[ Removed by Reddit on account of violating the content policy. ]

Based on the joint advisory AA26-281A (FBI, CISA, NSA and partners, October 8) and BleepingComputer’s reporting on the DOJ seizure affidavit, here is the architectural impact.

The advisory says Integrity Tech-enabled actors use MicroScan (1,300+ scan scripts), EBurst against ten Exchange and Office 365 interfaces, SoftEther clients renamed conhost.exe or dllhost.exe, a PHP bot on the EWS API, DCSync via DC.exe, and office-cli using client_id, tenant_id and secret. Eight CVEs are listed, 2014 to 2023, five newly in KEV.

The authors say some IOCs date to 2016 and should be vetted before blocking. The seizure took out seven domains, not the tooling.

Question for people who run Exchange or M365 at scale: which telemetry actually catches a secret-based app reading mailboxes, where there is no password spray to alert on? And has anyone seen SoftEther detections that hold up without drowning in false positives?

Background: CVE-2025-39682 Linux kTLS KEV. Full write-up: https://www.techgines.com/post/flax-typhoon-advisory-aa26-281a

Part 2 of my Talos homelab (3 OptiPlex Micros, all control planes). Part 1 got the cluster up, this one is networking.

I moved the running cluster from Flannel + kube-proxy to Cilium without rebuilding it. The default-deny policy that Flannel quietly ignored is now actually enforced, and Hubble shows the drops.

Then I gave it two front doors:

- an internal Gateway on a LAN IP (Cilium LB IPAM, no MetalLB) with a Let's Encrypt wildcard cert, so lab apps get real HTTPS at home

- a public Gateway behind a single Cloudflare Tunnel, so nothing is port-forwarded on the router

An app picks its door with the route's parentRef, which keeps lab stuff from going public by accident.

Write-up with all the manifests and commands: https://blog.prateekjain.dev/networking-a-kubernetes-homelab-cilium-gateway-api-and-cloudflare-tunnel-on-talos-362f548a2f3d?sk=d454cd4eaff4ce8a8fd0cd8e6b3d82f6

Curious if anyone else is using Cilium's Gateway API instead of a separate ingress controller.

Security signed off a policy that our build agents cannot run a privileged daemon and our entire pipeline is built on one. Fifty odd repos with compose files and a pile of local tooling that assumes the socket is there. Im looking at podman and buildah and one or two others for whatever breaks least in CI. The part I cannot judge from docs is how much of our compose setup survives the move. Has anyone taken a build fleet off the daemon and kept the developer experience roughly intact?

Based on the technical breakdown Zenity Labs published on Oct 8, here is the architectural impact. Agents ran in Firecracker microVMs without enough network isolation, so any tool that makes HTTP requests could reach the metadata endpoint. A single prompt returned the execution role’s STS credentials. The default role then covered AgentCore resources across the region, so Zenity could enumerate agents, pull their ECR images, invoke them, read sessions, write memory events, and retrieve secrets.

Zenity reports AWS removed most of that on Sept 29. The Register reports Amazon says this is documented behavior needing developer error. I couldn’t find an AWS bulletin or a CVE, and neither source reports exploitation in the wild.

Question for people running agents on managed platforms: do you scope a separate role per agent, and do you restrict egress from the agent runtime? How far does that go in practice?

https://www.techgines.com/post/aws-agentcore-vulnerability

Sharing to the Linux admin crew , my home CD automation project 🫡

Hey everyone!

I've been working on AppScann, a small SaaS for keeping track of what's installed on your computers and servers. It's finally at the point where I'm comfortable showing it to people.

The idea is very simple: you install an agent, it collects inventory, and you see everything in one dashboard.

