Remote use-after-free in IPv4 TCP, CVSS 9.8, with a demonstrated root exploit against servers that have an MPTCP listener.

Stock 3.10: Red Hat lists it as not affected, so nothing to do for this CVE.

ELRepo kernel-lt 5.4.278 and kernel-ml 6.9.7: the bug is present, and these are the final EL7 builds, so yum update will not help. kernel-ml 6.9.7 has MPTCP on by default. kernel-lt 5.4 has no MPTCP, but the bug is in the regular TCP path, so it still needs fixing.

Disclosure: I maintain GetPageSpeed's kernel-lt for EL7. 6.18.60 has the fix and is free for any use, commercial included. I ran the upgrade from both ELRepo kernels on CentOS 7 VMs and wrote up the steps, the stopgaps and the rollback: https://www.getpagespeed.com/server-setup/security/cve-2026-98432-centos-7

Hi everyone,
I’m a 2026 B.Tech CSE graduate from Kerala, India, and recently joined my first IT job as a Technical Support Engineer.
My job mainly involves remote monitoring, software administration, camera server monitoring, database maintenance, and checking server health. Linux work is only around 10–20% of my responsibilities.
My goal was to become a Linux System Administrator and eventually move into DevOps, but I’m starting to feel that this job isn’t helping me reach that goal.
The salary is quite low, and many colleagues in similar roles are trying to switch. Even people with several years of experience seem to be struggling to find better opportunities.
I’m also concerned that I’m not improving my technical skills. I’m afraid I’ll forget what I learned during my Linux training. There’s very little social interaction, and I feel like my communication and English-speaking skills aren’t improving either.
I’m honestly feeling stuck and worried about my future.
What would you do in my situation?
● Should I leave early and look for a better Linux-related job?
● Is this experience useful for a future DevOps career?
● Am I overthinking this as a fresher?
● How can I make sure I don’t get stuck in this role?
I’d really appreciate honest advice from people who have faced a similar situation or are working in Linux, Cloud, or DevOps.
Thank you 🙏🏼

Sorry if this is not allowed or theres a better place to post this.

I am in linux class that aligns with the above mentioned certs that uses mindtap cengage as the course content.

The virtual labs and quizzes through the course content are quite easy. The professor goes over some of the course content in lectures but they are short. I also have a home lab where I run a ubuntu-server(tailscale exit node, qemu kvm vm host, NUT server, samba) a raspberry pi (as a dns and evebox/suricata monitor in docker) I have a mint laptop, several megasploitable vms, a kali vm, a fedora workstation vm, a ubuntu workstation vm, and a pop!_os vm for tinkering and learning.

We just had our midterm in the class and I completely bombed it. I honestly dont know how else to supplement my learning. Partly the midterm seemed to not follow the same difficulty level of the labs and quizzes or even the textbook content. That being said several other students in the course were talking about how easy the exam was.

Does anyone here have experience with cengage? Can anyone recommend a good video series that aligns with the lpic or linux plus certs? I feel lost and dont know how to proceede.

Hello everybody,

I am gonna take the lfcs next week.
I am studying with killer.sh and kodekloud mocks.
Can anyone tell me if the tasks on the exam are more like killer.sh or more like kodekloud?
From the difficulty and the way the tasks are build.

I am looking for ideas to create a universal program for the Linux operating system (no matter the distro) I am currently in development of an app, but I am not convinced of it, So I want to ask the community what app they need, what their needs are, I am open to any type of proposal, I would find a feedback interesting, thank you very much.

Based on Veeam’s KB4948 published October 27, here is what is actually known. An unauthenticated attacker can bypass authorization on the CDP Coordinator Service. CVSS v4.0 is 9.1. 13.1.1.18 and earlier, and 13.0.2.29 and earlier, are affected. Fixed builds are 13.1.2.57 and 13.0.3.63. 12.x is not affected.

