Based on the technical breakdown Intezer and Kodem Security published July 19, here's the architectural impact for anyone running Kiro or evaluating agentic IDEs.

Root cause: ~/.kiro/settings/mcp.json wasn't in Kiro's protected-paths list. The agent's fsWrite tool could modify it without a real approval gate, and the file auto-reloads on change, starting whatever MCP server it describes.

Attack: hidden color:#fff;font-size:1px text on a normal-looking doc page instructs Kiro to add an MCP server whose launch command is an inline Node.js exfil script. Developer only approved fetching the URL. Everything downstream — file write, server creation, code exec — happened silently.

Fixed in 0.11.130. No CVE issued. Worth noting this is the second time this exact file-write primitive has surfaced in Kiro since its 2025 launch — the first fix only covered Supervised mode, leaving default Autopilot exposed, which is what got hit this time.

Full writeup w/ attack-chain diagram and remediation list: [background link, footnote]

Anyone running agentic IDEs in Autopilot-equivalent modes in production — what's your actual control for file writes to tool/MCP config paths? Approval dialogs clearly aren't sufficient on their own.

https://www.techgines.com/post/aws-kiro-mcp-prompt-injection-vulnerability

If you are running local LLMs, your hard drive is likely bleeding gigabytes without you realizing it. Between default model weights, duplicate quantization formats, and forgotten vector embeddings, local AI setups are silent storage hogs.

Here is how you can systematically track down and clean up the clutter directly from your terminal:

• Locate hidden Hugging Face and Ollama model weights: By default, Hugging Face caches everything in ~/.cache/huggingface/hub and Ollama stores models under ~/.ollama/models. Run du -sh ~/.cache/huggingface/ to see how much space is currently locked up.
• Prune redundant quantization formats and unused embedding databases: Review your downloaded models and delete redundant variations (like keeping both Q4_K_M and Q8_0 when you only use one). Clear out stale Chroma, FAISS, or Pinecone local vector database caches residing in your project directories.
• Automate routine garbage collection: Set up a lightweight shell script to periodically check cache growth and alert you before your drive hits capacity.

Fore More Information

I put together the complete, production-ready automated cleanup script along with an interactive storage calculator to help map out your directories.

Direct links to the complete article.

drop a comment below

CVE-2026-42533 is a configuration-dependent heap buffer overflow in NGINX that can result in worker crashes and, under specific conditions, potential remote code execution. This is an indepth analysis

Most engineers know what a page table is.

Far fewer know what happens after the guest page table.

In this video, I follow a memory access all the way from:

Application → Guest Virtual Memory → EPT → Host Physical Memory → CPU Cache → DRAM

Along the way we uncover vNUMA, AutoNUMA, remote memory access, EPT translations, and why a VM can think memory is local while the hardware disagrees.

Then we compare it all with containers.

A journey from a single memory load instruction to the hardware itself.

#LinuxUnderPressure #Linux #PerformanceEngineering #NUMA #Virtualization #KVM #Containers

Based on the technical breakdown published by researcher Chinmohan Nayak and covered by The Hacker News on July 10, here's the architectural failure: OpenClaw's sandbox bind-mount check, getBlockedReasonForSourcePath(), only verifies if the requested mount path is a *child* of a blocked dir (~/.ssh, ~/.aws, ~/.gnupg). It never checks the reverse — mount /home or /var and every blocked child comes along. Combined with two command-injection bugs in the host exec filter's incomplete denylist, plus the fact that WhatsApp contact/vCard/location name fields get flattened into the LLM prompt with zero untrusted-content marking (unlike web content, which is wrapped) — you get full host compromise from a single message. No foothold required. GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm (both 8.8), GHSA-575v-8hfq-m3mc (8.4). Fixed in 2026.6.6. Background on OpenClaw's prior security posture (VirusTotal skill scanning, Feb 2026): [internal link, secondary] For anyone running agent gateways against messaging channels — how are you drawing the trust boundary between message *metadata* fields (contact names, vCard labels, location labels) and the actual message body? Most prompt-injection mitigations I've seen only wrap fetched web content, not structured message objects. Is anyone sanitizing/stripping angle brackets or non-printable chars from contact fields before they hit the model?

https://www.techgines.com/post/openclaw-whatsapp-vulnerability-host-code-execution-ghsa-flaws

I would like to share my Linux Syscall Monitor project with you. It's a Linux process monitoring tool written in C that uses ptrace to observe system calls and generate behavioral reports.