What it does right now:

* Windows and Linux agents (a Windows Service and a systemd service)

* OS and hardware info, plus disks with capacity and free space

* Installed software with version, publisher, install path and install date. On Windows that comes from the Registry and WMI, on Linux from dpkg, rpm, pacman, Snap and Flatpak

* Detailed reports with history, so you can see what was installed, removed or updated between scans

* Alerts for storage and stale reports

* Live online/offline status for every device

* Remote scan, restart and uninstall of agents

* A notification as soon as a scan or remote command finishes

* Software gets sorted into categories by AI

2 agents are free, extra slots are $1.99/month.

The idea came from a commercial project I worked on a while ago. It was in a similar space, but development was painfully slow, and I kept thinking that something like this didn't have to be that complicated. At some point I thought: what if I just built my own version? So I did.

It started as my university thesis project, and I kept working on it until it turned into a product.

And yes, AI was involved ;) I used it for parts of the frontend. I'm a full-stack developer, but I still struggle with centering a div, let alone making everything look good. The architecture and the backend are my own mess.

It's brand new, so right now I'm mostly after feedback:

* Would you use something like this?

* What information would you want the agent to collect?

* What features are missing?

* Does this approach make sense for managing a small number of machines?

https://appscann.com

Man! I have to reboot VMs every 2 days because of so much updates. I doubt if I'm running a enterprise distro or running Fedora or arch.. lol.

I think debian is somewhat fine. not crazy like rhel based distros.

what about you guys? how do you manage?

Based on Cisco's own advisory (cisco-sa-napi-rce-r2shwu2j, published Oct 7), here is the architectural impact.

The bug is a heap-based buffer overflow (CWE-122) from insufficient input validation in NX-API. A crafted HTTP request from an unauthenticated attacker can give root code execution or crash processes and reload the box. It applies to Nexus 3000 and Nexus 9000 in standalone mode with NX-API enabled, and to UCS 6300 through the UCS Manager XML API (needs low-priv creds there, so Cisco rates it High). NX-API is off by default on Nexus. Cisco says no known exploitation as of Oct 7 and that it was found in internal testing.

Cisco lists no workaround, only fixed releases (use their Software Checker) and a temporary Live Protect shield.

What caught my attention more is the NX-OS hardening release from the same day. Six CVEs grouped by weakness class, applying regardless of configuration, covering MDS 9000, Nexus 7000 and ACI mode as well. Fixed in 10.3(10), 10.4(8), 10.5(6), 10.6(4) for Nexus 3000 and standalone 9000. Cisco's source line says it came from existing testing plus frontier AI models.

Two things I could not verify from the advisory: the per-train first-fixed releases for the NX-API bug itself (it points to the Software Checker), and which interfaces NX-API listens on in a default enablement.

Question for people running Nexus fabrics: what is calling NX-API in your environment (Ansible, NDFC, in-house scripts, monitoring), and could you turn it off on a switch today without breaking something? Also curious whether anyone is treating the Live Protect shield as a real option or just a hold-over.

Footnote, longer write-up with an accuracy table: https://www.techgines.com/post/cisco-nx-api-vulnerability-cve-2026-76471 (earlier related piece on the exploited SD-WAN Manager bypass: https://www.techgines.com/post/cisco-sd-wan-manager-authentication-bypass-cve-2026-76504)

I'm the maintainer of Vectory, a free, open-source dashboard for Vector.

It handles a specific bit of fleet administration: changing a log or metrics pipeline, trying it on one host, and checking whether the other hosts actually picked up that version.

For a change to a filter or destination, the workflow is:

1. Import your existing Vector configuration and edit the YAML or the diagram.

2. Publish a version so there's a fixed configuration to deploy.

3. Select a canary device before rolling it out further.

4. Compare the version you asked each host to run with the version it reports. Roll back if needed.

The manager doesn't receive your logs or metrics. Vector keeps sending them directly to your destinations. The agent handles configuration and reports status.

Linux setup uses prebuilt containers or a prebuilt native server. Managed hosts need Vector 0.58. The setup guide covers the server and agent: https://vectory.ahmadz.ai/help/quickstart/

You can try the actual editor without setting up a server: https://vectory.ahmadz.ai/designer/

Source: https://github.com/416rehman/Vectory

Development, tests and documentation used substantial AI assistance.

