clearhandreview/vulnerpocalypse-containmentOpen-source vulnerability analysis, CVE tracking, patch verification, and temporary security containment tools
Maintained catalog, not a universal zero-day patcher. This project tracks publicly disclosed security fixes linked to Anthropic/Claude research and separately sourced October 2026 vendor advisories. It contains an attributed original Linux upstream patch for CVE-2026-98432, vendor update references for proprietary or signed products, a cross-platform read-only version-floor checker, and an optional Linux-only temporary runtime control with explicit rollback.
No arbitrary kernel or binary modification, no automatic patch downloads, no exploitation tests, and no claim that every OS or every Anthropic finding is covered. Optional, explicitly approved Linux runtime MPTCP containment is the only executable change introduced by this toolkit. If no verified vendor fix or supported release exists, the correct result is unknown / manual review, never “patched.”
For the simplest instructions, open Easy install. Pick your device and follow its numbered steps. You do not need to install Python on a phone. On computers, Python 3.11–3.15 is needed only to run this repository's optional offline checking tools.
| Device | Quickest safe step | Optional containment |
|---|---|---|
| Windows | Settings → Windows Update → Check for updates → Restart | HTTP.sys HTTP/3 exposure review for administrators; not a binary patch |
| Mac | System Settings → General → Software Update | Safari JavaScript restriction; not a full WebKit fix |
| iPhone / iPad | Settings → General → Software Update | Avoid untrusted browsing pending Apple update |
| Android / Pixel | Settings → System → Software updates; check Google Play system updates too | Avoid untrusted USB hosts; not a device lock-screen fix |
| Linux | Use your distro's signed security updates, then reboot | Optional supervised, reversible MPTCP feature switch (Linux only) |
| Chrome | Chrome → Help → About Chrome → Relaunch | Limit V8 optimization or stop using outdated Chrome |
| Other / unsupported | Use the original device vendor's published security update | No universal cross-OS binary patch exists |
Guide from a laptop/desktop (no root/admin rights needed):
python scripts/quickstart.py guide --os linux
python scripts/quickstart.py guide --os windows
python scripts/quickstart.py guide --os macos
python scripts/quickstart.py guide --os android
Each guide provides: before you change anything → simple steps → how to verify the temporary control → how to replace it with the vendor fix. If a profile cannot be justified, the command returns no verified profile.
One executable temporary control: Linux MPTCP runtime disable. It modifies the current namespace only after a separate, explicit administrator command, creates limited rollback state, and does NOT patch the kernel or persist across reboot. See Emergency containment. All other temporary actions are manual guidance, not unsigned binaries.
Do not treat a successful install command as proof. Record these separately:
docs/VALIDATION.md has exact commands and an evidence worksheet. For some
products (including Android's unmapped chain and vendor-backported kernels),
the result must remain unknown / manual review without vendor proof.
Assisted vendor handoff, for products with a published, comparable version floor (example uses an existing MSRC advisory):
python scripts/vendor_handoff.py CVE-2026-33096 --os windows --version 10.0.22631.6936 --vendor-advisory-reviewed --active-version-confirmed --smoke-test-passed
The flags are operator attestations, not automated detection. The strongest
result is READY_FOR_CHANGE_REVIEW, never an automatic rollback or claim of
exploit resistance. OS versions without a verified release floor are held
for manual vendor confirmation.
No code patch is made up for an undisclosed flaw. Most entries in Anthropic's disclosure dashboard do not expose enough technical data to write or validate a legitimate fix. A kernel/device "universal hotfix" cannot safely be synthesized from a CVE name or a hashed disclosure. Use a source-backed, reversible containment where available; otherwise isolate or stop using the affected service.
The data/containments.json catalog contains ten conditional,
limited exposure-reduction guides. These do not establish CVE remediation.
A new automatic patch is accepted only after source code, reproducible
vulnerability, supported versions, regression tests, rollback and review
have been established. See Contribution rules.
The optional read-only platform inventory identifies distribution families (including Debian/Ubuntu, Fedora/RHEL, SUSE, Arch, Alpine, Void, Gentoo, NixOS and Fedora Atomic), architecture, limited firmware context, and the presence of common programming-language toolchains. It does not execute toolchains or package managers, install patches, or certify firmware.
python3 scripts/platform_inventory.py --json
python3 scripts/catalog.py inventory
When a distribution is unknown or reports only a parent through ID_LIKE,
the tool declines to recommend a parent distribution's update command.
Android, WSL, containers, Linux servers, embedded hardware and cloud-hosted
services have different vendor update authorities. Read the
Linux, language and hardware coverage guide
for exact capabilities, unsupported targets and safe vendor handoffs.
The curated data/advisories.json contains 27 individually identified CVEs
across 16 advisory records. The source for each record is linked inside the
catalog. The original Chrome group contains CVEs attributed to Anthropic/Claude; the October 30 MediaStream CVE is a separate vendor disclosure. This is not an exhaustive CVE or disclosure ledger.