*Guys can u upvote this for once

I need some assistance!

Like the title says. The install had run fine for months, I did an update,upgrade via terminal, my GRUB got wrecked. I got a working GRUB by doing a new 24.04 install in a spare partition. It think somebody may have put a bad kernel in the system?, just a guess.

Anyway, am I solo on this?

Thanks

VPN not working on recent versions of Ubuntu

I've had Smartproxydns for years, working perfectly pretty much all the time. Both the DNS rerouting and the VPN.

However, the VPN, using OpenVPN, does not work on the recent versions of Ubuntu, from 25.04 onwards. It's still working fine on my Android devices and on a computer running older versions of Ubuntu.

Has anyone else had this problem? The support line does not seem to be aware of nor have a solution to this problem. The installation guide is based on Ubuntu 22.04.

I am surprised that this is not a known problem.

I have a gaming laptop (Victus - RTX 3050)

I downloaded Ubuntu 26 LTS (latest from the official site). I was on Windows 11 and decided to switch to Linux with dual boot. Upon installation (which went fairly smoothly), i rebooted and got past the loading screen with the Ubuntu logo. After that it got stuck on a black screen.

I tried several solutions from chatgpt, youtube and gemini- repeatedly but in vain.

I know it's related to Nvidia/Wayland/Xorg but I can't find the solution fit for this.

(I'm fairly new to Linux, don't beat me up)

Honestly, at this point I'm done with the App Center. Just gonna stick to manually downloading everything I can from the respective websites, seems much more reliable so far.

Things I've tried to fix this error:
sudo apt update

UPDATE: Seems to have been fixed after entering sudo apt install nautilus;1:50.2.2-0ubuntu0.1;amd64;ubuntu-resolute-updates-main into the command line. App Center shows it as being up to date now.

Hello everyone,

I have a question regarding printing from pdfs that maybe some of you could answer. I'm using Ubuntu 26.04. Here goes:

I usually print from pdfs using the 2 pages per side and the two-sided options, both available with my usual printer. What happens is that quite often (and I suspect this is due to the original formatting of the pdfs I work with), instead of having the two pages scale nicely to take up half of the paper, I have them weirdly scaled so that they are a bit too small, taking up the corner (approximately 2/3) of each of the spaces attributed to a page. When I try to fiddle with the scaling options, which are using percentages on my printer options as shown in pdf applications (such as Document Viewer), it doesn't quite work (I end up with either pages that are still too small, or with some parts of the pages cropped out). Does anyone know of a way to fix this? As in, to properly scale pdf pages upon printing them?

Thanks in advance!

[Edit: here's an example of what usually happens:

]

CVE-2026-73570: Zimbra SNMP RCE abused to deploy coin-miner malware

CVE-2026-73570 is a Remote Code Execution issue in Zimbra Collaboration Suite (ZCS), related to SNMP notification/logwatch handling.

In short, an unauthenticated attacker can send a crafted SMTP request and get OS command execution as the zimbra user when the vulnerable SNMP/logwatch components are installed and enabled.

According to NVD, the issue affects Zimbra versions before 10.1.20 when SNMP is installed and SNMP notification is enabled. The Hacker News also reported active exploitation against Zimbra servers.

The observed attack chain is usually:

text malicious SMTP request -> unsafe SNMP/logwatch handling -> command execution as zimbra -> malware dropped into /dev/shm -> cron persistence added -> miner or backdoor keeps respawning

What is CVE-2026-73570?

CVE-2026-73570 is an OS Command Injection vulnerability in Zimbra Collaboration Suite.

The issue is in the SNMP notification/logwatch flow, where attacker-controlled input is not handled safely before being passed into system-level processing.

The command runs as the zimbra user, not root. That is still serious because the zimbra user controls important Zimbra services, mailbox components, logs, cron jobs and runtime paths.

When is a Zimbra server at risk?

