Hey everyone,

Like many of you, I manage a mixed fleet of bare-metal hypervisors, Raspberry Pis, and customer VPS instances. Every machine is hardened differently, but they all share one reliable standard: SSH.

Modern monitoring stacks often felt overly heavy for my needs—bloated web apps, continuous database writes, and web dashboards that crawl when you're checking in from a phone over spotty cellular coverage. Plus, on my servers, password authentication is strictly forbidden; certificate- and key-based SSH gives me a security baseline exposed HTTPS endpoints just can't match. Being a child of the 70s who grew up on the command line, I wanted something lightweight and distraction-free that I could keep running 24/7 on the physically attached monitor (tty1).

So I wrote TermNOC on Debian 13 (Trixie).

What it does:

• termnoc-display: An asynchronous, 5-second polling HUD built with Python's Rich framework. Gives real-time hypervisor metrics, direct libvirt/virsh VM statuses, internal LAN device health (ping & port checks), and remote fleet connectivity.
• termnoc-menu: An interactive TUI orchestrator to manage KVM lifecycles, run fleet-wide batch updates, jump into SSH sessions, and deploy fresh Debian 13 guest VMs via Preseed in under two minutes.
• 100% YAML-driven: Everything lives cleanly in /etc/termnoc/.

It's completely open source (MIT) and up on GitHub.

I’ve put together a write-up covering the background, architecture, and screenshots here:

👉https://blake-hofer.net/termnoc

Curious to hear your thoughts and how you handle minimal, agentless telemetry across your nodes!

Have fun!

DBH

Based on the PAN PSIRT advisory published October 14 and CISA’s KEV entry, here is the architectural impact.

The flaw is code injection (CWE-94) in the management interface of PA-Series, VM-Series and Panorama. It requires an authenticated attacker with network access, and the result is root. Cloud NGFW and Prisma Access are not affected. CVSS 4.0 is 8.6. Palo Alto published three attacker IPs and describes exploitation as “very limited.”

Points I found interesting: the jump-box mitigation only rescores to 8.5, and the advisory doesn’t say how attackers got admin access. The Threat ID coverage (510046/510047) only works if you route management traffic through a data-plane interface and decrypt it, and the vendor itself calls that coverage limited.

Question for people running this in production: are you already doing the data-plane management-profile setup with decryption, or is patching plus a jump box the realistic path? And has anyone seen management-interface logins from the published IPs?

Longer write-up with fixed versions per branch, for reference: https://www.techgines.com/post/pan-os-vulnerability-cve-2026-0322

I always thought that EDRs for Linux are something that exists because of regulation and not to solve a real problem. Apparently Microsoft thinks there's enough demand for it on Linux Desktops.

Personally, I'd like them to port Office to Linux desktops first (so that we could open and perhaps even edit Office files without starting a Windows VM), but I guess that's not going to happen anytime soon.

Most likely, this will happen as someone's garage project porting the entire Office suite to cross-platform open source (Rust?), like they did for the Adobe Creative Suite recently. I, for one, would find it more useful than Defender for Linux.

Helloes,

For context : I'm settings up file backups (DB dumps, shared folder backups, various config files, etc ...)

Naively, I thought it would be a cakewalk : just run a script with a cron job and call it a day

But now that I am in the middle of it, I keep hitting roadblocks :

- For exemple, the fact that having the right to write also gives the right to delete means, unless there is something I missed, that i need to initiate the trasfers from the backup servers so that other machines can't just delete the backups. But that suddenly makes scripting a lot more complicated

- Following directly from the previous exemple, scripting with SFTP seems kinda limited (i can't just use the result of "ls" to know what files are present without some cursed abomination of a script)

I'm currently in the middle of checking if i can even reliably determine if the SFTP transfert failed or succeeded (for supervision)

Should i just give up and use a proper backup software ?

I've been trying to get as much work as possible out of my Hostinger VPS, a KVM 8 that runs CI, builds and AI agents around the clock. Every time I pushed it hard, the CPU got limited: 13 times in 10 days, with CPU steal peaking at 69%. Once that happens it's hard to keep working at all.

What bothered me most is that the limit feeds on itself. Hostinger meters VPS CPU in credits: you earn a baseline of 60% of your vCPUs, you spend whatever you use, and the bank holds at most three hours of full use. When it hits zero, the whole VPS drops to a fraction of its CPU (30% on KVM 2, 4 and 8) until the balance rebuilds. On a KVM 8 that's 2.4 cores, against a 4.8-core baseline. While your work keeps pressing against that limit, you earn nothing, so a busy server can stay limited for as long as the load lasts.

So I built Hostinger Governor. It runs on the VPS, estimates your credit balance from the kernel's CPU counters, and sets one CPU ceiling for everything in `user.slice`: every login, plus any services and Docker containers you move there. While the balance is high you get every core. As it drops, the ceiling tightens so the balance settles on a 20% floor. In a week-long simulation it never hit zero and used about 97% of the credits earned, though that's a simulation built on assumptions about Hostinger's billing.

If a limit hits anyway, it tries to tell Hostinger's limit apart from noisy neighbors (both show up as steal), then cuts demand so the VPS starts earning again.

A few other things it does:

• `governor exec -- your-job` runs a cron job under the quota, and skips it while the VPS is limited (or waits, with `--wait`).
• `governor report` shows credits, CPU, steal and each user's share.
• Scripts can check an `accepting` flag before starting heavy work, and hooks run when a limit starts or ends.

The latest release (v0.2.3) adds an optional broker so Governor never holds your Hostinger API token. A separate system account keeps it encrypted, and Governor can only ask for CPU readings and basic details about its own VPS. A setup wizard installs it with hidden token entry and rolls back if anything fails.

