Daily Writeups

🔖New Writeup❗️
———————————————
🗓Date: Sun, 23 Jul 2023 17:30:43 GMT
———————————————
✏️Title: Securing PyTorch Models with eBPF
———————————————
📎Link: https://medium.com/p/7f75732b842d
———————————————
Tags: #cybersecurity #python #sandbox #ebpf #pytorch

Medium

Securing PyTorch Models with eBPF

This article was not generated by GPT

5 views19:02

Daily Writeups

🔖New Writeup❗️
———————————————
🗓Date: Sun, 03 Sep 2023 10:19:47 GMT
———————————————
✏️Title: Secure FastAPI with eBPF
———————————————
📎Link: https://medium.com/p/724d4aef8d9e
———————————————
Tags: #api #python #api_security #ebpf #fastapi

Medium

Secure FastAPI with eBPF

Leverage eBPF to secure internet-facing APIs: FastAPI, BlackSheep, Flask, Django, aiohttp, tornado, and more.

32 views14:02

Daily Writeups

🔖New Writeup❗️
———————————————
🗓Date: Tue, 05 Sep 2023 11:10:23 GMT
———————————————
✏️Title: Hack eBPF, Own Linux
———————————————
📎Link: https://medium.com/p/f93a6ff5753d
———————————————
Tags: #hacking #linux #ebpf #fuzzing #cybersecurity

Medium

Hack eBPF, Own Linux

This feature for Linux kernels, eBPF (Extended Berkeley Packet Filter) is “technology that makes programming the kernel flexible, safe, and…

10 views14:02

Daily Writeups

🔖New Writeup❗️
———————————————
🗓Date: Thu, 07 Sep 2023 00:48:05 GMT
———————————————
✏️Title: Tracing SSH User Activities Using eBPF
———————————————
📎Link: https://medium.com/p/c83f8f5a4a8e
———————————————
Tags: #cybersecurity #ssh #programming #linux #ebpf

Medium

Tracing SSH User Activities Using eBPF

With the increase in remote working and distributed working environments, tracing user activities has become more complicated. eBPF offers…

13 views02:02

Daily Writeups

🔖New Writeup❗️
———————————————
🗓Date: Thu, 21 Sep 2023 01:18:25 GMT
———————————————
✏️Title: Detecting SSH Tunnel Using eBPF
———————————————
📎Link: https://medium.com/p/29e73b21133e
———————————————
Tags: #cybersecurity #ebpf #ssh_tunnel #software_development #offensive_security

Medium

Detecting SSH Tunnel Using eBPF

Malicious actors have certain objectives when using SSH tunnels.

11 views02:01

Daily Writeups

⤷ Title: CVE-2024-56614 & CVE-2024-56615: PoC Exploits Released for Severe eBPF Vulnerabilities in Linux Kernel
════════════════════════
𐀪 Author: do son
════════════════════════
ⴵ Time: Thu, 30 Jan 2025 03:06:41 +0000
════════════════════════
⌗ Tags: #Linux #Vulnerability #CVE_2024_56614 #CVE_2024_56615 #eBPF

Daily CyberSecurity

CVE-2024-56614 & CVE-2024-56615: PoC Exploits Released for Severe eBPF Vulnerabilities in Linux Kernel

Uncover the latest Linux kernel vulnerabilities affecting eBPF framework with AF_XDP sockets. Learn about CVE-2024-56614 and CVE-2024-56615 and their potential security risks.

12 views04:04

Daily Writeups

⤷ Title: kntrl: Real-time eBPF Runtime Security for Your CI/CD Pipelines
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 02 Jun 2025 00:42:11 +0000
════════════════════════
⌗ Tags: #Network Defense #CI/CD #eBPF #GitHub Actions #kernel monitoring #kntrl #OPA #Open Policy Agent #open source #pipeline security #runtime security

Penetration Testing Tools

kntrl: Real-time eBPF Runtime Security for Your CI/CD Pipelines

kntrl is an eBPF-powered runtime agent for real-time detection & prevention of anomalous behavior in CI/CD pipelines, supporting OPA policies & GitHub Actions.

25 views02:03

Daily Writeups

⤷ Title: Monitoring Bash’s readline with eBPF CO-RE & LLM Assistance
════════════════════════
𐀪 Author: Alex Elbaum
════════════════════════
ⴵ Time: Tue, 03 Jun 2025 13:48:05 GMT
════════════════════════
⌗ Tags: #detection_engineering #ebpf #llm_applications #cybersecurity

Medium

Monitoring Bash readline with eBPF CO-RE & LLM Assistance

A year ago, I wrote a simple program with eBPF BCC to monitor bash commands. It was a great learning experience, but the main disadvantage…

28 views14:04

Daily Writeups

⤷ Title: Linux Kernel Rootkit Detection and Prevention Techniques
════════════════════════
𐀪 Author: Esra Kayhan
════════════════════════
ⴵ Time: Wed, 02 Jul 2025 14:06:01 GMT
════════════════════════
⌗ Tags: #ebpf #cybersecurity #rootkit_detection #kernel_development #linux_security

Medium

Linux Kernel Rootkit Detection and Prevention Techniques 🐧🔍

In the world of cybersecurity, rootkits remain one of the most stealthy and dangerous tools in an attacker’s arsenal. A kernel-mode rootkit…

27 views15:04

Daily Writeups

⤷ Title: Qtap: See Through Encrypted Linux Traffic with eBPF for Unparalleled Observability and Security Auditing
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 23 Jul 2025 00:32:55 +0000
════════════════════════
⌗ Tags: #Open Source Tool #API Development #cybersecurity #Debugging #eBPF #Linux Kernel #Network Observability #Qtap #Security Auditing #TLS/SSL #Traffic Interception

Penetration Testing Tools

Qtap: See Through Encrypted Linux Traffic with eBPF for Unparalleled Observability and Security Auditing

Qtap is an eBPF agent that captures pre-encrypted Linux kernel traffic, offering full visibility into TLS/SSL data with minimal overhead for security auditing, debugging, and API development.