I welcome any feedback or criticism—whether it's about the code

This technical analysis examines HollowByte, a recently disclosed OpenSSL denial-of-service vulnerability, from a Linux administration perspective. It covers the affected releases, vulnerable code path, attack prerequisites, patch availability, distribution considerations, and practical mitigation strategies for systems relying on OpenSSL.

I am ex support engineer who mainly worked with Linux command line for more than 2 years(nearly 2 and a half).

Ideally devops is not a junior role but the role responsibilities differ from area to area. What I am trying to say is someone who works with linux servers, cicd, kubernetes etc. Not a devops literally.

My goals is to crack a job fast. I should see visible progress at least weekly.

How do I start?

I can commit 15 hours per week on the first month. And 30 hours per week for the second and third month.

Hello everyone I have recently installed Linux Ubuntu and it’s going great I have learned a little bit about kernel cd ls sudo apt

My goal for learning Linux is probably system administrator and software detection I’ve seen a lot of people making home labs have to get away from the corrupt corporations blocking ads and becoming a pirate (one piece reference)

But my passion is to make an anti cheat system using software detection I think everyone can agree they hate cheaters in video games

But I’m lost at the moment what should I be studying is there going to be a job out there if I do start getting into the heart of Linux should I be building a home lab Should I get a nas and store everything locally and I also saw someone take there old android and make it an audio player device only

Thank you anyone who reads and answers me

Windows is very tricky even with all resources around 0% usage, micro stutters and lag can still happen.

What is the general route to debugging a linux system for system admins or power users?

Thank you very much for your help!

This is a tool that I have been working for a long time on, and it is for testing DNS delegations. Released under a BSD-2 license. If you run the stack yourself, you can even spin up an MCP server for fancy AI interaction. Feedback more than welcome!
[https://gonemaster.evilbit.de/\](https://gonemaster.evilbit.de/)

Welcome to Day 19 of the 30-day RHCSA challenge!

Creating and extracting archives is an everyday sysadmin task and an RHCSA objective.

Today we'll build compressed archives with tar -zcvf, unpack them with tar -zxvf, and finally make sense of what all those flags actually mean.

By the end you'll be able to archive directories, compress them, list their contents, and extract them anywhere on the system.

What you'll learn in this video:

What tar is and why we archive files

Creating a compressed archive: tar -zcvf archive.tar.gz /path/to/dir

Breaking down the flags: c create, x extract, v verbose, f file, z gzip

Listing contents without extracting (tar -ztvf)

Extracting an archive with tar -zxvf

Extracting to a specific directory with -C

About this series:

Over the next 30 days I'm covering everything you need to pass the RHCSA (EX200) — from setup to users, permissions, storage, networking, SELinux, containers, and more. New video every day. Subscribe and turn on notifications so you don't miss one.

#linuxminutes #rhcsa #redhat #linux #redhatlinux #ex200 #linuxadministration #linuxcertification #offline #closedloop #sysadmin #linuxforbeginners #30daychallenge #learnlinux #itcertifications #opensource #homelab #linuxtutorials #technology #techcareers #certificationprep #closedloop #airgap #shorts #shortvideo

Based on Rapid7's technical breakdown published July 15 and SonicWall's PSIRT advisory (SNWLID-2026-0008), here's the architectural impact of the SMA1000 zero-day chain: unauthenticated SSRF via /wsproxy → hardcoded Erlang RPC cookie → RCE as low-priv service account → path-traversal in remove_hotfix → root. No CVSS-10 hand-waving here, Rapid7 published working PoC.

What's the actual failure mode in your view — should vendor management-plane services on internet-facing gateways ever bind to localhost without a second auth layer, or is that an inherently broken trust model for perimeter appliances?

https://www.techgines.com/post/sonicwall-sma1000-zero-day-ssrf-rce-cve-2026-15409-cve-2026-15410

Welcome to Day 18 of the 30 day RHCSA challenge!

RHEL ships with tuned, a service that applies performance profiles tailored to your workload whether that's a virtual machine, a database server, or a laptop trying to save power.

Today we'll explore the available profiles and switch between them with tuned-adm.

By the end you'll know how to check your active profile, apply a new one, and let RHEL pick the best one automatically.

About this series:

Over the next 30 days I'm covering everything you need to pass the RHCSA (EX200) — from setup to users, permissions, storage, networking, SELinux, containers, and more. New video every day. Subscribe and turn on notifications so you don't miss one.

