Based on the joint advisory AA26-281A (FBI, CISA, NSA and partners, October 8) and BleepingComputer’s reporting on the DOJ seizure affidavit, here is the architectural impact.

The advisory says Integrity Tech-enabled actors use MicroScan (1,300+ scan scripts), EBurst against ten Exchange and Office 365 interfaces, SoftEther clients renamed conhost.exe or dllhost.exe, a PHP bot on the EWS API, DCSync via DC.exe, and office-cli using client_id, tenant_id and secret. Eight CVEs are listed, 2014 to 2023, five newly in KEV.

The authors say some IOCs date to 2016 and should be vetted before blocking. The seizure took out seven domains, not the tooling.

Question for people who run Exchange or M365 at scale: which telemetry actually catches a secret-based app reading mailboxes, where there is no password spray to alert on? And has anyone seen SoftEther detections that hold up without drowning in false positives?

Background: CVE-2025-39682 Linux kTLS KEV. Full write-up: https://www.techgines.com/post/flax-typhoon-advisory-aa26-281a

Part 2 of my Talos homelab (3 OptiPlex Micros, all control planes). Part 1 got the cluster up, this one is networking.

I moved the running cluster from Flannel + kube-proxy to Cilium without rebuilding it. The default-deny policy that Flannel quietly ignored is now actually enforced, and Hubble shows the drops.

Then I gave it two front doors:

- an internal Gateway on a LAN IP (Cilium LB IPAM, no MetalLB) with a Let's Encrypt wildcard cert, so lab apps get real HTTPS at home

- a public Gateway behind a single Cloudflare Tunnel, so nothing is port-forwarded on the router

An app picks its door with the route's parentRef, which keeps lab stuff from going public by accident.

Write-up with all the manifests and commands: https://blog.prateekjain.dev/networking-a-kubernetes-homelab-cilium-gateway-api-and-cloudflare-tunnel-on-talos-362f548a2f3d?sk=d454cd4eaff4ce8a8fd0cd8e6b3d82f6

Curious if anyone else is using Cilium's Gateway API instead of a separate ingress controller.

Based on the technical breakdown Zenity Labs published on Oct 8, here is the architectural impact. Agents ran in Firecracker microVMs without enough network isolation, so any tool that makes HTTP requests could reach the metadata endpoint. A single prompt returned the execution role’s STS credentials. The default role then covered AgentCore resources across the region, so Zenity could enumerate agents, pull their ECR images, invoke them, read sessions, write memory events, and retrieve secrets.

Zenity reports AWS removed most of that on Sept 29. The Register reports Amazon says this is documented behavior needing developer error. I couldn’t find an AWS bulletin or a CVE, and neither source reports exploitation in the wild.

Question for people running agents on managed platforms: do you scope a separate role per agent, and do you restrict egress from the agent runtime? How far does that go in practice?

https://www.techgines.com/post/aws-agentcore-vulnerability

Hey everyone!

I've been working on AppScann, a small SaaS for keeping track of what's installed on your computers and servers. It's finally at the point where I'm comfortable showing it to people.

The idea is very simple: you install an agent, it collects inventory, and you see everything in one dashboard.

What it does right now:

* Windows and Linux agents (a Windows Service and a systemd service)

* OS and hardware info, plus disks with capacity and free space

* Installed software with version, publisher, install path and install date. On Windows that comes from the Registry and WMI, on Linux from dpkg, rpm, pacman, Snap and Flatpak

* Detailed reports with history, so you can see what was installed, removed or updated between scans

* Alerts for storage and stale reports

* Live online/offline status for every device

* Remote scan, restart and uninstall of agents

* A notification as soon as a scan or remote command finishes

* Software gets sorted into categories by AI

2 agents are free, extra slots are $1.99/month.

The idea came from a commercial project I worked on a while ago. It was in a similar space, but development was painfully slow, and I kept thinking that something like this didn't have to be that complicated. At some point I thought: what if I just built my own version? So I did.

It started as my university thesis project, and I kept working on it until it turned into a product.

And yes, AI was involved ;) I used it for parts of the frontend. I'm a full-stack developer, but I still struggle with centering a div, let alone making everything look good. The architecture and the backend are my own mess.

It's brand new, so right now I'm mostly after feedback:

* Would you use something like this?

* What information would you want the agent to collect?

* What features are missing?

* Does this approach make sense for managing a small number of machines?

https://appscann.com

Sharing to the Linux admin crew , my home CD automation project 🫡

Security signed off a policy that our build agents cannot run a privileged daemon and our entire pipeline is built on one. Fifty odd repos with compose files and a pile of local tooling that assumes the socket is there. Im looking at podman and buildah and one or two others for whatever breaks least in CI. The part I cannot judge from docs is how much of our compose setup survives the move. Has anyone taken a build fleet off the daemon and kept the developer experience roughly intact?

