Critical Supermicro BMC flaws (CVE-2025-7937/6198) enable malicious, irreversible firmware to be installed, compromising servers at the root-of-trust level.

Introduction

The FlipSwitch rootkit uses bytecode modification to intercept syscalls in Linux kernel 6.9, bypassing the new switch-based dispatcher that rendered traditional sys_call_table hooking useless.

When digital trust becomes the most dangerous vulnerability of the twenty-first century

Trend Micro exposed ZeroDisco, a sophisticated op exploiting Cisco SNMP RCE (CVE-2025-20352) to install Linux rootkits on switches, setting a volatile universal "disco" password and erasing logs.

Linux Privilege

ELFSPIRIT is a versatile framework for static analysis and injection, allowing users to manipulate, patch, and camouflage every byte within ELF files for research.

The UNC2891 campaign against Indonesian banks used a Raspberry Pi and the CAKETAP rootkit to bypass ATM verification protocols, orchestrating cash-outs via a mule network.

Singularity is an advanced Linux Kernel 6.x rootkit that uses ftrace hooking to provide comprehensive stealth, including process/file hiding and eBPF/EDR detection evasion.

A new commodity has surfaced on underground forums for those seeking to operate more quietly—and for longer. An