> I have not seen an exploit in the wild.

How would you see one? Have you deployed your own army of honeypots that are actively logging and looking for corrupt IP options packets? If you're not already looking for it, I think it's very likely that most people who get hacked will have no way of knowing how it happened, so we can't consider those incidents as being a result of this particular bug.

Are you actually monitoring for this specifically or just trying to use a sample size of 1 group of servers to prove something?

The recent wave of vulnerabilities has actually prompted a lot of people to set up honeypots, monitoring, etc. and the rate of actual exploits has been notably very low for the general public.

Most of the October CVEs we've seen were situations that require an extremely complex chain of attacks - amazing if you want to break into a bank, or fuck up some grocery freezers, not so useful for scanning random public boxes and doing "hacks of opportunity"

Apologies for the lack of links - it's a scattering of random people I've read talking about this, not any coordinated study. But if you read between the lines on all of the threads about these CVEs, you'll notice a lack of "I was hit by this" stories - which is pretty normal for more complex vulnerabilities.

The reason these sat unnoticed for so long is precisely because it's difficult to actually exploit them.

If anyone has anecdotes to the contrary, I'm definitely interested in hearing it, of course!

Jesus H Christ! the bug is a narrow use-after-free race that needs SYNs carrying ipv4 options to make it to the box. I do not need an army of honeypots to tell you it most likely doesnt to have a way into a classic 443 machine... come on now.