Linux kernel maintainers observed an encouraging milestone in software security. Specifically, subsystem maintainers report that Linux AI bug fixes are finally overtaking the influx of automated defect reports. Linus Torvalds highlighted this positive trend...
The novel Linux implant, Quasar Linux, poses a formidable threat not merely to individual workstations but to the entire software supply chain. This malicious suite targets environments dedicated to the creation, compilation, and dissemination...
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution....
Singularity is a powerful Linux Kernel Module (LKM) rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through advanced system call hooking via ftrace infrastructure. What is Singularity? Singularity is a sophisticated rootkit...
Synacktiv researchers have documented a novel GNU/Linux rootkit, LinkPro, uncovered during an investigation into an AWS infrastructure compromise. The intrusion began with exploitation of a vulnerable Jenkins server, after which the threat actors deployed...
An eBPF agent that captures traffic flowing through the Linux kernel. By attaching to TLS/SSL functions, data is intercepted before and after encryption and then passed to flexible plugins with full visibility along with...
kntrl is an eBPF based runtime agent that monitors and prevents anomalous behaviour defined by you on your pipeline. kntrl achieves this by monitoring kernel calls, and denying access as soon as your defined...
kflowd kflowd runs as an agent on Linux endpoints to monitor processes via eBPF kernel subsystem for filesystem and TCP and UDP networking events, enabling immediate threat and anomaly detection on suspicious activities. Advanced...
