{"slug": "show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public", "title": "Show HN: Repairer – close the breach when a Linux flaw goes public", "summary": "A project called Repairer, published by gno.security, has released an open-source Go program that runs on each server and applies a signed stopgap the day a Linux exploit goes public, then automatically removes it once the vendor's real fix ships. The tool is framed around the Ubuntu critical CVE-2026-98432 (CVSS 9.8) and the claim that AI-discovered zero-day exploits are being reported at an exponential rate; stopgaps only remove access — dropping packets, disabling a kernel module or service, or removing a setuid bit — never open ports, download, install or run code, and revert via an armed undo playbook if they affect services. Repairer acts only on rules signed with a hardware crypto wallet, is built and tested on Ubuntu and Debian using standard-library Go, and the project proposes having a swarm of bonded-stake AI agents on gno.land write and check stopgaps, with agents caught lying losing their stake to whoever catches them.", "body_md": "As we've seen with the Ubuntu critical CVE-2026-98432 (CVSS 9.8), AI-dicovered zero day exploit are being reported at an exponential rate and we don't have the process for dealing with the flood of exploits in real time.\n\nWhat we need is an AI-based system for autopatching systems based on real time information. The vendor's fix can take days or weeks to be out (is the Ubuntu thing patched yet?) and meanwhile the grid is vulnerable to exploitation, especially AI worms.\n\nRepairer is a small program that runs on each of your servers. The day an exploit goes public it puts up a stopgap that blocks it, and once the real fix is up it takes the stopgap back off by itself.\n\nA stopgap only takes something away — drop certain packets, turn off a kernel module or service, remove a setuid bit. It never opens a port, installs or downloads anything, nor runs code. It arms an undo playbook before applying the stopgap, so the change reverts if affects any services.\n\nIt only ever acts on rules you sign with a (hardware) crypto wallet.\n\nLet's go further: stopgaps are written and checked by a swarm of AI agents (gnosh.ai sessions) running on gno.land, each with bonded stake. Each stopgap is run on fresh machines, and whoever is caught lying loses their stake to whoever caught them.\n\nThe agent is built and tested on Ubuntu and Debian, all open source, standard-library Go. More distros coming. Let's build repairer together.\n\n[https://gno.security/repairer/](https://gno.security/repairer/)\n[https://github.com/gnosecurity/repairer](https://github.com/gnosecurity/repairer)\n\nComments URL: [https://news.ycombinator.com/item?id=50388417](https://news.ycombinator.com/item?id=50388417)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public", "canonical_source": "https://gno.security/repairer/", "published_at": "2026-11-06 05:00:14+00:00", "updated_at": "2026-11-06 05:21:30.979342+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "developer-tools"], "entities": ["Repairer", "gno.security", "gnosecurity/repairer", "Ubuntu", "Debian", "CVE-2026-98432", "gno.land", "Go"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public", "markdown": "https://wpnews.pro/news/show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public.md", "text": "https://wpnews.pro/news/show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public.txt", "jsonld": "https://wpnews.pro/news/show-hn-repairer-close-the-breach-when-a-linux-flaw-goes-public.jsonld"}}