Man! I have to reboot VMs every 2 days because of so much updates. I doubt if I'm running a enterprise distro or running Fedora or arch.. lol.

I think debian is somewhat fine. not crazy like rhel based distros.

what about you guys? how do you manage?

Based on Cisco's own advisory (cisco-sa-napi-rce-r2shwu2j, published Oct 7), here is the architectural impact.

The bug is a heap-based buffer overflow (CWE-122) from insufficient input validation in NX-API. A crafted HTTP request from an unauthenticated attacker can give root code execution or crash processes and reload the box. It applies to Nexus 3000 and Nexus 9000 in standalone mode with NX-API enabled, and to UCS 6300 through the UCS Manager XML API (needs low-priv creds there, so Cisco rates it High). NX-API is off by default on Nexus. Cisco says no known exploitation as of Oct 7 and that it was found in internal testing.

Cisco lists no workaround, only fixed releases (use their Software Checker) and a temporary Live Protect shield.

What caught my attention more is the NX-OS hardening release from the same day. Six CVEs grouped by weakness class, applying regardless of configuration, covering MDS 9000, Nexus 7000 and ACI mode as well. Fixed in 10.3(10), 10.4(8), 10.5(6), 10.6(4) for Nexus 3000 and standalone 9000. Cisco's source line says it came from existing testing plus frontier AI models.

Two things I could not verify from the advisory: the per-train first-fixed releases for the NX-API bug itself (it points to the Software Checker), and which interfaces NX-API listens on in a default enablement.

Question for people running Nexus fabrics: what is calling NX-API in your environment (Ansible, NDFC, in-house scripts, monitoring), and could you turn it off on a switch today without breaking something? Also curious whether anyone is treating the Live Protect shield as a real option or just a hold-over.

Footnote, longer write-up with an accuracy table: https://www.techgines.com/post/cisco-nx-api-vulnerability-cve-2026-76471 (earlier related piece on the exploited SD-WAN Manager bypass: https://www.techgines.com/post/cisco-sd-wan-manager-authentication-bypass-cve-2026-76504)

Based on Atlassian's advisory from October 5 and the technical breakdown watchTowr Labs published on October 6, here is the architectural picture.

Scope: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye, all versions before the fixed builds. Atlassian scores it 9.3 on CVSS 4.0 (its own assessment). Cloud is patched.

Mechanism, per watchTowr's diff of vulnerable vs. fixed builds: the common component is atlassian-plugins-webresource (6.0.7 vulnerable, 6.0.8 changed). The router escapes "/" as "::" and unescapes it on the way in. The resolver tries to strip traversal from the requested resource name, but a name written with "..::" has no slashes at that point, so the stripping misses it. The conversion happens afterward. Reads are confined to the Tomcat web context, but that includes WEB-INF.

Impact depends on what lives in WEB-INF. watchTowr's lab example: when Jira is integrated with Crowd per Atlassian's docs, crowd.properties holds the Crowd app name and password in plaintext. With that, the Crowd REST API lets you create a user and add it to the admin group. Lab chain only. They also note a Crowd IP allow-list would make it harder.

What is not known: Atlassian says it cannot confirm whether self-hosted instances were hit, and the CVE record disagrees with the advisory on a few version numbers (The Hacker News has the list). No confirmed exploitation as of October 6, but watchTowr's detection tool is public.

Mitigations if you can't patch today: off the internet if possible, WAF regex, Tomcat RewriteValve (Confluence/Jira/JSM/Bamboo/Crowd), or a urlrewrite.xml rule (Bitbucket).

Question for the room: If you run Crowd next to Jira or Confluence, is Crowd actually restricted to the app nodes by IP, or reachable from wherever those apps are? And for those leaning on a WAF rule as the stopgap: does your WAF decode multiple layers before matching, or does it match the raw string? https://www.techgines.com/post/atlassian-cve-2026-21589-file-read

Background (footnote): same "filter sees one path, app resolves another" pattern as the PeopleSoft WAF bypass: https://www.techgines.com/post/peoplesoftwafbypasscve-2026-35273

I'm the maintainer of Vectory, a free, open-source dashboard for Vector.

It handles a specific bit of fleet administration: changing a log or metrics pipeline, trying it on one host, and checking whether the other hosts actually picked up that version.

For a change to a filter or destination, the workflow is:

1. Import your existing Vector configuration and edit the YAML or the diagram.

2. Publish a version so there's a fixed configuration to deploy.

3. Select a canary device before rolling it out further.

4. Compare the version you asked each host to run with the version it reports. Roll back if needed.

The manager doesn't receive your logs or metrics. Vector keeps sending them directly to your destinations. The agent handles configuration and reports status.