#linuxminutes #rhcsa #redhat #linux #redhatlinux #ex200 #linuxadministration #linuxcertification #offline #closedloop #sysadmin #linuxforbeginners #30daychallenge #learnlinux #itcertifications #opensource #homelab #linuxtutorials #technology #techcareers #certificationprep #closedloop #airgap #shorts #shortvideo

I’m curious how people handle the jump from “this model runs locally/in a notebook” to “this is an endpoint someone can actually hit.”

Running the model once is usually not the hard part, but things get annoying about:

- packaging CUDA/Python dependencies

- building or reusing an image

- exposing a stable API endpoint

- handling cold starts

- checking logs when startup fails

- updating the model without breaking the deploy

- deciding when serverless inference is enough vs when you need more control over the GPU instance

I’ve been comparing Modal, Replicate, RunPod Serverless, Northflank, AWS, and Glowsai from that angle. Modal/Replicate/RunPod Serverless seem better if you want a more serverless-style path. AWS is fine if your team already owns infra. Glowsai sits somewhere in between. It feels more like a managed platform, where most of the setup is handled.

The main thing I’d test is not just “can it run,” but deployment speed, endpoint reliability, autoscaling behavior, logs/debugging, cold starts, update flow, and total cost.

How are people choosing between these options once the prototype works?

Salutare tuturor!

În ultimele luni am lucrat la OrkestraVM, platforma de virtualizare dezvoltată intern de echipa MioriticHost pentru administrarea infrastructurii noastre VPS.

În loc să folosim un panou VPS generic, am construit o soluție adaptată modului în care operăm serverele și cerințelor clienților noștri.

OrkestraVM folosește virtualizare KVM, fiecare VPS având propriul kernel și resurse izolate.

Printre funcționalitățile actuale se numără:

• provisionarea automată a VPS-urilor Linux și Windows;
• alocarea automată a adreselor IP și a adreselor MAC;
• monitorizarea în timp real a resurselor CPU, RAM și stocare;
• consolă SSH accesibilă direct din browser;
• administrarea mai multor servere fizice dintr-o singură interfață;
• integrare completă cu WHMCS pentru activarea, suspendarea și închiderea automată a serviciilor;
• backupuri realizate la nivelul hypervisorului, criptate individual pentru fiecare VPS;
• pregătirea sistemului de fișiere înaintea snapshotului, pentru backupuri consistente inclusiv în cazul serverelor care rulează baze de date.

Platforma este scrisă în Go și comunică cu nodurile de virtualizare prin SSH, fără să necesite instalarea unui stack complex de management pe fiecare server.

OrkestraVM nu este, cel puțin momentan, un produs comercial separat. Este motorul intern pe care îl folosim pentru a administra și proteja VPS-urile oferite de MioriticHost.

Am ales să o construim pentru a avea mai mult control asupra infrastructurii, mai puține componente externe și posibilitatea de a implementa funcționalități în funcție de nevoile reale ale clienților noștri.

Mai multe detalii despre arhitectură, securitate și direcția de dezvoltare:

https://orkestravm.com

Suntem curioși ce funcționalități considerați esențiale într-un panou modern de administrare VPS. Feedbackul tehnic este binevenit.

I'm setting up a Almalinux router and followed this guide for setting up firewalld. It mostly does what I need it to: deny all incoming traffic, allow incoming traffic.

However the port forwarding simply does not work and I have no idea why. I have a virtual machine I want to forward ports 80 and 443 which looks like this:

# firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=80:proto=tcp:toport=80:toaddr=10.42.0.2
# firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=443:proto=tcp:toport=443:toaddr=10.42.0.2
# firewall-cmd --reload

However I still can't access my dockers located at 10.42.0.2. I don't understand what I'm missing here. I think that traffic is only going WAN --> Router but never making it past the routter to my VM (at least based off this diagram of firewalld's gateway policy set).

I wana start learning Ansible. I’ve read through some of the documentation and searched around.

I am wondering what resource you guys found most useful as an intro to Ansible? What learning material/resource made it click for you?

I have a homelab setup with Proxmox as the host, what is an easy way to approach hands on? IE: whats a good thing to use Ansible to automate as a learning experience? Something I can spin up/down over and over to learn using it.

Thanks

I have some(3 years) IT support experience. But it was linux command line kung fu only.

I want to teach devops in youtube(mainly because I like it and want to learn it further.)

My first channel goal is to earn money with AdSense.

And my second channel goal is to create a portfolio to show my potential recruiters about my skillset.

I have not created any channels yet in this field. So do not ask me for the link.

How do I learn it first so that I can teach?

Also AI can make proper steps and commands so I feel teaching "how to install xyz in xyz server" is kind of useless these days. Such videos used to be highly useful back in the day when AI was not present.