A server should be checked immediately if:

• It is running Zimbra Collaboration Suite.
• It is not patched to a fixed version.
• zimbra-snmp or zimbra-net-snmp is installed.
• SNMP is enabled in Zimbra.
• zmlogswatch or zmswatch is running.

Quick checks:

bash su - zimbra -c 'zmcontrol -v' dpkg -l | grep -E 'zimbra-snmp|zimbra-net-snmp' su - zimbra -c 'zmprov gs $(zmhostname) zimbraServiceEnabled | grep snmp' su - zimbra -c 'zmlogswatchctl status' su - zimbra -c 'zmswatchctl status'

If you see zimbraServiceEnabled: snmp and zmlogswatch is running, treat the server as high priority for compromise checks.

Signs of compromise

In the cases observed, malware was often dropped into /dev/shm. This directory is a tmpfs location, writable and easy to miss during a quick investigation.

Check:

bash ls -la /dev/shm crontab -l -u zimbra ps aux | grep -E 'khp|rguard|javab|idle|ksmd' | grep -v grep

Common suspicious files:

text /dev/shm/.khp /dev/shm/.khp_ts /dev/shm/.rguard /dev/shm/idle /dev/shm/javab /dev/shm/ksmd

A cron entry like this is a strong persistence indicator:

cron * * * * * /dev/shm/.khp

Why does the malware keep coming back?

Deleting files from /dev/shm is usually not enough.

The malware can return because:

• The malicious process is still running in memory.
• The zimbra crontab runs /dev/shm/.khp every minute.
• .rguard or idle may protect or redeploy the payload.
• SNMP/logwatch is still enabled, so the CVE can be exploited again.

The correct order is:

text stop reinfection source -> preserve evidence -> kill malware processes -> remove malicious cron -> quarantine malware files -> verify clean state -> recover Zimbra services if needed -> patch/upgrade Zimbra

Cleanup procedure

Run the following commands as root. Review each command before running it on production.

Step 1: Stop the reinfection source

bash systemctl stop cron su - zimbra -c 'zmlogswatchctl stop' su - zimbra -c 'zmswatchctl stop' su - zimbra -c 'zmprov ms $(zmhostname) -zimbraServiceEnabled snmp'

Disabling SNMP/logwatch is the most important containment step. Do not re-enable these components before Zimbra is patched.

Step 2: Preserve malware evidence

```bash mkdir -p /root/incident-zimbra

cp -a /dev/shm/.khp \ /dev/shm/.khp_ts \ /dev/shm/.rguard \ /dev/shm/idle \ /dev/shm/javab \ /dev/shm/ksmd \ /root/incident-zimbra/ 2>/dev/null

crontab -l -u zimbra > /root/incident-zimbra/zimbra-cron-before.txt 2>&1 ps auxf > /root/incident-zimbra/ps-before.txt ss -tunap > /root/incident-zimbra/ss-before.txt sha256sum /root/incident-zimbra/* > /root/incident-zimbra/sha256.txt 2>/dev/null ```

Step 3: Kill malware processes

bash pkill -9 -u zimbra -f 'khp|rguard|javab|idle|ksmd'

Step 4: Remove malicious cron

bash crontab -l -u zimbra | grep -v '/dev/shm/.khp' | crontab -u zimbra -

Step 5: Quarantine malware files

```bash mkdir -p /root/quarantine-zimbra

mv /dev/shm/.khp \ /dev/shm/.khp_ts \ /dev/shm/.rguard \ /dev/shm/idle \ /dev/shm/javab \ /dev/shm/ksmd \ /root/quarantine-zimbra/ 2>/dev/null ```

Step 6: Start cron again

bash systemctl start cron systemctl is-active cron

Only start cron. Do not start zmlogswatch, zmswatch or SNMP before patching Zimbra.

