setuid, setgid, and the Sticky Bit: How Linux Permissions Really Work [Under the Hood]
unixshadow — permissions setuid, setgid, and the Sticky Bit The three permission bits every sysadmin uses and few can explain […]
The Cursor Marketplace Backdoor: How a svc-telemetry SSH Key Landed in authorized_keys
unixshadow — cursor-backdoor The Cursor Marketplace Backdoor A trusted editor extension auto-updated, and a stranger’s SSH key quietly moved into […]
Node2Shell: The Brotli Bug That Turned HTTP/2 Into Remote Code Execution
node — CVE-2026-111497 ~ node –version # if this prints anything older than the fixed lines below, keep reading Node2Shell: […]
The CVE Flood: Why 2026 Broke the Vulnerability Count
analyst@unixshadow: ~/cve-count/2026.log analyst@unixshadow:~# curl -s “https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2026-10-01T00:00:00.000Z&pubEndDate=2026-10-26T00:00:00.000Z&resultsPerPage=1” # totalResults: 13934 The CVE Flood: Why 2026 Brokethe Vulnerability Count October 2026 published […]
Panic on Boot? Rebuilding the initramfs on RHEL 6 Through 10, Running or in Rescue Mode
root@rescue: ~/initramfs/rebuild.log root@rescue:~# dracut -f /boot/initramfs-$(uname -r).img $(uname -r) # panic on boot, rebuild it right Panic on Boot? Rebuilding […]
Cairn & Storm-0940: Two Campaigns That Let AI Agents Do the Hacking [Under the Hood]
analyst@unixshadow: ~/cairn-storm0940/analysis.log analyst@unixshadow:~$ explain cairn storm-0940 # two campaigns, one inflection: the human gives a goal, the agents do the […]