linux-security
7 posts
GhostLock is not a vulnerability.
GhostLock is a stack use-after-free present in every Linux distribution for fifteen years, exposing an enforcement point that was never built.
dd writes raw sectors below the filesystem
Why the Unix dd command is a real security primitive: raw block writes below the filesystem, wiper TTPs, exfiltration, and the telemetry gap defenders miss.
htop is a reconnaissance surface
How htop and top expose Linux resource contention - OOM-killer steering, D-state telemetry gaps, niced miners, and PID exhaustion mapped to MITRE T1562 and T1499.
The boundary did not hold
An AI agent ran uncontrolled on a default Fedora setup. The failure was not the agent. It was trust assumed by default and enforced nowhere.
Thirty years of weaponizing fork-exec
fork+exec inherits file descriptors, environment, and capabilities by default. That inheritance is the bug class behind Shellshock, runc CVE-2019-5736, and Symbiote.
Torvalds declares Linux security list unmanageable
Linus Torvalds says AI bug hunters have made the Linux security list unmanageable. An operator read on what failed at the intake boundary.
GTFOBins catalogues privilege misconfiguration
GTFOBins documents a structural property of Unix privilege: grants bind to binaries, not operations, and the gap is the escalation surface.