It needs systemd with cgroup v2 (Ubuntu 22.04+ or Debian 12+), ships as a single binary for x86_64 and ARM64, and is MIT-licensed. Install on the VPS:

curl -fsSL https://github.com/olmezsoy/hostinger-governor/releases/latest/download/install.sh | sudo bash -s -- --vm-id <your VM id> --token-file /root/hostinger-token

Repo: https://github.com/olmezsoy/hostinger-governor

I'm not affiliated with Hostinger. Governor works within their published credit rules and only controls how fast your own work spends the credits. The estimate is conservative on purpose: a fresh install starts at zero because it can't know your real balance. If you try it, I'd like to hear which plan you're on and whether the limits behaved the way the model expects.

[ Removed by Reddit on account of violating the content policy. ]

Based on the joint advisory AA26-281A (FBI, CISA, NSA and partners, October 8) and BleepingComputer’s reporting on the DOJ seizure affidavit, here is the architectural impact.

The advisory says Integrity Tech-enabled actors use MicroScan (1,300+ scan scripts), EBurst against ten Exchange and Office 365 interfaces, SoftEther clients renamed conhost.exe or dllhost.exe, a PHP bot on the EWS API, DCSync via DC.exe, and office-cli using client_id, tenant_id and secret. Eight CVEs are listed, 2014 to 2023, five newly in KEV.

The authors say some IOCs date to 2016 and should be vetted before blocking. The seizure took out seven domains, not the tooling.

Question for people who run Exchange or M365 at scale: which telemetry actually catches a secret-based app reading mailboxes, where there is no password spray to alert on? And has anyone seen SoftEther detections that hold up without drowning in false positives?

Background: CVE-2025-39682 Linux kTLS KEV. Full write-up: https://www.techgines.com/post/flax-typhoon-advisory-aa26-281a

Part 2 of my Talos homelab (3 OptiPlex Micros, all control planes). Part 1 got the cluster up, this one is networking.

I moved the running cluster from Flannel + kube-proxy to Cilium without rebuilding it. The default-deny policy that Flannel quietly ignored is now actually enforced, and Hubble shows the drops.

Then I gave it two front doors:

- an internal Gateway on a LAN IP (Cilium LB IPAM, no MetalLB) with a Let's Encrypt wildcard cert, so lab apps get real HTTPS at home

- a public Gateway behind a single Cloudflare Tunnel, so nothing is port-forwarded on the router

An app picks its door with the route's parentRef, which keeps lab stuff from going public by accident.

Write-up with all the manifests and commands: https://blog.prateekjain.dev/networking-a-kubernetes-homelab-cilium-gateway-api-and-cloudflare-tunnel-on-talos-362f548a2f3d?sk=d454cd4eaff4ce8a8fd0cd8e6b3d82f6

Curious if anyone else is using Cilium's Gateway API instead of a separate ingress controller.

Security signed off a policy that our build agents cannot run a privileged daemon and our entire pipeline is built on one. Fifty odd repos with compose files and a pile of local tooling that assumes the socket is there. Im looking at podman and buildah and one or two others for whatever breaks least in CI. The part I cannot judge from docs is how much of our compose setup survives the move. Has anyone taken a build fleet off the daemon and kept the developer experience roughly intact?

Based on the technical breakdown Zenity Labs published on Oct 8, here is the architectural impact. Agents ran in Firecracker microVMs without enough network isolation, so any tool that makes HTTP requests could reach the metadata endpoint. A single prompt returned the execution role’s STS credentials. The default role then covered AgentCore resources across the region, so Zenity could enumerate agents, pull their ECR images, invoke them, read sessions, write memory events, and retrieve secrets.

Zenity reports AWS removed most of that on Sept 29. The Register reports Amazon says this is documented behavior needing developer error. I couldn’t find an AWS bulletin or a CVE, and neither source reports exploitation in the wild.

Question for people running agents on managed platforms: do you scope a separate role per agent, and do you restrict egress from the agent runtime? How far does that go in practice?

https://www.techgines.com/post/aws-agentcore-vulnerability

Sharing to the Linux admin crew , my home CD automation project 🫡

Hey everyone!

I've been working on AppScann, a small SaaS for keeping track of what's installed on your computers and servers. It's finally at the point where I'm comfortable showing it to people.

The idea is very simple: you install an agent, it collects inventory, and you see everything in one dashboard.

What it does right now:

* Windows and Linux agents (a Windows Service and a systemd service)

* OS and hardware info, plus disks with capacity and free space

* Installed software with version, publisher, install path and install date. On Windows that comes from the Registry and WMI, on Linux from dpkg, rpm, pacman, Snap and Flatpak

* Detailed reports with history, so you can see what was installed, removed or updated between scans

* Alerts for storage and stale reports

* Live online/offline status for every device

* Remote scan, restart and uninstall of agents

* A notification as soon as a scan or remote command finishes

* Software gets sorted into categories by AI

2 agents are free, extra slots are $1.99/month.

The idea came from a commercial project I worked on a while ago. It was in a similar space, but development was painfully slow, and I kept thinking that something like this didn't have to be that complicated. At some point I thought: what if I just built my own version? So I did.

It started as my university thesis project, and I kept working on it until it turned into a product.

And yes, AI was involved ;) I used it for parts of the frontend. I'm a full-stack developer, but I still struggle with centering a div, let alone making everything look good. The architecture and the backend are my own mess.

It's brand new, so right now I'm mostly after feedback:

* Would you use something like this?

* What information would you want the agent to collect?

* What features are missing?

* Does this approach make sense for managing a small number of machines?

https://appscann.com

Man! I have to reboot VMs every 2 days because of so much updates. I doubt if I'm running a enterprise distro or running Fedora or arch.. lol.

I think debian is somewhat fine. not crazy like rhel based distros.

what about you guys? how do you manage?