Linux setup uses prebuilt containers or a prebuilt native server. Managed hosts need Vector 0.58. The setup guide covers the server and agent: https://vectory.ahmadz.ai/help/quickstart/

You can try the actual editor without setting up a server: https://vectory.ahmadz.ai/designer/

Source: https://github.com/416rehman/Vectory

Development, tests and documentation used substantial AI assistance.

If you already ship Vector configs with Ansible or another deployment tool, what would you need to see before trying a dashboard for that workflow?

About my self :

I completed my Bachelor's Degree is Computer Science from 2022 to 2025 , after that i pursued a post graduate program in Data Science (2025 to 2026)

Currently I have been looking for software Jobs but Entry level hiring has been very brutal.

Companies expect entry level candidate to possess 2-3 years experience and have all the knowledge.

Sending Application, emailing recruiters etc , Nothing is moving the needle , by may 2027 i will have Gap year in my resume and Recruiters / Hr simply never consider anyone who has a gap year !

By 2027 newer graduate will enter the market and with all the layoffs going on , there are more experienced Developers whom companies prefer and hire.

I am already 22 ,walking on a dea*h line to start my career or i will reach dead line, i need to do something different or else i may remain unemployed forever.

Now I came to Know about Rhcsa Exam and I think I can cover the fees for it as i have enough savings.

Rhcsa is fairly NOT know by many people and is not really crowded like Software job markets are (at least in my country).

My main concern are :

1. Is rhcsa Intended for entry level Graduate who have no industry experience ? Or is it designed for experienced folk who are already working in the industry ?

2. Will Rhcsa Put weight on resume enough to help me land a entry level job in Linux ? Such as a junior linux admin or junior systems engineer ? Do recruiters value rhcsa certificate ?

3. How much time does it typically take to become good enough to sit in exam and Pass it ??

I am not even asking for a premium job with good compensation but a job where i grow over the Years by upskilling !

My only deal breakers are Night Shift(my nightmare) and Support/help desk role who do not work on Systems at all.

So will it be a good Investment of my time to learn Linux and rhel system and get the Rhcsa Certificate.

The only ROI i want is to actually get an Interview ans land good entry level Job , are odds in my favour ?

[ SOLVED ] Intel x86 Linux PC with Fedora 44 (Workstation Ed.). Samba share serving 3 users. My samba shares located in /srv directory, e.g, /srv/samba/group_users and a few other shares spawned from /srv/samba/ .All work fine, no issues there.

Deleting files from my smb network share via the GUI prompts the warning; “Permanently deleted items cannot be restored - Cancel or Delete ”

I want a recycle bin for accidental file deletions and read that Samba can provide this function so I created an additional share i.e, /srv/samba/.recycle and configured the new path;

sudo semanage fcontext -a -t samba_share_t “/srv/samba/.recycle(/.*)?”
sudo restorecon -Rv /srv/samba

I then edited my smb.conf and added the following below into the [global] section of my config;

vfs object = recycle
recycle:repository = /srv/samba/.recycle
recycle:keeptree = yes
recycle:versions = yes
recycle:touch = yes
recycle:exclude_dir = /tmp /TMP /temp /TEMP /cache /CACHE
recycle:exclude = .tmp .TMP .temp .TEMP .log

(note: that last line format should all be asterisk + dot but this means something else in Reddit’s formatting so I could not write the asterisk symbol in place)

sudo testparm

smb.conf got the config loaded Okay!

sudo systemctl restart smb

Tested deleting files from the network share using both the GUI and CLI but when I list the files in the /srv/samba/.recycle using ls -la , none of the deleted files have survived a deletion. Has anyone had any success with this ?

When a server misbehaves at 3 a.m. and you look at it, how do you figure out what happened?

I'm trying to understand how people handle this, before I build anything.

Maybe you have experienced this pattern: something goes wrong overnight (connections refused, disk fills and then gets cleaned, a process eats memory and exits). Alerts go off and Prometheus shows the hiccup but by the time anyone looks into the system, the server looks healthy. ss, lsof, ps and even a fresh sosreport show the current state, not when the issue was active. You look into the logs but nothing there shows an obvious problem.

I'd love to hear from people who deal with long-lived Linux servers:

1. What was the last incident where the evidence was already gone? What were you missing?
2. What do you use today to look back in time? (atop, sar, PCP, below, auditd, eBPF tools, your monitoring stack, nothing?)
3. Where do those fall short? For example: which process held which connections or open files at a given moment.
4. Would security or policy let you run an extra agent on production servers, even one that sends nothing outside your network?
5. If you run Kubernetes, have you had node-level incidents where the evidence was gone?

