Linux security
Server hardening, service isolation, privilege boundaries, release integrity, and the evidence required to show that a control changed a real attack path.
Start here, then go deeper.
Begin with a defensible hardening method, test the container-to-host boundary, then follow three Linux casefiles where service authority, privileged process state, and release provenance failed in different ways.
- 01Hardening methodThe Hardening Score Went Up. The Attack Path Stayed Open.18 min ↗
A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.
- 02Container boundaryThe Container Was Non-Root. The Node Was Still One Mount Away.21 min ↗
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
- 03Privilege boundaryCVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root11 min ↗
A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.
- 04Privileged serviceCVE-2024-6387: How an OpenSSH Timeout Could Lead to Remote Root Access11 min ↗
A clear reconstruction of regreSSHion: how an unauthenticated connection triggered unsafe signal-time logging in sshd, why that could corrupt the heap, which systems were exposed, and how OpenSSH 9.8p1 fixed the root cause.
- 05Artifact integrityCVE-2024-3094: How a Backdoored XZ Release Reached OpenSSH11 min ↗
A clear reconstruction of the XZ Utils supply-chain attack: what was changed, how malicious release tarballs altered liblzma, why selected OpenSSH servers became reachable, and which systems were actually exposed.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 2
The Container Was Non-Root. The Node Was Still One Mount Away.
A container security methodology that measures mounts, runtime authority, kernel controls, and workload identity instead of treating a non-root UID or a passing policy check as proof of isolation.
21 min read ↗Pentest · Aug 22, 2026The Hardening Score Went Up. The Attack Path Stayed Open.
A practical Linux hardening methodology that uses Lynis as a sensor, established baselines as context, and controlled retesting to prove which changes reduce attack paths without breaking the service.
18 min read ↗CVE research 4
Calibrating a Root-Namespace Load Detector
I ended a CVE-2025-32463 write-up with a recommendation and never carried it out. This is what happened when I built the instrument to do it: an inert marker running as root, two detection layers that had to be redesigned mid-flight, and three ways the measurement lies to you.
9 min read ↗CVE-2025-32463 · Static ReproductionCVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root
A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.
11 min read ↗CVE-2024-6387 · Static ReproductionCVE-2024-6387: How an OpenSSH Timeout Could Lead to Remote Root Access
A clear reconstruction of regreSSHion: how an unauthenticated connection triggered unsafe signal-time logging in sshd, why that could corrupt the heap, which systems were exposed, and how OpenSSH 9.8p1 fixed the root cause.
11 min read ↗CVE-2024-3094 · Static ReproductionCVE-2024-3094: How a Backdoored XZ Release Reached OpenSSH
A clear reconstruction of the XZ Utils supply-chain attack: what was changed, how malicious release tarballs altered liblzma, why selected OpenSSH servers became reachable, and which systems were actually exposed.
11 min read ↗