They'd also need to MPTCP right?
Not according to the article, which says the vulnerable path runs "during the TCP handshake, ..."
alt Hacker News
Not according to the article, which says the vulnerable path runs "during the TCP handshake, ..."