Get Off the Internet (the Public One)

I've spent almost thirty years building internet infrastructure. The internet I started building on was a million nodes in garages, run by hobbyists, universities, and small companies, all reachable, all direct. The whole point was anyone could talk to anyone. That was the feature.

It's also the vulnerability now. Everything connected means every public address gets found by scanners, bots, and exploit kits, at machine speed, with AI writing the exploits. The whole thing runs on trust in parties you never met, starting with the runtime behind port 443 and the certificate authority baked into every device you own. One careless certificate issuer or one missed patch cycle and the damage can be permanent.

You can see what comes next. A private network you belong to, where nothing is exposed to the outside and the only way in is the one you chose. The group chat beat the public feed for the same reason: small, high trust, by invitation. doxx.net is that idea applied to the whole internet, a parallel internet you join, where the only members are the devices, people, and agents you let in, built on infrastructure we own rather than rent, with our own addresses, our own DNS root, and our own certificate authority. Inside the walls you get back what the open internet promised and lost: direct connections between your devices.

Today we're making the mesh and call, chat and video communications free.

October was the case for why

If you own a server on a public IP, October was a bad month. Two critical flaws in the PHP interpreter leaked on October 20, before a fix existed. The bugs are in PHP core, not in any framework or plugin, and the exploit triggers while PHP is still parsing the request, before your application code runs. No login, no accepted file upload, nothing but ordinary HTTP POSTs. App-level validation never sees it. Fixes shipped the next day.

The same week, Node2Shell exposed applications that decompress attacker-controlled Brotli data to memory corruption and possible remote code execution. Node.js released fixes on October 21.

Then the kernel itself joined in. CVE-2026-98432 is a flaw in the Linux IPv4 TCP handshake, below your application code. The demonstrated exploit uses IP options and an MPTCP listener. An AI model wrote a working root exploit in under an hour. By November 2, Ubuntu had published fixes for qualification testing for several supported releases, with Ubuntu 26.10 already fixed. Check the advisory for your release and kernel.

These flaws reach vulnerable code through different paths. PHP and the kernel expose risks in accepting connections; the Brotli bug also matters when an application processes untrusted compressed data. Of course the first step is to patch them. But patching is reactive, and is the entire defense for anyone whose whole security posture is "the box is reachable and I keep the software current." AI-discovered vulnerabilities are outpacing that posture because reachability leaves you nowhere to hide while you do it.

How doxx.net filters the attack

Most of October's advice was patch and pray. While fixes work their way through distribution testing and deployment, we did what I've done since Prolexic: filter the attack in the network.

The bug is a use-after-free in the Linux TCP handshake (CVE-2026-98432, CVSS 9.8). When a connection request comes in, the kernel saves the options carried on that SYN and hands them to the child socket it builds for the connection. On the affected path that saved state gets freed and used again, and Go 1.24 made MPTCP the default for ListenConfig on systems that support it. Applications can override that default. The trigger is always an inbound SYN, the first packet of a connection someone opens toward you.

Two ways we take that off the table.

First, exposure. A doxx.net server with the outside world turned off has no path from the public internet at all. Only the devices you allow in can reach it, so the SYN that starts this never arrives.

Second, for servers that do take internet traffic on a doxx.net address, the fabric drops the trigger packet before it reaches you. On IPv4 the exploit rides in the IP header options of the SYN. Those options have no legitimate use toward a client, and the kernel's saved-option path is exactly what the bug abuses, so we drop an inbound SYN that carries the option types this exploit uses: record route, timestamp, and loose and strict source routing. We don't drop IP options wholesale, and we only act on connections opened toward you, so nothing you initiate is affected.

Alongside that IPv4 mitigation, we hardened inbound IPv6 handling. IPv6 carries per-connection data in extension headers rather than IPv4 options (hop-by-hop, destination options, routing, fragment, authentication header). So we drop an inbound IPv6 SYN that carries any extension header, and we drop the tiny-first-fragment trick that splits the TCP header across fragments to slip past inspection. While we're in that SYN we also strip MPTCP's MP_CAPABLE option: that removes the MPTCP attack surface entirely, and it closes an evasion where an extension header in front of the TCP header was used to smuggle MP_CAPABLE past a naive filter. The connection still completes as plain TCP.

All of this is a single byte compare on the doxx.net server fast path, and it runs only in the inbound-to-client direction. It's live today for every doxx.net user with a port open to the internet.

The Security screen in the app shows every attempt we dropped, with the CVE, the vector, and where it came from, so you can watch it work instead of taking my word for it.

It doesn't patch the kernel. It buys you the time to.

The mesh lesson

Another answer to October is the one making the rounds: put the box behind a private network. Good advice. We built a company around it. But October stress-tested that answer too, and it's worth being honest about what it showed.

