I have been applying a fix for the recently reported 8 compromised certificates and figured I'd share the script I'm using.

Designed for RH and clones, I'll share it as a text file you can review before you rename and apply. It's a simple script based directly on the disclosure page linked to that I found after the original article here on reddit.

I hope it helps, here is distrust.sh - downloaded as a .txt file you can read/review before renaming to distrust.sh and running it as /bin/bash distrust.sh. If your system isn't vulnerable it does nothing.

The champions of the new [KDE Goals](https://kde.org/goals/) for the 2026-2028 cycle will be answering your questions live!

They are working o making KDE a more viable choice for businesses and public institutions by improving enterprise features such as centralized authentication, network management, system administration, and remote access. In the long-term, the idea is to build enough demand for enterprise distributions to bring Plasma and the KDE software stack back into the offerings of enterprise distributions.

More info in the [full proposal](https://invent.kde.org/teams/goals/goal-setting/2026/-/work_items/5)

Leave your questions in the comments or in the [KDE Forum post](https://discuss.kde.org/t/kde-goals-ask-the-champions/51167)!

The champions will answer them live on on [Youtube](https://www.youtube.com/watch?v=_mDII0UwFUE) and [Peertube](https://tube.kockatoo.org/w/9PxMoZTEXWNYvZKmS1Zg7E) on **October 29 at at 17:00 UTC**.

Two weeks ago we found out someone had cloned a client’s storefront from its public case-study repo (typo in my comment included) and added a fake crypto checkout step to steal wallet seed phrases. The VPS host only sent an auto-reply and the clone stayed up for days, so ive moved the client to a stack I control, using BeAdmin to see what's exposed, has anyone else had a client site copied and turned into a scam like this? How did you get it taken down?

If you run a PHP web server, prioritize the security fixes for CVE-2026-109618 and CVE-2026-109619. PHP-FPM is affected too.

Update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or newer), or confirm that your distribution/vendor package includes the backported fixes.

After patching, restart PHP-FPM or the relevant PHP-serving processes. Verify the version or patched package actually handling web requests: `php -v` only checks the CLI and may not match your web runtime. Check every installed PHP version and FPM pool, and remove any temporary public diagnostic files afterward.

Updating WordPress or another CMS is not enough. Configuration changes are only partial mitigations, not a replacement for the patch.

Our shared host went down for 6 hours during a clients sale, no root access, no backups even the support took like 3 hours to reply. Told my partner we should move onto our own VPS and run it ourselves but he digressed. he used HestiaCP as a middle ground, still one box + babysittin it solo tho, so I spun up a test VPS this weekend and put beadmin on it, backups, cron, firewall, all through separate modules had 3 client sites live on it by Sunday night, hes still not sold. Anyone moved a small shop off shared hosting onto ur own box??

Hi all,

I'm a new sysadmin and I've been tasked with evaluating Linux patch management solutions. Looking for real-world experience before we start a PoC.

Our environment:

- Mostly Ubuntu and Oracle Linux servers (we may standardize on one distro in the future, but that's undecided)

- Running on VMware

- Regulated industry, so audit reporting, change control and staged rollouts (Dev → Test → Prod) matter a lot

- Budget is not the main constraint; we prefer a supported commercial product

What I've shortlisted so far:

- SUSE Multi-Linux Manager (supports both Ubuntu and Oracle Linux)

- Red Hat Satellite + Ansible (but Ubuntu support seems limited)

- Canonical Landscape (Ubuntu only)

- Tanium / HCL BigFix (cross-platform)

Questions:

1. If you run a mixed Ubuntu + Oracle Linux fleet, what do you use and would you choose it again?
2. Anyone running SUSE Multi-Linux Manager (or Uyuni) with Ubuntu clients in production? How stable is Debian/Ubuntu support compared to RPM-based distros?
3. How do you handle CVE reporting and audit evidence for regulators?
4. Is a full platform worth it, or is a local mirror + Ansible + good reporting enough at a few hundred servers?

Any gotchas, horror stories or lessons learned are very welcome. Thanks!

Hey everyone,

I have a 30-minute interview coming up for a Software Support Engineer position at a defense contractor, and I'm trying to prepare as thoroughly as possible.

The recruiter mentioned there won't be a formal technical assessment, but I still want to be ready for any technical questions or troubleshooting scenarios.

For background, I currently work in cloud/data center infrastructure operations, where I use Linux, Python, and Bash for diagnostics, troubleshooting, and automation. I also have experience developing software applications, working with REST APIs, automated testing, and CI/CD.

Here's the relevant job description:

Responsibilities:

• Support lab tooling and version control through CI/CD pipelines.
• Create and deploy test scripts.
• Support and troubleshoot software deployments on custom servers.
• Support configuration management processes.
• Develop unit tests and tailor rule sets.

