@malwaretech hey, just a reminder that blocking MPTCP is not the proper fix: MPTCP has the vulnerability because it is on top of TCP which has the bug. And it happened Anthropic used MPTCP because it "only" took them 50+ minutes in a lab to attack a remote host.

The proper workaround is to block IPv4 options, which are certainly already blocked in many places for years.

https://social.kernel.org/notice/BBxO99YYQ3YK11iS8G

BTW, researchers showed that some firewalls (e.g. China) are replying with the same TCP options.