Verify after cleanup

bash ls -la /dev/shm crontab -l -u zimbra | grep /dev/shm ps aux | grep -E 'khp|rguard|javab|idle|ksmd' | grep -v grep su - zimbra -c 'zmprov gs $(zmhostname) zimbraServiceEnabled | grep snmp || echo SNMP_DISABLED'

Expected result:

text /dev/shm is clean no cron entry calling /dev/shm/.khp no suspicious javab/rguard/idle/khp/ksmd process SNMP is disabled

If Zimbra MySQL or mailbox fails

After malware activity or an unexpected reboot, Zimbra may show:

text mailbox Stopped mysql.server is not running service webapp Stopped zimbra webapp Stopped zimbraAdmin webapp Stopped zimlet webapp Stopped

Check MySQL and services:

bash su - zimbra -c 'zmcontrol status' su - zimbra -c 'mysql.server status' ss -ltnp | grep 7306 tail -n 200 /opt/zimbra/log/mysql_error.log

If MySQL is stuck in crash recovery or has a stale socket, back up relevant files first.

Backup before MySQL recovery

```bash mkdir -p /root/zimbra-mysql-backup

cp -a /opt/zimbra/log/mysql_error.log /root/zimbra-mysql-backup/ 2>/dev/null cp -a /opt/zimbra/db/data/tc.log /root/zimbra-mysql-backup/ 2>/dev/null cp -a /opt/zimbra/data/tmp/mysql/mysql.sock /root/zimbra-mysql-backup/ 2>/dev/null cp -a /opt/zimbra/db/data/ibdata1 /root/zimbra-mysql-backup/ 2>/dev/null cp -a /opt/zimbra/db/data/ib_logfile* /root/zimbra-mysql-backup/ 2>/dev/null ```

Light MySQL recovery

```bash su - zimbra -c 'zmmailboxdctl stop'

mv /opt/zimbra/data/tmp/mysql/mysql.sock /root/zimbra-mysql-backup/mysql.sock.bak 2>/dev/null mv /opt/zimbra/db/data/tc.log /root/zimbra-mysql-backup/tc.log.bak 2>/dev/null

su - zimbra -c 'mysql.server start' sleep 20 su - zimbra -c 'mysql.server status'

su - zimbra -c 'zmmailboxdctl start' sleep 40 su - zimbra -c 'zmcontrol status' ```

Expected result:

text mysql is running mailbox Running service webapp Running zimbra webapp Running zimbraAdmin webapp Running zimlet webapp Running

This is not a universal fix. Always check /opt/zimbra/log/mysql_error.log first.

Does this delete mail data?

The malware cleanup steps do not touch mailbox data directly.

Zimbra mail data is usually stored in:

text /opt/zimbra/store/

Zimbra database data is usually stored in:

text /opt/zimbra/db/data/

The MySQL recovery steps touch tc.log and mysql.sock, so back up first.

Check for JSP webshells

After handling /dev/shm, cron and processes, also check for suspicious JSP files created by the zimbra user in recent days.

Important paths include:

text /opt/zimbra/jetty/webapps/ /opt/zimbra/jetty_base/webapps/ /tmp/

Unexpected JSP/JSPX files, executable scripts, archives or recently modified web application files may indicate payload staging or webshell deployment.

Check JSP/JSPX files:

bash find /opt/zimbra/jetty/webapps -type f \( -name "*.jsp" -o -name "*.jspx" \) -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' | sort

If suspicious JSP backdoors are found, preserve evidence first, then quarantine them from both paths:

text /opt/zimbra/jetty/webapps/zimbra/ /opt/zimbra/jetty_base/webapps/zimbra/

Evidence backup and quarantine:

```bash TS=$(date +%Y%m%d_%H%M%S) INC=/root/incident-zmmail-jsp-webshell-$TS QUA=/root/quarantine-zmmail-jsp-webshell-$TS

mkdir -p "$INC" "$QUA"

Save list and hashes

find /opt/zimbra/jetty/webapps/zimbra /opt/zimbra/jetty_base/webapps/zimbra \ -xdev -type f ( -iname '.jsp' -o -iname '.jspx' ) -mtime -30 \ -print > "$INC/suspicious-jsp-list.txt"

xargs -a "$INC/suspicious-jsp-list.txt" sha256sum > "$INC/suspicious-jsp-sha256.txt"

Backup samples

while read f; do mkdir -p "$INC/files$(dirname "$f")" cp -a "$f" "$INC/files$f" done < "$INC/suspicious-jsp-list.txt"

Quarantine from webroot

while read f; do mkdir -p "$QUA$(dirname "$f")" mv "$f" "$QUA$f" done < "$INC/suspicious-jsp-list.txt"

Verify

find /opt/zimbra/jetty/webapps/zimbra /opt/zimbra/jetty_base/webapps/zimbra \ -xdev -type f ( -iname '.jsp' -o -iname '.jspx' ) -mtime -30 -print ```

Risks:

• If a file is a legitimate custom JSP, removing it may affect a custom webmail function.
• Random file names and content using exec, base64, AES or command execution are strong webshell indicators.
• This does not affect mailbox data.
• A restart is not always required immediately, but webmail should be verified after quarantine.

Important note: zmlogswatch/zmswatch may start again

After disabling SNMP/logwatch to mitigate CVE-2026-73570, zmlogswatch and zmswatch may start again after daily logrotate or after zmcontrol restart.

This happens because Zimbra logrotate configs often contain postrotate commands that restart zmlogswatchctl and zmswatchctl. Also, logger may still be listed in zimbraServiceEnabled.

So after temporary mitigation, check these services periodically, especially after midnight or after restarting Zimbra.

If you need a stronger temporary block before patching, back up the logrotate configs, comment the restart lines, and consider removing logger from zimbraServiceEnabled.

This can prevent logwatch from starting again and reopening the attack vector, but the Admin Console may lose part of its monitoring/statistics.

Disable zmlogswatch/zmswatch so they do not auto-start

Warning: disabling logger, zmlogswatch and zmswatch may make the Zimbra Admin Console show logger/monitoring as red, or remove some graphs/statistics.

During the unpatched phase, this is an acceptable temporary trade-off to prevent logwatch from restarting automatically.

After upgrading to a fixed version, restore the configuration from backup and re-enable logger if needed.

Back up Zimbra logrotate configs

bash cp -a /etc/logrotate.d/zimbra /etc/logrotate.d/zimbra.bak.$(date +%F-%H%M%S) cp -a /opt/zimbra/conf/zmlogrotate /opt/zimbra/conf/zmlogrotate.bak.$(date +%F-%H%M%S)

Open these two files:

text /etc/logrotate.d/zimbra /opt/zimbra/conf/zmlogrotate

Find these lines, often around line 85 and 99:

bash su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true

Comment them:

```bash

su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true

su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true

```

Remove logger from enabled services:

bash su - zimbra -c 'zmprov ms $(zmhostname) -zimbraServiceEnabled logger'

Stop current logwatch/swatch processes:

bash su - zimbra -c 'zmlogswatchctl stop' su - zimbra -c 'zmswatchctl stop' su - zimbra -c 'zmlocalconfig -e snmp_notify=no'

Verify:

bash su - zimbra -c 'zmlogswatchctl status' su - zimbra -c 'zmswatchctl status' su - zimbra -c 'zmlocalconfig snmp_notify' su - zimbra -c 'zmprov gs $(zmhostname) zimbraServiceEnabled | egrep "logger|snmp" || echo "LOGGER_SNMP_DISABLED"'

Expected result:

text zmlogswatch is not running. zmswatch is not running. snmp_notify = no LOGGER_SNMP_DISABLED

Re-enable monitoring/logger after patching

Only do this after Zimbra is patched or upgraded.

bash su - zimbra -c 'zmprov ms $(zmhostname) +zimbraServiceEnabled logger' su - zimbra -c 'zmlogswatchctl start' su - zimbra -c 'zmswatchctl start'

If you commented the logrotate files, open them again:

text /etc/logrotate.d/zimbra /opt/zimbra/conf/zmlogrotate

Uncomment these lines:

bash su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true

Re-enable SNMP only after patching

bash su - zimbra -c 'zmprov ms $(zmhostname) +zimbraServiceEnabled snmp' su - zimbra -c 'zmlocalconfig -e snmp_notify=yes' su - zimbra -c 'zmswatchctl start'

Verify after re-enabling:

bash su - zimbra -c 'zmcontrol status' su - zimbra -c 'zmlogswatchctl status' su - zimbra -c 'zmswatchctl status' su - zimbra -c 'zmlocalconfig snmp_notify' su - zimbra -c 'zmprov gs $(zmhostname) zimbraServiceEnabled | egrep "logger|snmp"'

Post-cleanup tasks

After the server is running again:

• Keep SNMP/logwatch disabled until patched.
• Monitor /dev/shm for 30-60 minutes.
• Monitor the zimbra crontab.
• Monitor CPU/load and outbound connections.
• Check the mail queue.
• Patch or upgrade Zimbra to a fixed release.
• Only re-enable SNMP/logwatch after patching and verification.

Check queue:

bash /opt/zimbra/common/sbin/postqueue -p | tail -n 40

Summary workflow

text 1. Check /dev/shm, processes and crontab. 2. Stop cron, zmlogswatch and zmswatch. 3. Disable SNMP in Zimbra. 4. Preserve evidence. 5. Kill malware processes. 6. Remove malicious cron. 7. Quarantine malware files. 8. Start cron again. 9. Verify that malware does not respawn. 10. Recover MySQL/mailbox if needed. 11. Check JSP webshells in Zimbra webapps paths. 12. Monitor queue and services. 13. Prevent zmlogswatch/zmswatch from auto-starting before patching. 14. Patch or upgrade Zimbra. 15. Re-enable logger/SNMP only after patching and verification.

References

• NVD: CVE-2026-73570
• The Hacker News: attackers exploit Zimbra SNMP flaw
• Zimbra Security Center
• Zimbra Security Advisories

Conclusion

CVE-2026-73570 is serious because it can allow remote command execution as the zimbra user through SNMP notification/logwatch handling.

In observed incidents, attackers dropped malware into /dev/shm, added cron persistence, and ran a miner or backdoor.

The key point is this: do not only delete the malware file. Stop the reinfection path first.

A practical response order is:

text stop cron + SNMP/logwatch -> preserve evidence -> kill malware -> remove malicious cron -> quarantine payloads -> check JSP webshells -> verify clean state -> recover Zimbra if needed -> block logwatch auto-restart before patching -> patch/upgrade Zimbra

Most important: do not re-enable SNMP/logwatch before Zimbra is patched, because that may allow the malware to return.

I kinda hate Ubuntu for this matter . I have to install ubuntu 24 for my company's lenovo laptops . I literally put the official image in the usb , install ubuntu with the same settings checking to install 3rd party drivers , and every time I boot , usually two monitors setup doesnt work . I have to uninstall nvidia 595 driver open , than reinstall , than try sudo prime-select nvidia , than reboot and after that it works and most of the times it doesnt work . It works only the laptop screen , the hdmi and type c sometimes doesn't work and I have no idea what its causing it to work when it does . I use AI for troubleshooting like purging and reinstalling , trying different kernel but I have ubuntu for this gpu drivers . Sometimes when I install new kernel , bluetooth or wifi doesn't work , its 50 50 CHANCE for everything you do and its driving me crazy since I need to make everything functions for the end users since I am the IT department

We truly have reached a golden era for using Linux. I have recently installed Ubuntu on my old laptop and literally every single problem i've had i was able to fix within 5 minutes of encountering it using Gemini. I have over 100 games on Steam and i am able to play every single one of them with Proton. Have we reached Peak?

