Underground forums share eBPF rootkit code and tutorials
A Russian-language Duty Free guide covers process hiding, magic-packet activation, and AES-256-GCM command-and-control.
Stories per day · 30 days
Relatedkubernetes2linux2agent-observability1ai-agents1bpfdoor1easy-anti-cheat1egress-control1epic-games1gke1google-cloud1linkpro1linux-kernel1llm-agents1remote-attestation1rootkit1runtime-security1secure-boot1security-auditing1
10 stories, newest first · one card per story
Stories tagged #ebpf
Wiz and Google Cloud preview native Wiz Sensor add-on for GKE
GKE Standard and Autopilot can enable the sensor with one flag; credentials stay in Secret Manager.
Paper parks AI-agent pod egress in-kernel until a verifier approves
A 98-instruction eBPF hold adds 4.5 ms median per released connection, with 24 microseconds of that in policy.
AgentLoupe traces agent actions to LLM calls via kernel labels
The eBPF tool keeps causal labels on files and sockets, with average observation overhead below 8%.
Epic's EAC2 v2 seems fairly easily bypassable
Matthew Garrett says Epic's Linux Easy Anti-Cheat 2 attestation can be spoofed with a reset or spare TPM.
4
Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
Framework secures LLM agents on Kubernetes assuming full prompt-injection compromise, mapping seven defense layers to EKS, AKS, and GKE controls.
12 Best Kubernetes Security Tools Compared (2026): Features & Pricing
GBHackers compares 12 Kubernetes security vendors including Sysdig, Wiz, Aqua, and Cisco Isovalent on features, pricing units, and procurement strategy.
5
Autonomy in Check: Governor-Mediated Adaptive Security at the Edge
Split-control architecture adds a deterministic governor to validate LLM and rule-based planner intents before eBPF enforcement at the edge.
A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK
Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.
A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs
eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.