21 views01:04

Daily Writeups

⤷ Title: Stealth Innovation: LinkPro Linux Rootkit Hides via eBPF and Activates with Magic TCP Packet on Kubernetes Nodes
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 20 Oct 2025 02:28:28 +0000
════════════════════════
⌗ Tags: #Malware #eBPF #Kubernetes #LinkPro #Linux Rootkit #Magic Packet #Stealth C2 #TCP #VShell #XDP

Penetration Testing Tools

Stealth Innovation: LinkPro Linux Rootkit Hides via eBPF and Activates with Magic TCP Packet on Kubernetes Nodes

Synacktiv exposed LinkPro, an advanced Linux rootkit using eBPF to cloak activity on Kubernetes nodes. It is activated by a "magic" TCP packet (window size 54321) to establish covert remote control.

17 views04:04

Daily Writeups

⤷ Title: Singularity: Advanced Linux Kernel Rootkit Uses ftrace to Bypass EDR and eBPF
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 08 Dec 2025 04:39:40 +0000
════════════════════════
⌗ Tags: #Open Source Tool #eBPF #EDR Bypass #ftrace #Linux Kernel #Offensive Security #privilege escalation #Process Hiding #rootkit #Singularity #Stealth

Penetration Testing Tools

Singularity: Advanced Linux Kernel Rootkit Uses ftrace to Bypass EDR and eBPF

Singularity is an advanced Linux Kernel 6.x rootkit that uses ftrace hooking to provide comprehensive stealth, including process/file hiding and eBPF/EDR detection evasion.

38 views06:03

Daily Writeups

⤷ Title: VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 14 Jan 2026 00:21:17 +0000
════════════════════════
⌗ Tags: #Malware #Check Point Research #Chinese Threat Actor #Cloud Security #Cobalt Strike #container security #DevOps Security #eBPF #Kubernetes Security #Linux Malware #supply chain attack #VoidLink #Zig Programming Language

Daily CyberSecurity

VoidLink: The "Cloud-First" Malware Hunting Your Linux Servers

New "cloud-first" malware VoidLink targets Linux & containers with advanced stealth. Written in Zig, it mimics Cobalt Strike to evade EDR. Check your cloud.

25 views02:06

Daily Writeups

⤷ Title: “JackMa” & ShadowGuard: TGR-STA-1030 Spies on 37 Nations via Linux Rootkit
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 09 Feb 2026 00:32:38 +0000
════════════════════════
⌗ Tags: #Cyber Security #Malware #Advanced Persistent Threat #cyber_espionage #Diaoyu Loader #eBPF #geopolitics #JackMa #Linux Rootkit #ShadowGuard #TGR_STA_1030 #UNC6619 #Unit 42

Daily CyberSecurity

"JackMa" & ShadowGuard: TGR-STA-1030 Spies on 37 Nations via Linux Rootkit

TGR-STA-1030 (UNC6619) hits 70+ orgs in 37 countries. The Asia-based group uses the new ShadowGuard eBPF rootkit to hide in Linux kernels.

15 views02:04

Daily Writeups

⤷ Title: Locked in eBPF: Meet Jailer, the Next-Gen Process Jailing System for Linux Security
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 24 Apr 2026 08:06:41 +0000
════════════════════════
⌗ Tags: #Open Source Tool #BPF task_storage #Cybersecurity 2026 #eBPF #Jailer #Linux Kernel #Linux Security #mac #Mandatory Access Control #Process Isolation #System Administration

Penetration Testing Tools

Locked in eBPF: Meet Jailer, the Next-Gen Process Jailing System for Linux Security

Jailer is an eBPF-powered Mandatory Access Control (MAC) system for Linux. It enforces ultra-granular policies on files, networks, and execution via BPF maps.

21 views11:04

Daily Writeups

⤷ Title: Quasar Linux (QLNX) Emerges to Subvert the Global Software Supply Chain
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 07:50:51 +0000
════════════════════════
⌗ Tags: #Malware #AWS #Credential Harvester #DevSecOps #eBPF #GitHub Security #Kubernetes #Linux malware #malware analysis #QLNX #Quasar Linux #rootkit #supply chain attack #Trend Micro

Penetration Testing Tools

Quasar Linux (QLNX) Emerges to Subvert the Global Software Supply Chain

The novel Linux implant, Quasar Linux, poses a formidable threat not merely to individual workstations but to the

10 views09:04

Daily Writeups

⤷ Title: New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 08:11:06 +0000
════════════════════════
⌗ Tags: #Malware #AWS Credentials #DevOps Security #eBPF Rootkit #Fileless Malware #infosec #Linux RAT #npm Security #PyPI #QLNX #Quasar Linux #supply chain attack #Trend Micro

Daily CyberSecurity

New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens

Trend Micro uncovers QLNX, a fileless Linux RAT targeting AWS, NPM, and Kubernetes keys. Learn how its eBPF rootkit hides from even the deepest system scans.

14 views09:04

About

Blog

Apps

Platform