I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
DevSecOps
Most sysadmins reach for AppArmor or SELinux when they want to confine a service. Both work, both have learning curves, and both expect either pre-shipped policies or substantial custom-rule writing. Meanwhile, systemd has shipped — for years — a sandboxing toolkit that gets you most of the protection with maybe
Threat Intel
Published: May 8, 2026 Affected Products: cPanel & WHM, WP Squared (WP2) Patch Status: Available — apply immediately Context: Second emergency Technical Security Release (TSR) within 10 days Executive Summary WebPros (cPanel) released a coordinated patch on May 8, 2026 at 12:00 EST addressing three distinct vulnerabilities affecting cPanel &
Threat Intel
Published: May 8, 2026 Risk Level: CRITICAL (affects 9+ years of kernel versions) Status: Unpatched on most distributions; mitigations available Executive Summary A newly disclosed Linux kernel local privilege escalation vulnerability chain, dubbed "Dirty Frag" and assigned CVE-2026-43284 and CVE-2026-43500, enables attackers with local
Threat Intel
A new security vulnerability has been identified in cPanel & WHM through a trusted disclosure source. The cPanel engineering team is actively developing patches and has issued an early advisory so administrators can prepare servers ahead of patch availability. To protect customers prior to patch release, full technical details will
Linux
Use zstd for everything new. It's faster on both ends, compresses better at equivalent CPU cost, and is multi-threaded by default. Stick with gzip/tar.gz only when you need maximum portability to ancient/minimal systems (older than ~2018). Quick Reference Table Dimension gzip (tar.gz) zstd
DevSecOps
Digital Certificates and the Chain of Trust When a browser opens an HTTPS connection, the server hands over a public key. Before a single byte of encrypted application data flows, the client has to answer one question: is this public key actually trustworthy? The mechanism that answers it — X.509
Cloud Security
Virtual machines offer a layer of isolation, but they are not a security boundary you can fully trust. Understanding where that isolation breaks down — and how to tighten it — is essential for anyone running sensitive workloads inside a hypervisor. Weaknesses Host-to-Guest and Guest-to-Host Compromise The trust
Threat Intel
Critical — Local Privilege Escalation + Container Escape Kernel cryptographic subsystem (AF_ALG / algif_aead). Any local user → root. Any container → host node escape. Overview Field Detail CVE CVE-2026-31431 Nickname Copy Fail Disclosed 2026-04-29 Component Linux kernel — AF_ALG interface (algif_aead module) Impact LPE (user → root), container
System Design
wp_options Health Check -- Row count (healthy: 500–2000, bad: 50k+) SELECT COUNT(*) FROM wp_options; -- Autoload payload size (>1MB = problem, >3MB = serious, >10MB = broken) SELECT SUM(LENGTH(option_value)) / 1024 / 1024 AS autoload_mb FROM wp_options WHERE autoload = 'yes'; -- Biggest rows overall SELECT
Threat Intel
Table of Contents * Overview * Critical Issue: CVE-2026-23918 (CVSS 8.8) * Privilege Escalation: CVE-2026-24072 * Additional Fixes in 2.4.67 * Immediate Mitigation Steps * FAQs Overview The Apache Software Foundation has disclosed multiple security vulnerabilities affecting the Apache HTTP Server, including a high-impact remote code execution issue.
DevSecOps
OS: CloudLinux 9 Panel: cPanel/WHM Method: TOTP via pam_google_authenticator Supports: Key + TOTP and Password + TOTP simultaneously Table of Contents * Prerequisites * Installation * PAM Configuration * SSH Daemon Configuration * User Enrollment * Sharing a Secret (Shared Root Setup) * Authentication Flow Reference * Offboarding a Team Member * Troubleshooting * Reverting Everything Prerequisites * Root access
Linux
Table of Contents 💡This post assumes you've Proxmox VE 7.4.x, non-enterprise without ceph * Pre-flight Checks * Phase 1 - Backup the VM to /backup * Phase 2 - Session Safety * Phase 3 - Upgrade 7.4 to 8.x * Phase 4 - Reboot and Verify on 8.x * Phase 5