How sudo Really Works: setuid, PAM, and the sudoers File
What happens between typing sudo and getting a root shell: the setuid bit, PAM authentication, sudoers parsing, and why sudo -l matters.
948 Root Bugs in One Run: What OpenAI’s Kernel Vulnerability Pipeline Means for Linux
OpenAI ran an autonomous pipeline over 7% of the Linux kernel and found 948 distinct privilege escalation flaws, each with a working exploit, for $1.2M in API credits.
The Patching Process That Survives Audit
A patching process that survives audit: rings that earn production, fixed windows, one Ansible playbook for a mixed fleet, pins with an owner and an expiry date, and a record that proves it happened.
Patching Ubuntu LTS in Production: apt, Livepatch, and Knowing When to Reboot
Ubuntu LTS patching runs on apt and unattended-upgrades with no security-only flag, plus Canonical Livepatch for Critical and High kernel CVEs — and the current LTS is 26.04, not the next one.
Patching Oracle Linux in Production: dnf, Ksplice, and Knowing When to Reboot
Oracle Linux patches like RHEL until you hit the two things that make it different: the Unbreakable Enterprise Kernel and Ksplice live patching for the kernel and user space.
Patching RHEL in Production: dnf, versionlock, kpatch, and Knowing When to Reboot
Patching RHEL in production means reading the advisories first, automating carefully, pinning with a reason, live-patching within its limits, and rebooting only when needs-restarting says so.