GNU/Linux and Security Leftovers

posted by Roy Schestowitz on Sep 11, 2025

• Server

  • eBPF: The Silent Power Behind Cloud Native’s Next Phase

    eBPF is quietly reshaping cloud native computing, powering service meshes, observability, networking, and security directly in the GNU/Linux kernel. By reducing sidecar overhead, enabling zero-instrumentation telemetry, and enhancing runtime protection, eBPF is emerging as the invisible foundation of Cloud Native 2.0.

• Kernel Space

  • [Repeat] Ruben Schade ☛ FastCode on open source software shakedowns

    You all know I’m not the biggest fan of K8s, and this scenario is one of the many reasons why I lose sleep about its deployment far in exceess of use cases where it makes sense (and I assert those cases are vanishingly small).

  • University of Toronto ☛ ZFS snapshots aren't as immutable as I thought, due to snapshot metadata

    One visible place where ZFS updates the metadata of a snapshot is to maintain information about how much unique space the snapshot is using. Another is that when a ZFS snapshot is deleted, other ZFS snapshots may require updates to adjust the list of snapshots (every snapshot points to the previous one) and the ZFS deadlist of blocks that are waiting to be freed.

• Distributions and Operating Systems

  • SUSE/OpenSUSE

    • Linuxiac ☛ openSUSE's Agama Installer 17 Released with UI Improvements

      Agama, the new, still-in-development Linux installer from openSUSE, released version 17, unveiling various UI enhancements and practical new features. With SUSE Linux Enterprise 16.0 on the horizon, this release is expected to closely align with the installer that will ship with SUSE’s flagship distribution.

  • Arch Family

    • Linuxiac ☛ Garuda Linux Releases New ISO with Mesa Fixes

      As is always the case with the other point ISOs, this update isn’t a new major release but simply a refreshed snapshot. It just rolls in all the latest package updates, bug fixes, and hardware compatibility improvements. In other words, users don’t need to reinstall the system to get these changes; running a normal garuda-update is enough. Now, on to the changes.

  • Fedora Family / IBM

    • insideHPC ☛ CIQ to Accelerate AI and HPC Workloads with NVIDIA CUDA

      Enterprise Linux platform company CIQ today announced it is collaborating with NVIDIA to integrate the NVIDIA CUDA Toolkit within its commercial offerings. This collaboration transforms how the entire industry can access and operationalize GPU acceleration, delivering ready-to-run environments that dramatically reduce complexity, risk, and time-to-value for all performance computing workloads, including AI, machine learning, and HPC.

• Security

  • Linux botnet ‘Luno’ unleashes advanced DDoS capabilities

    According to The Cyber Express, Cyble threat intelligence researchers have discovered a sophisticated Linux botnet called "Luno." This botnet is tailored for cryptocurrency mining, remote command execution, and various types of DDoS attacks.

    The Luno botnet, identified by Cyble Research and Intelligence Labs, demonstrates advanced features such as process masquerading, self-update systems, and robust obfuscation techniques. The malware is actively marketed for DDoS services on a Telegram channel, indicating the involvement of a professional threat actor. Focused on establishing a long-term criminal infrastructure, LunoC2 employs intricate evasion tactics and a pricing model that implies continuous monetization. The malware targets systems with limited resources for cryptocurrency mining, employing anti-analysis methods to evade detection and self-destruct in case of anomalies.

  • Cyble Inc ☛ LunoBotnet: A Self-Healing Linux Botnet with Modular DDoS and Cryptojacking Capabilities

    In a deep-dive analysis, Cyble Research and Intelligence Labs (CRIL) identified an ongoing in-the-wild Linux botnet campaign, which we have dubbed “Luno.” This campaign combines cryptocurrency mining, remote command execution, and modular DDoS attack capabilities. Additionally, it uses watchdog-based respawning and unusually strong anti-analysis defences into a single malware framework, indicating active professional threat actor involvement.

    Unlike conventional cryptominers or DDoS botnets, LunoC2 exhibits process masquerading, binary replacement, and a self-update system, suggesting the malware is designed as a long-term criminal infrastructure tool.

    Based on frequent updates to attack modules, it appears to be actively evolving and being augmented with new functionalities.