A technical case study on defending Linux kernel zero-days (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) without downtime using layered compensating controls including eBPF telemetry, kernel module disarmament, and user namespaces. The framework bridges the 7–21 day gap between public vulnerability disclosure and vendor patch availability by combining syscall gating, module eviction/sealing, and automated remediation pipelines.
A blog post exploring software sandboxing fundamentals, discussing the challenges of implementing privilege restriction mechanisms in software without administrative authority. The author shares experiences from work on Emilua, examining traditional UNIX approaches and modern OS interfaces like Capsicum and Seccomp, while cautioning against insecure practices like suid binaries.