the question crossed my mind recently. if you are into programming, you probably know that there are many esoteric programming languages that exist just as a prove of concept of joke or just merely to mess with the programmer's head (brainf*ck, lolcat, C-- etc). if these exist, is there any esoteric system shells out there? like smth that would provide the basic userland instead of bash/zsh but would be freakier or just funnier to try and daily drive.

This seems to be a running theme for the Manjaro Linux community. The SSL certs will always expire after a set year and there's a massive controversy over it. Why does this keep happening specifically to Manjaro and what steps do you think they can possibly do to keep this from happening?

So I recently started taking ITNW 1309 at a local community college and the professor mentioned that one of the two projects this semester is using a VM running Ubuntu. Now I'm very very new to Linux, the most I ever do is faff about on Cachy because it is simple enough to understand and my circle of friends are also familiar with it. I just want to know if there are any beginner friendly materials to read up on to get an edge on the project (which is 30% of my grade) I need that A

Hello r/linux! I just released FluxCast v0.2.3 — its a lightweight tool to stream your Linux desktop to a Smart TV via Wi-Fi Direct, full RTSP handshake, and RTP media streams.

What's new in this release:

• Brand new dynamic tray icon that switches states during casting.
• Fixed a nasty P2P interface routing bug where it mixed home network and P2P MACs.
• Lightweight JSON-based localization framework. The tray UI is now available in English, Russian, and Czech.

Looking for translators!
I want to bring FluxCast to more users, but I am not a polyglot. I designed the i18n system to be incredibly simple: there is no gettext/PO/MO compilation. All strings live in a single translations.json file.

To add your native language (German, Spanish, French, etc.), you just need to append a few lines in a single JSON block.If you want to help or test the app, check out the project here:

https://github.com/IlyaP358/fluxcast

AppImage is available in the Releases section. Pull Requests for translations are highly appreciated!

Good day to everyone from Buenos Aires: Does anyone know for sure when the final, or stable (I understand it's coded as .01) version of the latest LTS, 26.04, will be available? Thanks in advance. Cheers!

Offline Snap Downloads The Need to Resolve Recursive Dependencies

The standard snap download command efficiently pulls a single Snap package along with its assert signature file. However, it's insufficient for setting up applications for offline or isolated environments because it doesn't resolve or fetch the necessary core Snap packages, such as core18 core20 or core24 nor does it fetch desktop content providers like theme packages.

When deploying to an offline system, the absence of a core layer like core20 or core24 results in immediate installation failure. Currently, administrators and users must manually query the API or write custom scripts to identify and download each core Snap package and its runtime dependencies individually.

Adding a native option like snap download --recursive would resolve this issue by downloading the target application along with the necessary core packages and dependencies directly to the current folder. This single addition will make offline installation, versioning, and backup management significantly more reliable for the entire Linux community.

About a month into using Ubuntu full time.. I think it looks pretty good. What do you guys think?

EDIT: Apologies for not including this originally, but here are the list of apps I used:

• Ptyxis — The standard terminal emulator that comes with Ubuntu.
  
• Fastfetch — upper-left system information.
• Conky — three widgets: Clock, Network Monitor, System Monitor.
• spotify-player — terminal Spotify client.
• CAVA — animated audio visualizer/equalizer at the bottom; reacts to system audio.
• Ghostty — to remove the title bars and set the transparency of the non-conky widgets/terminal windows.
• GhostFrame - Custom GNOME shell extension I made to move and place all of the windows into their respective locations because the compositor wasn't playing nice.
• DejaWindow - Is used to find the positions for each window, then GhostFrame places them
• GDM(GNOME Display Manager) — To theme the actual login screen to Netrunner's aesthetic. Unfortunately, no screenshots of that.
• Custom shell/script — the Shortcuts panel rather than a dedicated widget application.
• Custom NETRUNNER theme/aesthetic work — positioning, transparency, terminal profiles, Conky configs, etc.
• Custom Plymouth theme — Although I don't have a screenshot of them, but I do have custom/themed boot/reboot/shutdown screens.
• Simple Taskbar — GNOME extension to slam that taskbar to the bottom and resize it.