers at Parameter reported that an ordinary public ChatGPT share could run attacker-controlled JavaScript in the signed-in session of whoever opened it. They listed conversations, retrieved a private chat, and sent selected data to an external server.

Parameter's researchers told The Hacker News they could perform any action on behalf of the victim's ChatGPT account. Treat that as the ceiling. What they demonstrated was retrieving and sending selected private chat data, between separate accounts.

Now the mechanism, because it's a good one. The Preview sandbox itself worked, Parameter says. The hole was a graph inside it that loaded MathLive, a math-input library.

MathLive accepted a cross-frame message carrying keyboard-layout markup without adequately checking the sender. Then it rendered that markup as HTML into the main ChatGPT page.

That markup built an unsandboxed frame on ChatGPT's own origin. ChatGPT's content security policy allowed YouTube scripts, so the researchers used YouTube's JSONP-style oEmbed response to run JavaScript in that frame. Same origin meant it could call authenticated ChatGPT APIs directly, not just read the screen.

The most reliable version needed one click on Preview. A later one opened Preview automatically, and they reproduced it three times. The final iframe markup was seven thousand three hundred ninety characters, which is a lot of typing for an alert box.

Parameter says it reported this October eighteenth. OpenAI reproduced it, raised it from P two to P one, fixed both affected web frontends by October twenty-sixth, and paid a five thousand dollar bounty. Simon Willison called that a bit cheap for a flaw this serious.

The Hacker News reports no known real-world exploitation and says you need to do nothing, since the fix was on OpenAI's side.

For you, the lesson is postMessage. If your app embeds a widget that listens for cross-frame messages, check the sender before you render anything as HTML.

What's unclear is whether OpenAI changed cross-frame messaging or HTML rendering more broadly, or only closed the one MathLive path.

That ChatGPT fix needed nothing from you. This next one needs a reboot.

CVE twenty twenty-six, ninety-eight four thirty-two. Atlasum reports a remote, unauthenticated use-after-free in Linux's IP version four TCP handshake path, scored nine point eight by the kernel CNA, in code dating to Linux four point four.

Red Hat also rates it Critical at nine point eight. It says an unauthenticated remote attacker can corrupt kernel memory or crash a system over IPv4 TCP traffic, and that systems accepting inbound connections are most directly exposed.

Here's the mechanism, per Atlasum. During the handshake, IP version four options move from a request socket to a child socket without being copied. Another CPU can still be reading them when they get freed.

The upstream fix is two lines across two files. It swaps ordinary frees for RCU-deferred frees, which wait until readers are finished with the memory.

The nine point eight isn't universal. Atlasum says Ubuntu rates it High, while SUSE, Oracle, and Amazon say Important. Red Hat adds that reliable code execution would need precise heap control.

Atlasum also reports that Anthropic said its Claude model produced a working proof of concept for root command execution on servers with an MPTCP listener; Atlasum says Anthropic had not published the exploit. Go programs have enabled MPTCP by default on Linux listen sockets since Go one point twenty-four, so that setup may be common.

As of Atlasum's October thirty-first update, Amazon Linux had fixed kernels, AlmaLinux fixes were in testing, and Ubuntu and RHEL hadn't shipped yet. Stable releases like five point ten point two seventy two and seven point three carry the fix, but distributions backport under different version numbers.

So check your distro's tracker, and reboot into a fixed kernel.

The last two were about things that break. This one's about things that merely look like everything else.

Unslop is a skill for Claude Code and Codex. It audits what it calls slop, meaning generic AI-looking interface patterns, in a local project or from a live-site link. It handles Next.js, React, Vue, Svelte, Tailwind, and plain HTML and CSS.

It audits first and proposes a design direction before editing, so you can steer early. Then it works in passes: spacing, color, icons, copy, typography, layout, details, visuals, motion. If a screen is already good, it suggests small refinements instead of a redesign.

For hero images it can use fal, Replicate, OpenAI images, or Higgsfield. It shows the prompt and asks before each paid generation. The optional story video is a square clip, under ten seconds, of a screen unslopping itself, and it needs Playwright, Chromium, and ffmpeg.

The limit: it's unclear how repeatable the results are across models, or how often it makes edits you didn't want. Read the diff. Designers will add that a pass can regularize a UI without replacing product judgment.

To try it, clone the heydamir unslop repo and copy the unslop skill folder into your Claude skills folder. Then type unslop with a slash, and tell it, my landing page.

The license is CC BY 4.0, commercial use included, with credit to Damir Sokolovsky.

A repo's README is a claim you can check by running it. So is a database's marketing, and Jepsen just checked one.

ParticleDB advertised Full ACID and a hundred fifty-nine thousand transactions per second, while its documentation also described snapshot isolation. Jepsen found the documented transaction modes hard to interpret, and called the Full ACID claims somewhat premature.