On October 25, a researcher published eleven security findings against Tailscale and the open-source headscale server, without coordinated disclosure, and with no patch available at the time. The headline finding was in Tailscale's optional built-in SSH feature, served by client software that runs as root: a lab-demonstrated flaw that could let a device already inside the network escalate beyond its configured user to root on other machines. The attack came from inside the private network. (Tailscale responded substantively. They called the issues serious and released fixes in Tailscale v1.104.4 on October 28; check their security bulletins for the current state.)

To be fair to Tailscale: you can run plain OpenSSH over their network with the SSH feature turned off, and a private network is still a far better place to be than a public IP. The lesson isn't "mesh bad." The lesson is about what runs as root on the machines you install things on, and about whether your networking tool tries to replace your SSH or just carry it.

doxx.net takes the second path. There is no SSH server inside our client. OpenSSH, your keys, and your user accounts stay exactly as they are, with the privilege separation they already have, and a server joins the mesh with a standard WireGuard config and no extra software from us. That's an architectural choice. Our client is software, and software has bugs. But a bug in the thing carrying your packets is a different kind of bad day than a bug in the thing holding root logins to your fleet, and we would rather only ever be the first thing.

The lockdown, in four moves

For a VPS or any box you administer, this is the whole recipe:

1. Private network, not public. Put the VPS on the mesh with your laptop and phone. Confirm you can reach it over its private address before you touch the public firewall, and keep a second way in until you have.

2. Default-deny inbound. Configure the firewall so nothing reaches the box unless you allowed it, and know your provider's semantics, because an empty ruleset isn't universally a deny-all.

3. One door for the app. The only rule that touches 443 allows your edge provider's IP ranges, with origin authentication on. For Cloudflare, use zone-level or per-hostname Authenticated Origin Pulls with your own certificate when you need to identify your account; its shared global certificate only identifies the Cloudflare network. Direct-to-origin scanners and bypass traffic hit a wall; the requests that do arrive come through your edge, where you can filter and log them. Check IPv6 as well as IPv4.

4. SSH and admin via the mesh. OpenSSH stays in charge of who gets in; the mesh just carries the session. If you want zero inbound at all, an outbound-only tunnel from your edge provider gets you the rest of the way. The allowlist and the tunnel are alternatives, not a requirement to do both.

This replaces the public door instead of backing it up. Note what it doesn't do: it doesn't fix vulnerable code, and if your app is public, patch it anyway. It removes doors. And the machine most people should move first is the always-on box that runs their agents.

The part your agent does

You shouldn't have to do any of this by hand.

Set up the network. config.doxx.net is a full network API with native MCP support, written to be read by agents. Point yours at it and it explains doxx.net, joins your devices to the mesh, sets the firewall rules, and leaves you with a working private network and a page of what it did. The agent that keeps your machines patched and notices when something is wrong needs a network it can act on without exposing them, and this is that network. The network setup is free; agent seats are part of the paid plans.

Work from inside it. Agents browse, fetch, log in, and act with your accounts and your authority, which makes a fake login page or a malware host a bigger problem for an agent than for a person. On the paid plans, an agent operates inside your network with DNS Protection in front of it, which has blocked more than 48 million threats since December 2025 and is adding 2 million per week, mostly known-malicious destinations. It helps keep an agent from wandering somewhere it shouldn't; it is not a substitute for watching what your agent does.

Talk to you, and to other agents, in private. An agent seat gives the agent its own identity on your network and private channels to its humans and to other agents, over the same peer-to-peer communications you use. It can chat with you and hand you a file with no platform in the middle, and it only reaches what you explicitly granted.

What's free, and for whom

The mesh and the communications are free for up to 3 devices, and every plan includes a private domain. That includes encrypted mesh, end-to-end encrypted calls, video, chat, voice memos, and file transfer, with no email, no phone number, no password. Your account is a token your device earns with proof-of-work. There's nothing to leak because nothing was collected.

Paid plans add more. Essentials ($6/month) covers 5 devices, private browsing over our own backbone, DNS Protection, and 1 agent seat. Pro ($16/month) covers 8 devices and everything in Essentials, plus Onion Routing, Covert Networking for networks that block private traffic, Anti-Fingerprinting, and 5 agent seats.

Why now?

Most VPS setups are a public IP with SSH open and an app on 443, defended by a key pair and hope. Keys stop brute force. They do nothing against a bug in the thing you're connecting to. Get the box off the public internet. We made that part free.

The internet was supposed to let two machines talk to each other directly. We lost that decades ago, and everything wrong with the internet moved into the gap. A mesh is a list of devices you let in. Comms is a list of people you let in. Same network, same idea, and in both cases the list is yours, not ours.

Keep the public internet for public things. Put your devices, your people, and your agents inside the walls. We just made the walls free.

Get started at doxx.net, or point your agent at config.doxx.net. Join the community at doxx.net/discord.

Barrett Lyon is founder and CEO of doxx.net. He founded Prolexic Technologies (acquired by Akamai), BitGravity (acquired by Tata Communications), XDN (acquired by Fortinet), and Defense.net (acquired by F5), and has worked with law enforcement to track extortion crews across continents.