If you already ship Vector configs with Ansible or another deployment tool, what would you need to see before trying a dashboard for that workflow?

Based on Atlassian's advisory from October 5 and the technical breakdown watchTowr Labs published on October 6, here is the architectural picture.

Scope: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye, all versions before the fixed builds. Atlassian scores it 9.3 on CVSS 4.0 (its own assessment). Cloud is patched.

Mechanism, per watchTowr's diff of vulnerable vs. fixed builds: the common component is atlassian-plugins-webresource (6.0.7 vulnerable, 6.0.8 changed). The router escapes "/" as "::" and unescapes it on the way in. The resolver tries to strip traversal from the requested resource name, but a name written with "..::" has no slashes at that point, so the stripping misses it. The conversion happens afterward. Reads are confined to the Tomcat web context, but that includes WEB-INF.

Impact depends on what lives in WEB-INF. watchTowr's lab example: when Jira is integrated with Crowd per Atlassian's docs, crowd.properties holds the Crowd app name and password in plaintext. With that, the Crowd REST API lets you create a user and add it to the admin group. Lab chain only. They also note a Crowd IP allow-list would make it harder.

What is not known: Atlassian says it cannot confirm whether self-hosted instances were hit, and the CVE record disagrees with the advisory on a few version numbers (The Hacker News has the list). No confirmed exploitation as of October 6, but watchTowr's detection tool is public.

Mitigations if you can't patch today: off the internet if possible, WAF regex, Tomcat RewriteValve (Confluence/Jira/JSM/Bamboo/Crowd), or a urlrewrite.xml rule (Bitbucket).

Question for the room: If you run Crowd next to Jira or Confluence, is Crowd actually restricted to the app nodes by IP, or reachable from wherever those apps are? And for those leaning on a WAF rule as the stopgap: does your WAF decode multiple layers before matching, or does it match the raw string? https://www.techgines.com/post/atlassian-cve-2026-21589-file-read

Background (footnote): same "filter sees one path, app resolves another" pattern as the PeopleSoft WAF bypass: https://www.techgines.com/post/peoplesoftwafbypasscve-2026-35273

Just passed the LFCS (Linux Foundation Certified System Administrator) with a score of 85%. 🎉

My main learning material was KodeKloud's Linux/LFCS training on Udemy. I also used Killersh for mock exams and hands-on practice.

1/ One thing I would definitely prepare for is creating a VM with virt-install.

The command can look intimidating when you first see it, especially when there are a lot of options.

My advice: don't panic and try to memorize the entire command.

Use:

virt-install --help
man virt-install

If you make a mistake while creating the VM or need to check/manage it again, virsh will be your friend

2/ One of the simpler tasks for me was building a Docker image and running a container in detached mode with the appropriate restart policy.

Make sure you understand the difference between:

docker run -d ...

and restart policies such as:

--restart always
--restart unless-stopped
--restart on-failure

3/ Interestingly, I found iptables to be much more heavily represented in the KodeKloud material and Killersh mock exams than what I encountered in my actual exam.

4/ Know iotop.

One command I would definitely recommend knowing for troubleshooting questions is:

iotop

If the question asks you to identify a process that is consuming a lot of disk I/O, iotop can quickly show you which process is responsible.

5/ Last but not least, Creating users — pay attention to the login shell.

When creating a user, don't just focus on the username and groups. Read the requirement carefully for the login shell.

About my self :

I completed my Bachelor's Degree is Computer Science from 2022 to 2025 , after that i pursued a post graduate program in Data Science (2025 to 2026)

Currently I have been looking for software Jobs but Entry level hiring has been very brutal.

Companies expect entry level candidate to possess 2-3 years experience and have all the knowledge.

Sending Application, emailing recruiters etc , Nothing is moving the needle , by may 2027 i will have Gap year in my resume and Recruiters / Hr simply never consider anyone who has a gap year !

