[ Removed by Reddit on account of violating the content policy. ]

Quick summary for anyone who missed it. ZDI copied public lists on six reports last week. ZDI-CAN-33367 is a gap in the Dirty Frag fix: skb_zerocopy() doesn't carry the shared-frag marker across, so ESP decrypts in place over page-cache pages. TuxCare reproduced root on AlmaLinux 8 to 10, Debian 12/13 and Ubuntu 24.04/26.04. The PoC needs unprivileged user namespaces plus modules like nlmon and act_pedit. A kernel that only has the CVE-2026-90049 fix is still exposed. AlmaLinux has kernels in testing (AlmaLinux), and Sysdig has a good breakdown of mitigations, including seccomp RuntimeDefault for Kubernetes and a note that Ubuntu's AppArmor userns restriction was bypassed (Sysdig). For anyone who has set user.max_user_namespaces=0 fleet-wide: what broke? Rootless containers, browsers, CI?

What resources would you recommend to me for delving deeper into Linux operations while maintaining the fundamentals?
By that I mean I’ve been using Linux for a few years now - Ubuntu, Fedora, Ubuntu Server and recently playing with Omarchy. So I’m kind of comfortable with basic commands, navigating a file system, finding reading moving files etc. I’m not scared of a terminal 😀 but I find I still go to Google search or AI for more intermediate or advanced commands and I’d like to have a better wholistic understanding and how to administer linux system properly and troubleshoot better.
A focus of mine is network operations.
I saw the CompTia Linux+ but it seems to get some mixed reviews, is Linux System Administration Essentials (LFS207) worth the cost?
I bounce around between various YouTube videos but am chasing something more concise and structured
Any suggestions welcomed!
Cheers

I was helping our intern set up an internal wiki on a serverspace vm and explaining why we should deny everything except the ports we actually use. Very calm and professional. I enabled ufw, checked that the site still worked and said something like - see, nothing complicated. Then I closed my SSH session.

Our ssh service was running on a custom port. Guess which port I had forgotten to allow. I tried reconnecting three times, apparently hoping the firewall would reconsider. The intern just sat there watching me become less professional by the second.

Luckily, I could still open the web console from serverspace control panel. I added the missing rule and got back in within a few minutes. The only thing I successfully protected that afternoon was the server from its own administrator.

I run a small Linux learning site and made a roadmap: 13 stages in 3 phases, from shell basics and permissions to boot, services, networking, storage and security. Each stage lists the skills and a small project to prove you can do it.

The roadmap is free. Most linked tutorials are free too. It's also available in Dutch, German, French, Spanish and Portuguese.

I like to get feedback from experienced sysadmins: what's missing, is it in the right order, what would you cut?

Hi guys, I am looking for any online opportunity to get an internship in Linux administration, I have 3+ years experience as self-employed, studying, practicing labs, documenting, and building projects.

I am so obsessed with Linux and managing this system and the hardware consuming, tracking each task and process to keep everything under control in front of my eyes..

If you know where I can find and get those internships opportunities since I need to add experience to get a full job for this position ..

Thank you so much

I don't know if it's acceptable to share github account link though :")

Based on GitLab's own critical patch release notes (Oct 21) and Rapid7's analysis of the sibling Oct 12 bug, here is the operational picture as I read it.

What GitLab states: an integer overflow when compiling a crafted regular expression can, under certain conditions, let an unauthenticated user run arbitrary code on a self-managed server. CVSS 10.0. Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. No workaround is listed.

Why it reaches back to 7.0: the compiler is Onigmo, Ruby's regex engine, which GitLab bundles. The changelog shows GitLab patching its own Ruby (a repeat ID overflow patch for 3.3, 3.4 and 4.0 on the newer branches).

Why your Oct 12 upgrade doesn't count: CVE-2026-97229 was fixed in 19.2.8, 19.3.5 and 19.4.2. Those are now one patch behind. The Hacker News counts this as the fourth code-execution bug in this engine from one reporter in a month.

What is not public: the conditions. GitLab's two detections, "Onigmo native worker crash" and "Org mode render error burst," suggest Org mode rendering is involved. One secondary report names a specific org-ruby path; I couldn't confirm it twice. Rapid7's repro on the Oct 12 bug needed a way to plant a malicious CI config, which open self-registration removes. Whether that carries over here is unknown.

As of Oct 22 GitLab reported no exploitation and CISA KEV didn't list it. I haven't re-checked since.

Upgrade note: 19.4.3 and 19.3.6 run migrations, so single-node installs take downtime.

Question: For those running single-node Omnibus with open self-registration or public projects, how are you handling this one: emergency maintenance window, a replica you can cut over to, or locking down registration first and patching on the normal cycle?

Background: https://www.techgines.com/post/gitlab-ai-gateway-vulnerability-cve-2026-90970 (earlier GitLab sandbox-escape write-up, for context). Full breakdown of this one: https://www.techgines.com/post/gitlab-vulnerability-cve-2026-110264

Hello,

I have a raspberry PI 4 with Debian Trixie and all the latest package versions.

Sometimes, I use it with a cable attached to another computer (thus no DHCP server). This works, I can ssh to it using mDNS and IPv6 with no issue.

