#Execve
LightNews LightNews
d-philla.bsky.social
Ppl so concerned with data centers and resource usage and ai

But, what I've learned in the last several years is that things like the fork() + execve() and setjmp() and longjmp() have probably wasted more energy than anything else in human history
November 8, 2026 at 6:25 PM
hugovalters.bsky.social
Catch setuid/setgid binary execution in containers with this Falco rule. Watches proc.is_suid_exe/is_sgid_exe on execve to flag privilege escalation attempts like SUID-root tools. https://www.valtersit.com/vault/detect-privilege-escalation-via-setuid-binary-execution-468292/
Detect Privilege Escalation via setuid Binary Execution
www.valtersit.com
November 4, 2026 at 3:30 AM
hugovalters.bsky.social
Falco rules to catch cryptojacking: match miner binaries via proc.name/cmdline, flag outbound connects to mining pool ports on net_connect. Runs on execve+connect syscalls. https://www.valtersit.com/vault/detect-crypto-miner-process-names-and-mining-pool-connection-0c754b/
Detect Crypto Miner Process Names and Mining Pool Connections
www.valtersit.com
November 4, 2026 at 9:50 AM
williamincyber.bsky.social
The audit records provided useful details:

SYSCALL: Operation and result
EXECVE: Command execution
PATH: Affected file

The recorded operation showed success=yes.

But successful activity isn't automatically malicious. I still need the user, process and context.
October 26, 2026 at 5:12 PM
kerneldispatch.bsky.social
Linux mainline: week of Oct 19

A weekly briefing built from 9 published daily update(s).

#ACPI #ConfidentialComputing #Execve #Ksmbd #KVM #RCU #SchedExt #Vfs

https://kerneldispatch.com/posts/weekly-2026-10-19
October 26, 2026 at 2:28 PM
joh.dev
you *can* control execve syscall more directly instead of "shelling out" in php, but last time I checked it is obscure and no php dev does it.
October 25, 2026 at 9:38 AM
devops-daily.com
What happens when you type ls, in 68 seconds: $PATH lookup, fork(), execve(), shared libraries, syscalls, write() to your terminal, and a brief zombie.

Run strace ls to see every step yourself.

Learn Linux in your browser: devops-daily.com/games/linux-terminal
October 21, 2026 at 1:02 PM
hugovalters.bsky.social
Capture execve, connect, and setuid syscalls with kernel audit rules. Tune auditctl backlog limits and rate limits to prevent dropped events under high load. #auditd #auditctl #ValtersIT

https://www.valtersit.com/vault/kernellevel-execve-auditing-with-auditctl-rules-and-backlog--128f24/
October 18, 2026 at 7:21 AM
gwollman.bsky.social
You can absolutely make FreeBSD jails with a single binary, if that's a thing you want to do. Literally all jail startup does is execve(3) the command you specify, whether it's `/etc/rc start` or something bespoke, your choice.
October 17, 2026 at 10:08 PM
millsdev.bsky.social
Do you keep a small executable case for the execve assumption alongside that taxonomy? I'd want the next session to run it, rather than merely agree with the corrected prose.
October 17, 2026 at 9:34 PM
lippard.org
I don't give Claude access to my systems so it only runs its own tests in Linux (and anything I'm doing with Multics PL/I also involves running test suites myself). In C, OpenBSD pledge can carry over execve with pledge execpromises, which are likely to be removed, but perl never supported them.
October 17, 2026 at 11:14 PM
lippard.org
It took me multiple attempts to get Claude to stop claiming that pledge and unveil persist over execve calls in perl code, which they do not and never have. It's not a sandbox for running untrusted code, it's tools for limiting the blast radius of potential vulnerabilities in your own code.
October 17, 2026 at 12:35 AM
geeknewsbot.bsky.social
C에서 이름을 쓰지 않고 함수 호출하기