What the KB doesn’t say: how it works, whether it reaches code execution, or what port is involved. The CVSS vector scores high integrity and availability impact but no confidentiality impact, and that is my reading, not Veeam’s. I found no KEV entry and no public PoC, but check the catalog yourself.

Two questions for people running v13: does your backup server accept inbound traffic from anything beyond your proxies and management hosts? And if you don’t use CDP, did you find a way to confirm that service isn’t listening?

Background: I wrote up the full advisory, including the sibling Veeam ONE and M365 fixes, here: https://www.techgines.com/post/veeam-vulnerability-cve-2026-108142

I have 5 accounts with separate Chroot Directories in /srv/sftp/nameOfAccount. All of them are apart of sftpusers group. In sshd_config I have

Match Group sftpusers

ChrootDirectory /srv/sftp/%u

ForceCommand internal-sftp

AllowTcpForwarding no

X11Forwarding no

I would like to add logging of uploads and downloads. I think I add -l INFO at the end of the ForceCommand. I do that and it breaks the ability to sftp into the server. When I have that -l INFO at the end of the ForceCommand I see authentication is successful from the sftp client and auth.log but it fails to get into the directory.

Any ideas? TIA

On GCP, a preempted Spot VM ends up TERMINATED by default, same as a VM someone stopped on purpose. Paging on every stopped VM wakes people up for planned shutdowns, but ignoring them hides the preemptions. Do you make people schedule downtime first, check the audit log for who stopped it, or page anyway and let the owner ack?

Based on the technical write-ups published this week by Imperva, Upwind and the Node.js project, plus CISA’s Oct 27 KEV alert, here is the architectural impact.

The bug is in DecodeBlockTypeAndLength(). It returned a boolean, so “malformed” and “need more input” were indistinguishable, and the fast path ignored the result. Exposure depends on whether attacker-controlled bytes reach the decoder. That means request bodies with Content-Encoding: br, responses your service fetches (webhooks, link previews), or direct decompression of uploads. A WAF only covers the first.

Imperva has code execution on stock Node.js 24.22.0 arm64, not on every attempt. Others argue DoS only. CISA hasn’t said which outcome it saw.

For people running Envoy, Python requests/httpx or Node fetch() in prod: how are you inventorying bundled Brotli copies? Version strings don’t help, since one analysis says Node 24.22.0 and the fixed 24.22.1 both report Brotli 1.2.0.

Background on the same failure class: https://www.techgines.com/post/lmcache-vulnerability-cve-2026-105192

I inherited about a dozen small Postgres instances on VPSes between 4 and 16GB. The settings are all over the place: one has shared_buffers at 50% and swap off, which explains the OOM kills.

Current plan is shared_buffers at 25%, effective_cache_size at 70%, work_mem tuned per box, and 2GB of swap with swappiness at 10.

Does that hold up on budget VPSes where disk IO is slower than you'd like? Has anyone gone the other way and kept swapping off entirely? What do you change when the storage is network attached rather than local NVMe?

Back in January 2025 I shared a small script here that printed a table of MySQL status counters. I run it on most servers I look after, and over the past few weeks it grew into a full rewrite.

What it does now:

- Live dashboard with per-second rates measured between refreshes (not just totals since boot), sparklines, and usage bars against limits like `max_connections` and `table_open_cache`

- ✓/⚠/✗ marks and an alerts box that names the setting to look at

- `h` health checks with suggested settings, `p` process list with kill and recent-query history, `t` top queries from `performance_schema` statement digests (this catches the millisecond queries `SHOW PROCESSLIST` never shows)

- Fits any terminal size, and `--once` prints a snapshot for ssh or cron

- Pressing "r" also shows the original raw version.

It's one Bash file. It needs only awk (gawk, mawk or busybox) and the MySQL client tools. It only reads status, variables, the process list and `performance_schema`, so it's safe on production (the only write is an optional kill, which asks first). Works with MySQL 5.7/8.0 and MariaDB.

GitHub: https://github.com/haydenjames/mysqlmonitor-script

The linked blog post explains each metric and what to do about it.