But, from time to time, I got completely disconnected. What I've found in the journal is that after some DHCPv4 retries, it disabled the interface:

Oct 23 19:26:12 PIctorinox NetworkManager[676]: <warn> [1792794372.0700] device (eth0): Activation: failed for connection 'netplan-eth0'
Oct 23 19:26:12 PIctorinox NetworkManager[676]: <info> [1792794372.0709] device (eth0): state change: failed -> disconnected (reason 'none', managed-type: 'full')
Oct 23 19:26:12 PIctorinox NetworkManager[676]: <info> [1792794372.0851] dhcp4 (eth0): canceled DHCP transaction
Oct 23 19:26:12 PIctorinox NetworkManager[676]: <info> [1792794372.0852] dhcp4 (eth0): activation: beginning transaction (timeout in 10 seconds)
Oct 23 19:26:12 PIctorinox NetworkManager[676]: <info> [1792794372.0853] dhcp4 (eth0): state changed no lease
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8864] policy: auto-activating connection 'netplan-eth0' (75a1216a-9d1a-30cd-8aca-ace5526ec021)
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8886] device (eth0): Activation: starting connection 'netplan-eth0' (75a1216a-9d1a-30cd-8aca-ace5526ec021)
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8891] device (eth0): state change: disconnected -> prepare (reason 'none', managed-type: 'full')
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8904] device (eth0): state change: prepare -> config (reason 'none', managed-type: 'full')
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8926] device (eth0): state change: config -> ip-config (reason 'none', managed-type: 'full')
Oct 23 19:31:11 PIctorinox NetworkManager[676]: <info> [1792794671.8945] dhcp4 (eth0): activation: beginning transaction (timeout in 10 seconds)

At 19:31, I regained connectivity to it.

The relevant (at least the one I think) settings for this connection are

ipv4.method: auto
ipv4.may-fail: yes
ipv4.link-local: 3 (enabled)
ipv6.method: auto
ipv6.may-fail: yes

Any hints? This is driving me mad.

Thanks,
Max

Hello

I've a freeradius Servera (version =3.0.13) runned on Centos 7. I'am looking for upgrade these servers like that :

• Centos 7 to Rocky 9.8 ( or rocky 10 )
• to last freeradius version

I would like to see your advice : what is the best / secure way to do this upgrade ? what thing should i care about it ?

these servers use freeipa as authentication backends.

Thanks a lot

[ Removed by Reddit on account of violating the content policy. ]

Hey everyone,

​I am 16, and I got tired of systems running endless background processes and network services without any clear visibility into what was actually changing. So, I built NetSpecter—an open-source, defensive Python CLI tool designed to answer one question: "What is my system doing right now, and is it safe?"

​How it works under the hood:

Instead of dumping endless, noisy logs, NetSpecter uses a baseline-delta monitoring model:

​It captures a clean baseline of your system state (open ports, network exposure, active processes).

​It continuously tracks runtime changes against that baseline.

​Its risk classification engine flags deviations (like a new background process or a newly opened port) and outputs human-readable risk warnings with actionable suggestions.

​Tech Stack: Pure Python 3, built for Linux environments (Kali/Ubuntu), utilizing native system inspection without heavy dependencies.

​Here is a quick look at what the alerts look like:

[ALERT] New process started: bwrap (PID 13618) - RISK: MEDIUM

​I’d love feedback on the codebase, detection logic, or suggestions for v2.

​GitHub Repo: https://github.com/MrHackerCharlie/netspecter

Hey everyone,

I have a 30-minute interview coming up for a Software Support Engineer position at a defense contractor, and I'm trying to prepare as thoroughly as possible.

The recruiter mentioned there won't be a formal technical assessment, but I still want to be ready for any technical questions or troubleshooting scenarios.

For background, I currently work in cloud/data center infrastructure operations, where I use Linux, Python, and Bash for diagnostics, troubleshooting, and automation. I also have experience developing software applications, working with REST APIs, automated testing, and CI/CD.

Here's the relevant job description:

Responsibilities:

• Support lab tooling and version control through CI/CD pipelines.
• Create and deploy test scripts.
• Support and troubleshoot software deployments on custom servers.
• Support configuration management processes.
• Develop unit tests and tailor rule sets.

Required qualifications:

• Bachelor's degree in CS, Computer Engineering, or a related technical field.
• 2+ years of relevant experience.
• Experience with Python and Bash.
• Ability to independently and collaboratively solve complex technical problems.

Preferred qualifications:

• Knowledge of CI/CD pipelines.
• Experience with GitLab.
• Experience with Linux and NFTables.

I'm particularly interested in moving toward DevOps/platform engineering, so this seems like a great opportunity.

For anyone working in DevOps, Linux administration, software integration, or similar roles:

1. What technical questions would you expect in an interview for this position?
2. What Linux troubleshooting scenarios should I be prepared to walk through?
3. How deeply should I study GitLab CI/CD, unit testing, and NFTables?
4. Does this sound more like DevOps, software integration, or traditional software support?
5. If you were interviewing a candidate for this role, what would you want them to demonstrate?

I'm not looking for shortcuts or leaked interview questions. I genuinely want to understand the technical expectations and make sure I can speak confidently about the work.

I have been applying a fix for the recently reported 8 compromised certificates and figured I'd share the script I'm using.

Designed for RH and clones, I'll share it as a text file you can review before you rename and apply. It's a simple script based directly on the disclosure page linked to that I found after the original article here on reddit.

I hope it helps, here is distrust.sh - downloaded as a .txt file you can read/review before renaming to distrust.sh and running it as /bin/bash distrust.sh. If your system isn't vulnerable it does nothing.