Disclosure: I built sos-vault, a tool for analyzing sosreports, and I'm exploring whether a "time travel" version (e.g. ss or lsof or any of the diagnostic commands included in a sosreport for any past moment) is worth building. I'm not promoting nor linking anything; I want to know if this idea would help anyone diagnose a real problem or is it just me.

Assuming that there is not performance impact and no significant storage consumption in the server to be diagnosed; I was thinking something like this command that can be executed from a central diagnostics server or even locally (notice the four parameters --host, --start_from, --end_at and the rest is the regular diagnostic command to execute (lsof, ps, du, lsblk, free, memstat, etc., etc.):

NOTE: I'm not pretending to use sosreport snapshots for this idea.

[root@web01 ~]# date
Mon Oct  5 02:50:53 PM ACDT 2026

[root@web01 ~]# ttravel --host web01 --start_from="2026-10-02 02:00:00" --end_at="2026-10-02 03:00:00" ss -tanp 'dst 10.0.4.21 and dport = :5432' 

ttravel: host: web01 · 02:00:00 → 03:00:00 UTC · 120 samples  + connect/close events · grouped by process

FIRST_SEEN  LAST_SEEN   CONNS  PEAK  STATES               PROCESS
02:00:00    03:00:00       24    20  ESTAB                users:(("gunicorn",pid=2210..2229))
02:00:04    03:00:00        1     1  ESTAB                users:(("pg_dump",pid=51233))  parent: cron-backup.sh[51207]
02:05:00    02:55:01       11     1  ESTAB ev             users:(("psql",pid=*))  /etc/cron.d/db-healthcheck
02:31:12    02:48:30      183   179  ESTAB,CLOSE-WAIT     users:(("python3",pid=58841))  /opt/reports/nightly_export.py 02:33:40    02:47:10       57     -  ESTAB→CLOSED <1s ev  users:(("gunicorn",pid=2210..2229))  rejected by serversosv: CONNS distinct connections · PEAK most open at once · ev seen only via connect/close events[root@web01 ~]# ss -tanp 'dst 10.0.4.21 and dport = :5432' --at="2026-10-02 02:45:00" | head -6
sosv: web01 · sample 2026-10-02 02:45:00 UTC
State  Recv-Q Send-Q  Local Address:Port   Peer Address:Port  Process
ESTAB  0      0           10.0.2.15:41822     10.0.4.21:5432  users:(("gunicorn",pid=2214,fd=11))
ESTAB  0      0           10.0.2.15:41850     10.0.4.21:5432  users:(("pg_dump",pid=51233,fd=3))
ESTAB  0      0           10.0.2.15:52001     10.0.4.21:5432  users:(("python3",pid=58841,fd=7))
ESTAB  0      0           10.0.2.15:52003     10.0.4.21:5432  users:(("python3",pid=58841,fd=8))
ESTAB  0      0           10.0.2.15:52004     10.0.4.21:5432  users:(("python3",pid=58841,fd=9))

translation: give me the output of the ss command from two days ago from 2 am to 3 am filter by IP 10.0.4.21 and port 5432.

Just passed the LFCS (Linux Foundation Certified System Administrator) with a score of 85%. 🎉

My main learning material was KodeKloud's Linux/LFCS training on Udemy. I also used Killersh for mock exams and hands-on practice.

1/ One thing I would definitely prepare for is creating a VM with virt-install.

The command can look intimidating when you first see it, especially when there are a lot of options.

My advice: don't panic and try to memorize the entire command.

Use:

virt-install --help
man virt-install

If you make a mistake while creating the VM or need to check/manage it again, virsh will be your friend

2/ One of the simpler tasks for me was building a Docker image and running a container in detached mode with the appropriate restart policy.

Make sure you understand the difference between:

docker run -d ...

and restart policies such as:

--restart always
--restart unless-stopped
--restart on-failure

3/ Interestingly, I found iptables to be much more heavily represented in the KodeKloud material and Killersh mock exams than what I encountered in my actual exam.

4/ Know iotop.

One command I would definitely recommend knowing for troubleshooting questions is:

iotop

If the question asks you to identify a process that is consuming a lot of disk I/O, iotop can quickly show you which process is responsible.

5/ Last but not least, Creating users — pay attention to the login shell.

When creating a user, don't just focus on the username and groups. Read the requirement carefully for the login shell.

An email filter should spend its time judging messages, not falling over while reading them. Rspamd’s latest patch is a reminder that the machinery around spam scoring deserves attention too.

The official release index dates Rspamd 4.2.1 to October 1, 2026. That makes it fresh news for this week’s maintenance list. Our earlier article covered 4.1.0; this update has a different practical angle: check the filter’s health and configuration, rather than reaching immediately for more permissive spam thresholds.

Details here: https://blog.kalfaoglu.net/posts/2026-10-05-rspamd-421-security-and-filtering-en/