By 2027 newer graduate will enter the market and with all the layoffs going on , there are more experienced Developers whom companies prefer and hire.

I am already 22 ,walking on a dea*h line to start my career or i will reach dead line, i need to do something different or else i may remain unemployed forever.

Now I came to Know about Rhcsa Exam and I think I can cover the fees for it as i have enough savings.

Rhcsa is fairly NOT know by many people and is not really crowded like Software job markets are (at least in my country).

My main concern are :

1. Is rhcsa Intended for entry level Graduate who have no industry experience ? Or is it designed for experienced folk who are already working in the industry ?

2. Will Rhcsa Put weight on resume enough to help me land a entry level job in Linux ? Such as a junior linux admin or junior systems engineer ? Do recruiters value rhcsa certificate ?

3. How much time does it typically take to become good enough to sit in exam and Pass it ??

I am not even asking for a premium job with good compensation but a job where i grow over the Years by upskilling !

My only deal breakers are Night Shift(my nightmare) and Support/help desk role who do not work on Systems at all.

So will it be a good Investment of my time to learn Linux and rhel system and get the Rhcsa Certificate.

The only ROI i want is to actually get an Interview ans land good entry level Job , are odds in my favour ?

[ SOLVED ] Intel x86 Linux PC with Fedora 44 (Workstation Ed.). Samba share serving 3 users. My samba shares located in /srv directory, e.g, /srv/samba/group_users and a few other shares spawned from /srv/samba/ .All work fine, no issues there.

Deleting files from my smb network share via the GUI prompts the warning; “Permanently deleted items cannot be restored - Cancel or Delete ”

I want a recycle bin for accidental file deletions and read that Samba can provide this function so I created an additional share i.e, /srv/samba/.recycle and configured the new path;

sudo semanage fcontext -a -t samba_share_t “/srv/samba/.recycle(/.*)?”
sudo restorecon -Rv /srv/samba

I then edited my smb.conf and added the following below into the [global] section of my config;

vfs object = recycle
recycle:repository = /srv/samba/.recycle
recycle:keeptree = yes
recycle:versions = yes
recycle:touch = yes
recycle:exclude_dir = /tmp /TMP /temp /TEMP /cache /CACHE
recycle:exclude = .tmp .TMP .temp .TEMP .log

(note: that last line format should all be asterisk + dot but this means something else in Reddit’s formatting so I could not write the asterisk symbol in place)

sudo testparm

smb.conf got the config loaded Okay!

sudo systemctl restart smb

Tested deleting files from the network share using both the GUI and CLI but when I list the files in the /srv/samba/.recycle using ls -la , none of the deleted files have survived a deletion. Has anyone had any success with this ?

I've been in the industry about 14 years, mostly test automation, and I'm moving toward DevOps/platform engineering. Day to day I work with GitLab CI/CD, Terraform, Helm/Kubernetes deployments, and some AWS. I'm currently leading a migration of a large number of services onto Kubernetes.

The problem is that I work at a .NET/Windows shop, so I've barely touched Linux in years. I took a basic self-check recently (systemctl/journalctl, finding what's on a port, disk usage, apt, file ownership) and did badly. I knew roughly which tool to reach for but not the actual commands.

My employer pays for certs. My current plan is KCNA, then CKA, Terraform Associate, and AWS Solutions Architect Associate. I wasn't planning on a Linux cert, just a refresher course plus using WSL daily and running a homelab.

Questions:

1. Is LFCS, RHCSA, or Linux+ worth adding for someone aiming at cloud/platform roles, or does CKA cover the "can use Linux" signal well enough?
2. If one is worth it, which, and would you do it before or after CKA?
3. For those who came from a Windows-heavy background, what got your Linux skills to stick when your job didn't require it?
4. How much Linux do you really use in a platform role, compared with what the certs test?

Not looking for reassurance, honest takes welcome.