- Engineer — Plan: Severity is high (unauthenticated remote root), but enrichment signals are absent — no KEV, no confirmed public PoC, no active exploitation. Audit whether MPTCP listeners are running on exposed servers and schedule kernel patching as soon as a fix is available; consider disabling MPTCP if it is not operationally required.
- SOC/IR — Learn: No IOCs, no confirmed in-the-wild exploitation, and no ATT&CK-mappable TTPs are published yet; there is nothing to hunt or detect at this stage. Watch for follow-on reporting with exploitation evidence before writing detections.
- Leader — Skip