Required qualifications:

• Bachelor's degree in CS, Computer Engineering, or a related technical field.
• 2+ years of relevant experience.
• Experience with Python and Bash.
• Ability to independently and collaboratively solve complex technical problems.

Preferred qualifications:

• Knowledge of CI/CD pipelines.
• Experience with GitLab.
• Experience with Linux and NFTables.

I'm particularly interested in moving toward DevOps/platform engineering, so this seems like a great opportunity.

For anyone working in DevOps, Linux administration, software integration, or similar roles:

1. What technical questions would you expect in an interview for this position?
2. What Linux troubleshooting scenarios should I be prepared to walk through?
3. How deeply should I study GitLab CI/CD, unit testing, and NFTables?
4. Does this sound more like DevOps, software integration, or traditional software support?
5. If you were interviewing a candidate for this role, what would you want them to demonstrate?

I'm not looking for shortcuts or leaked interview questions. I genuinely want to understand the technical expectations and make sure I can speak confidently about the work.

Appreciate any advice!

Based on Forescout’s Vedere Labs ROMULUS write-up (Oct 15) and Siemens’ exploitation notice, as relayed by SecurityWeek on Oct 19. I haven’t read Siemens’ pages directly, so check their IoC list.

Siemens says attackers bundled a genuine, validly signed Software Center with their own DLLs, and the app loaded them from its own folder. Siemens linked it to ROMULUS, and Forescout couldn’t say who runs it. Earlier Huntress reporting showed the same side-loading pattern with Canon and Stardock binaries, with the loader and RAT unchanged between those two.

Siemens itself says to hunt on behavior and folders, not hashes. That makes publisher-signature allow rules the weak spot. One thing I couldn’t establish: whether the old bundled build would auto-update before loading the planted DLLs.

How are you detecting “signed binary running from a user-writable path with unsigned DLLs beside it” without drowning in false positives from legitimate per-user installers?

Footnote, writeup with the hunt checklist: https://www.techgines.com/post/siemens-software-center-vulnerability-cve-2026-110936

Mix of EC2 and a few bare-metal boxes running Kubernetes, maybe 25 clusters, mostly Debian under the hood. Platform team of three and I'm the one who ended up owning security. The thing I keep getting stuck on: a process inside a container opens an outbound connection to something it hasn't talked to before. Sometimes that's a real signal. Most of the time it's a new dependency, a mirror that changed, a sidecar someone added, or a job that only runs monthly and looks new every time.

We've got basic egress logging via VPC flow logs plus some Falco rules for unexpected network activity. The Falco side is drowning us. Every deploy churns the baseline and we get a wave of "new connection" alerts that are 95% noise. I've tried maintaining allowlists per workload but it rots the second someone bumps a chart version.

What I'm actually trying to answer is: for a given process making an outbound connection, is this connection new for that process/image, and has it been seen before across the fleet, so I can tell drift from a genuine first-time behaviour. Ideally scoped to the binary and image rather than the pod, which is ephemeral. Someone on another team showed me Upwind's runtime view, which says it baselines per image, but I haven't seen how it holds up on real traffic.

How are people doing this without hand-maintaining baselines? Is the answer eBPF with some kind of learned baseline per workload, or is everyone just accepting the noise and triaging? Curious what's actually working in production vs what sounds good on paper.

Warpgate is a FOSS bastion-style PAM that needs neither a client app nor a server-side agent. It's an alternative to Teleport/StrongDM/Hashicorp Boundary: https://warpgate.null.page/

After a turbulent month of development I'm proud to publish Warpgate 0.30 - adding a few of the most requested features

* Vault/OpenBao support as secrest stores - integrated into target options (reference passwords and private keys)

* Short-lived SSH certificate authentication for targets - issued by Vault/OpenBao

This allows you to decouple target credential management from Warpgate itself and rotate secrets centrally.

My focus for the next release is most likely going to be building a full IaC / GitOps workflow - if you're interested, consider chiming in at https://github.com/warp-tech/warpgate/discussions/2482

Full release notes: https://github.com/warp-tech/warpgate/releases/tag/v0.30.0

Hi all,

I'm planning to take the RHCSA (EX200) and would really appreciate advice from people who've passed it. I have some Linux experience and I've written a few scripts, but I haven't done much formal sysadmin work (storage, SELinux, firewalld, Podman, etc.).

My budget is a bit tight. I'm planning to set up a free RHEL 10 VM through a Red Hat Developer account and practice in VirtualBox, using the official exam objectives as my checklist.

I'd love to hear:

1. Which cheap or free resources (Udemy courses, YouTube channels, books, GitHub labs) actually helped you pass, and which were a waste of time?

2. Are there good mock exams for RHEL 10 specifically? I've seen a few on Udemy but can't tell which are accurate.

3. How long did you study, and what do you wish you'd practised more?

4. Any tips for the exam itself?

Thanks in advance. Any advice is really appreciated!