Jepsen tested versions one point one point four through one point one point eighteen point eleven release candidate twenty-two, not just the first one. It found ninety-six issues: crashes, deadlocks, data loss, inconsistent reads, and malformed SQL behavior.

Most showed up on healthy single-node instances, often with one client and no faults. That's the unsettling part.

The method: generated transactions, and the Elle checker to infer dependency graphs and hunt for anomalies. Jepsen also compared generated SQL against PostgreSQL and injected process, filesystem, and disk faults.

Two examples. ParticleDB returned one row for the predicate where four equals five. And a dropped table's rows reappeared in a new table with the same name, with a floating-point value turned into an integer.

Scope matters. The replicated Raft cluster is enterprise cloud only, and the builds Jepsen got didn't support replication, so the report doesn't test clustered behavior. Orkes funded the work, under Jepsen's ethics policy.

By the last build tested, most earlier issues looked resolved. Jepsen still saw acknowledged writes lost in normal operation, and anomalies under the strongest serializable setting. Orkes says release one point one point nineteen candidate thirteen fixes the rest. Jepsen didn't test it.

If you're evaluating this, ask for an independent retest of that build, under replication and the transaction mode you'd actually run. A claimed fix isn't a fix until someone tests it, and release notes are claims too, just cheaper to check.

Claude Code two point one point three sixteen. Opus four point eight fast mode was deprecated October thirtieth and goes away November thirtieth. After that, fast-mode requests return an error instead of falling back to standard Opus, so migrate to Opus five point five to keep the speedup. The release also adds an environment variable to disable the ultrathink keyword, another for default subagent effort, and, for the Claude apps gateway, pooled group budgets on top of individual limits.

CrewAI one point fifteen point thirty-three. You can now pass inputs to a Python flow with crewai run, create a deployment from a zip that prints its source commit, and list your organization's skills with crewai skill search. It also reports token usage for LiteLLM tool-call and structured-output calls. Deeply nested JSON on Python three point twelve now stays text in the run TUI, an oddly specific fix.

LocalStack for Azure, public preview. It's free, with general availability expected in early twenty twenty-seven, and your existing Terraform, Bicep, Pulumi, and Azure CLI scripts can be used against it without rewrites. The catch, per InfoQ: App Service access restrictions and authentication settings are stored but not enforced, and the emulator serves HTTP. Virtual Networks neither route traffic nor enforce rules, so a green local test proves little about security. The transition FAQ still has a literal placeholder where the number of days goes.

OpenBSD eight point zero, officially dated October twentieth, raises the amd64 kernel address space from four gigabytes to five hundred twelve. That's enough to map graphics cards with more than four gigabytes of VRAM. The vmm and vmd tools now give guests up to sixty-four virtual CPUs. Intel Arc A-Series support is new, though NVIDIA GPUs remain unsupported, InfoQ notes. The release song is titled The Simps on AI.

Nvidia edited its Vera Rubin numbers. TechRadar reports per-GPU HBM4 bandwidth went from twenty-two terabytes per second to nineteen point two, and NVLink six from three point six to three. The HGX Rubin NVL8 system's listed bandwidth fell twenty-six percent, from one hundred seventy-six to one hundred thirty.

Nvidia's product page confirms nineteen point two per GPU and fourteen hundred terabytes per second for an NVL72 rack, but doesn't explain the change. TechRadar says older per-GPU tables no longer add up to the new totals.

Why you care: inference decode can be bound by memory, so bandwidth is where these numbers bite. Nvidia's engineers say effective kernel bandwidth matters more than peak specs. Its cost-per-million-token and tokens-per-megawatt comparisons use the Kimi-K2-Thinking model and 32K/8K input/output lengths; Nvidia labels inference performance subject to change.

Wait for reconciled numbers before you plan capacity.

Fast Boot, which is also what one tested Android 12 phone does about every ninety seconds.

SMS of Death. A public proof of concept can crash unpatched Android phones with one eight-byte data SMS, disconnecting calls, emergency ones included. It's processed before the inbox, so the phone goes down without a single notification to blame.

Reboot loop. The report says 20 malicious messages could leave phones in reboot loops. One tested Android 12 phone entered recovery mode about every ninety seconds and needed a factory reset, and Android 12 and 13 reportedly did not receive the October fix. That's less a phone than a very expensive metronome.

Volta-Autodoxer. Cisco Talos found an infostealer that feeds stolen data to AI models for a dossier. Talos said it had not tracked whether the malware was used in the wild. Its two hundred forty word prompt suggests checking whether the Wi-Fi password is the victim's last name.

Eight bytes to crash a phone, two hundred forty words to profile its owner. Somehow the malware is the wordy one.

Today we covered the ChatGPT share link bug, the Linux TCP flaw, unslop, and Jepsen's report on ParticleDB.

Try this today: look up your distro's kernel tracker for that TCP flaw, and reboot into a fixed kernel.

Links for everything are in the show notes. Follow The Daily Reboot wherever you get your podcasts. See you next time.