ALBY HUB MERGED A FIX FOR A 9.8-RATED LINUX EXPLOIT PATH — ITS LATEST RELEASE AND DOCKER IMAGE DON’T HAVE IT — THE SEED SITS DECRYPTED IN MEMORY

On November 2, 2026, at 11:01 UTC, Alby Hub added one setting to its build file: godebug multipathtcp=0. The comment above it says, “Disable MPTCP by default to reduce exposure to CVE-2026-98432. Host kernels still need patching.” This is the Linux kernel bug rated 9.8 out of 10 that lnd closed off on October 30. Go’s security team wrote on October 29 that in a published exploit, a server using multipath TCP listeners “is shown to be vulnerable to Remote Code Execution.”

The fix isn’t in what people download. Hub’s latest release is v1.24.4, dated October 22. I read its build file: Go 1.26.10, no such setting. Go has opened these listeners by default since 1.24. Hub’s server starts on port 8080 on all interfaces through Go’s plain net.Listen. The “latest” image on GitHub’s registry has the same digest as v1.24.4, and Umbrel’s app store pins that digest. At 00:04 UTC on November 3, I found no release and no image tagged for the fix.

The limits. I read the code; I didn’t run it. The shown exploit needs a Linux kernel with MPTCP switched on and a port a stranger can reach. Hub’s README example binds to 127.0.0.1, and Umbrel puts Hub behind its app proxy, so a home box may be out of reach. Alby didn’t say how many servers are exposed. And Go’s security team warns that “the underlying bug is not specific to MPTCP.” The real fix is a patched kernel. Ubuntu’s tracker, read November 2, lists every LTS from 16.04 through 26.04 as vulnerable, with work in progress on 22.04 and later.

Hub’s GitHub page says, “Run anywhere. Become self-sovereign.” Its README says the seed phrase is encrypted and “only decrypted in-memory in order to run the lightning node.” That is the honest price of holding your own keys on a server. Whoever gets root on the box gets the memory too. Run sudo ss -Mlnp on Linux. If Hub shows up, start it with GODEBUG=multipathtcp=0 and patch the kernel. Nobody has to release anything for that to work. At the time of this writing, bitcoin was $77,507.