학교의 C 코드 자동 채점 환경에서 허용 함수 검사 를 우회해 execve 심볼을 직접 쓰지 않고 셸을 실행하는 개념 증명에 성공함 ASLR 은 메모리 배치 주소를 바꾸지만 같은 세그먼트 안의 함수 간 상대 위치는 유지하므로, 허용된 함수의 주소와 미리 알...
C에서 이름을 쓰지 않고 함수 호출하기
학교의 C 코드 자동 채점 환경에서 허용 함수 검사 를 우회해 execve 심볼을 직접 쓰지 않고 셸을 실행하는 개념 증명에 성공함 ASLR 은 메모리 배치 주소를 바꾸지만 같은 세그먼트 안의 함수 간 상대 위치는 유지하므로, 허용된 함수의 주소와 미리 알...
news.hada.io
October 8, 2026 at 10:00 AM
andreww591.bsky.social
execve() functions more like execvpe(), looking up programs from the internal table rather than just looking them up normally in the filesystem as in basically every other Unix. I'm assuming this is to allow it to load binaries from a TFTP server,
which doesn't support directory listing.
October 2, 2026 at 11:08 AM
patrick-ohlson.ms-dot.net
It's alive

GPUManager auto deployed job

Unsloth

models--Blackfrost-AI--GLM-5.3-Flash-DERISKED-GGUF

4 A100 SXM4 320 GB VRAM 1002 GB RAM

Vast AI

Tested a simple tcp shellcode

Friday can continue🔥
You should see it report 86 bytes, which is small for a fully functional bind shell. Notes: Changing the port: the value 0x7a690002 packs AF_INET (2), the port in network byte order (htons(31337) = 0x7a69), and 0.0.0.0. Patch those bytes for a different port. One connection only: classic shellcode does a single accept then execve, so the process becomes the shell — when you exit, it's gone. The C version's fork() loop supports reconnects, but that costs extra bytes; most in-the-wild payloads skip it. Null bytes: this payload contains a couple of \x00 bytes, which is fine for mmap-style loaders like above. If you ever need a strictly null-free payload (for strcpy-style injection), there are variants using the push rdx + "/bin//sh" trick — ask and I'll write one. The industry shortcut: msfvenom -p linux/x64/shell_bind_tcp LPORT=31337 -f c generates an equivalent, and shell-storm.org's shellcode database is great for studying hand-optimized variants.
October 2, 2026 at 3:45 PM
euvd-bot.bsky.social
🚨 EUVD-2026-84164
📊 6.3/10
🏢 1Panel-dev

📝 MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execve...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84164

#cybersecurity #infosec #cve #euvd
September 25, 2026 at 12:01 AM
hugovalters.bsky.social
Catch attackers spawning bash inside Kubernetes pods with a custom Falco rule using eBPF to intercept execve in real time. Full how-to: https://www.valtersit.com/vault/detecting-interactive-shell-executions-in-kubernetes-contain-32df8d/ #falco #kubernetes #runtime-security
Detecting Interactive Shell Executions in Kubernetes Containers via Falco Rule
www.valtersit.com
September 24, 2026 at 7:30 AM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 5:39 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 5:38 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 5:19 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 5:17 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 4:41 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 19, 2026 at 4:35 PM
hugovalters.bsky.social
Use ausearch to trace execve calls tied to root escalation and setuid binaries in auditd logs on RHEL/Ubuntu. Fast, precise threat hunting.

https://www.valtersit.com/vault/search-linux-audit-logs-for-unauthorized-execution-and-privi-a87b5f/

#auditd #security #ValtersIT
September 16, 2026 at 3:00 PM
bartoszosiej.bsky.social
Behavioural eBPF tracing (execve/openat + per-CPU perf buffers) catches ransomware by the shape of its damage. The hard part: not crying wolf on every cargo build. #eBPF #Rust #Security

https://bartoszosiej.github.io/content/ebpf-ransomware-monitor-lessons
Catching ransomware with eBPF: what execve/openat tracing taught me about false positives
Lessons from building talus-process-monitor, a Rust + eBPF ransomware detector: per-CPU perf buffers, behavioural pattern matching, and why build systems are a detector's worst enemy.
bartoszosiej.github.io
September 16, 2026 at 5:48 PM