{"article":{"slug":"wtf-ubuntu","title":"WTF Ubuntu?","subtitle":null,"summary":"An angry post arguing that Ubuntu failed its promise of timely patches: more than two weeks after Debian patched the critical remote Linux TCP bug CVE-2026-98432, every supported Ubuntu release was still listed as vulnerable, so the author took his Ubuntu servers offline and is moving off the distro.","content_type":"opinion","language":"en","canonical_url":"https://chalmovsky.com/posts/wtf-ubuntu","author":{"name":null,"url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"chalmovsky.com","url":"https://chalmovsky.com/","listing_slug":null,"listing":null},"topics":[{"name":"linux","slug":"linux","url":"https://listedarticles.com/topics/linux"},{"name":"security","slug":"security","url":"https://listedarticles.com/topics/security"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":301,"reading_minutes":1,"published_at":"2026-11-02T12:00:00.000Z","added_at":"2026-11-02T17:12:38.877Z","updated_at":"2026-11-02T17:12:38.877Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/wtf-ubuntu","markdown_url":"https://listedarticles.com/articles/wtf-ubuntu.md","example":false,"citation":"chalmovsky.com. \"WTF Ubuntu?.\" 2 Nov 2026. https://chalmovsky.com/posts/wtf-ubuntu (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://chalmovsky.com/posts/wtf-ubuntu"},"body_markdown":"# WTF Ubuntu?\n\n*2026-11-02*\n\nWhat the fuck, Ubuntu?\n\nIn case you missed it: [CVE-2026-98432](https://ubuntu.com/security/CVE-2026-98432) is a critical (CVSS 9.8)\nbug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet\nhas it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server.\nA total takeover.\n\nDebian [patched it on October 16](https://lists.debian.org/debian-security-announce/2026/msg00482.html).\nUbuntu still doesn't have a patch more than two weeks later.\nEvery supported release, LTS included, is listed as \"Vulnerable\".\n\nUbuntu's website promises [\"timely patches for critical vulnerabilities.\"](https://ubuntu.com/server)\nUbuntu hasn't shipped the patch nine days after it was rated 9.8 and six days after a working root exploit.\nVery fucking timely indeed.\n\nSoftware is full of this blabber where words mean nothing. Ubuntu uses words like these:\n\"Timely.\" \"Enterprise-grade.\" \"Production grade.\" \"Enterprise resilience. Developer velocity. Build with confidence on Ubuntu.\"\n\nSomebody, or perhaps worse, some special team at Canonical is dedicated to writing these........\n\nSo I'm asking again... What the fuck, Ubuntu?\n\nI'm moving all my servers off Ubuntu. I've completely lost trust in it.\nOn the desktop I always hated it anyway. On servers I mostly used it because it's the default\non most VPS providers, and I considered it the solid, no-drama LTS distro. Fuck that now.\n\nI can't express how crazy this is. I didn't have time to migrate my services and data when I learned\nabout this, so I had to take all my servers that run Ubuntu offline.\n\nOh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu,\nmade by a company that sells security subscriptions, hasn't. This is true as of 2026-11-02 14:48 UTC.\n\n*Added after this blew up:* Can't beat all the bullshit, so I parody it at [Bloatberg](https://bloatberg.com).\n","body_html":"<h1 id=\"wtf-ubuntu\">WTF Ubuntu?</h1>\n<p><em>2026-11-02</em></p>\n<p>What the fuck, Ubuntu?</p>\n<p>In case you missed it: <a href=\"https://ubuntu.com/security/CVE-2026-98432\" rel=\"nofollow ugc noopener\">CVE-2026-98432</a> is a critical (CVSS 9.8)\nbug in the Linux kernel&#39;s TCP code. It&#39;s been there since 2016, so virtually every Linux server on the planet\nhas it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server.\nA total takeover.</p>\n<p>Debian <a href=\"https://lists.debian.org/debian-security-announce/2026/msg00482.html\" rel=\"nofollow ugc noopener\">patched it on October 16</a>.\nUbuntu still doesn&#39;t have a patch more than two weeks later.\nEvery supported release, LTS included, is listed as &quot;Vulnerable&quot;.</p>\n<p>Ubuntu&#39;s website promises <a href=\"https://ubuntu.com/server\" rel=\"nofollow ugc noopener\">&quot;timely patches for critical vulnerabilities.&quot;</a>\nUbuntu hasn&#39;t shipped the patch nine days after it was rated 9.8 and six days after a working root exploit.\nVery fucking timely indeed.</p>\n<p>Software is full of this blabber where words mean nothing. Ubuntu uses words like these:\n&quot;Timely.&quot; &quot;Enterprise-grade.&quot; &quot;Production grade.&quot; &quot;Enterprise resilience. Developer velocity. Build with confidence on Ubuntu.&quot;</p>\n<p>Somebody, or perhaps worse, some special team at Canonical is dedicated to writing these........</p>\n<p>So I&#39;m asking again... What the fuck, Ubuntu?</p>\n<p>I&#39;m moving all my servers off Ubuntu. I&#39;ve completely lost trust in it.\nOn the desktop I always hated it anyway. On servers I mostly used it because it&#39;s the default\non most VPS providers, and I considered it the solid, no-drama LTS distro. Fuck that now.</p>\n<p>I can&#39;t express how crazy this is. I didn&#39;t have time to migrate my services and data when I learned\nabout this, so I had to take all my servers that run Ubuntu offline.</p>\n<p>Oh and btw, distros run by volunteers (Debian, Arch, Alpine...) hve shipped the fix. Meanwhile Ubuntu,\nmade by a company that sells security subscriptions, hasn&#39;t. This is true as of 2026-11-02 14:48 UTC.</p>\n<p><em>Added after this blew up:</em> Can&#39;t beat all the bullshit, so I parody it at <a href=\"https://bloatberg.com\" rel=\"nofollow ugc noopener\">Bloatberg</a>.</p>","headings":[{"level":1,"text":"WTF Ubuntu?","id":"wtf-ubuntu"}]}}