Linux Tricks

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products https://github.com/DepthFirstDisclosures/Nginx-Rift

AI Just Changed Security Forever Something major happened in March 2026 that nobody saw coming. What's happening: AI agents are now finding 5-10 real Linux zero-day vulnerabilities EVERY DAY They're no longer producing junk reports — they're finding actual critical bugs Human maintainers can't keep up with reviewing them all The numbers: GitHub hit 14 billion commits in 2026 Security researchers are overwhelmed Companies like Anthropic and OpenAI have AI systems running 24/7 hunting for vulnerabilities Why this matters: Bad actors could use the same AI to find vulnerabilities before they're patched Open-source maintainers are facing a "review crisis" — too many reports to check The race is on: who finds the bugs first? The bottom line: AI is now better than humans at finding security holes. This is both exciting and terrifying. Read more: https://aiforautomation.io/news/2026-04-05-ai-agents-just-cracked-open-source-security-linux-zero-days #ai #security #zeroday #devsecops #cybersecurity #infosec

Very important security warning Version 1.82.8 of the litellm package is compromised and is actively collecting sensitive system data without your knowledge and sending it to an external server. This is a serious Supply Chain Attack and must be treated as…

Very important security warning Version 1.82.8 of the litellm package is compromised and is actively collecting sensitive system data without your knowledge and sending it to an external server. This is a serious Supply Chain Attack and must be treated as critical. The dangerous part: This does NOT require import litellm The package includes a malicious file named litellm_init.pth inside site-packages. .pth files in site-packages are automatically executed when the Python interpreter starts (via the site module), so the payload runs silently in the background. —- What data can be stolen? (According to this report) 1. SSH keys 2. API keys and passwords (from environment variables) 3. AWS / Azure / GCP credentials 4. Kubernetes configs and service tokens 5. Docker and package manager configs 6. bash, zsh, MySQL, Redis histories 7. system and network information 8. CI/CD configs and secrets 9. SSL/TLS private keys This malware aggressively scans common paths and config files to collect as much sensitive data as possible. All collected data is encrypted (AES-256) and the key is secured using RSA, then sent to an external server: https://models.litellm.cloud/ Note: this domain is NOT the official litellm domain. —- If you have installed this version: 1. Check if this file exists: site-packages/litellm_init.pth Also check: - virtualenvs - user site-packages (~/.local/...) - system-wide Python paths 2. If found, you should IMMEDIATELY: * rotate ALL API keys * generate new SSH keys * rotate cloud credentials * revoke tokens and sessions * review access logs and unusual outbound traffic 3. Remove the package and upgrade to a safe version —— Important: Other versions may also be affected. Do NOT assume only 1.82.8 is impacted. —- This is a strong reminder: No dependency should ever be fully trusted, even if it is popular. —- Discovery date: March 24, 2026 Source: https://github.com/BerriAI/litellm/issues/24512 #security #python

Save Docker Images with Compression Save space by compressing your Docker images. Without compression, using docker save alone creates a raw tar file that takes up the full size of all image layers combined. This can quickly eat up disk space, makes transfers slower, and wastes bandwidth when sharing images with teammates. For large images, an uncompressed tar file can be several gigabytes, making it impractical to store or send. gzip (fast): docker save nginx:latest | gzip > nginx.tar.gz bzip2 (smaller file): docker save nginx:latest | bzip2 > nginx.tar.bz2 Load gzip: gunzip -c nginx.tar.gz | docker load Load bzip2: bunzip2 -c nginx.tar.bz2 | docker load Pick gzip for speed, bzip2 for smaller files. Real example: A 17.4GB DevDocs image compressed down to just 3.4GB with bzip2. That's an 80% reduction in size! @linuxtricks #docker #compress

Last week my Suse Linux had a long boot time, when this problem occurred, you can see what takes so long on the boot screen by pressing ESC key or debug it using the following command: systemd-analyze blame

The best habit is taking notes for every fix you apply. Not a big document. Just an application, a short file, or a small wiki, or a markdown note. I strongly recommend, using Joplin: https://github.com/laurent22/joplin It could integrate with S3 and you can have your notes, every where. Write: 1. what broke 2. the exact command you used 3. why it worked This prevents repeat mistakes and saves hours of debugging in the future. This is how you grow fast. This is how you stay sharp.

What’s Air? A CLI tool for Go that watches your code, rebuilds, and restart the app(Go program) automatically. Attention: It’s for development, not production. Quick install: With Go 1.25+: go install github.com/air-verse/air@latest Getting started: Go to your project root: cd /path/to/project Init default config: air init Run: air Or use a config file: air -c .air.toml Pros: Colorful logs, customizable build/run commands Exclude folders from watching Docker/Podman friendly (image: cosmtrek/air) Cons: Dev-only, not a production hot-deploy Rebuild time on large projects Might need PATH/GOPATH fixes if “air” isn’t found GPLv3 license (FYI) GithuB #golang #develop_in_linux #go

Deploying Leader-Worker Pods Easily with LeaderWorkerSet (LWS) The kubernetes-sigs/lws (LeaderWorkerSet) project provides an API for Kubernetes that lets you deploy and manage a group of pods as a single unit of replication. It is especially useful for scenarios…

Deploying Leader-Worker Pods Easily with LeaderWorkerSet (LWS) The kubernetes-sigs/lws (LeaderWorkerSet) project provides an API for Kubernetes that lets you deploy and manage a group of pods as a single unit of replication. It is especially useful for scenarios where you need to run multiple pods with different roles (such as leader and worker) in a coordinated and manageable way. The main goal is to simplify deployment and management of complex workloads in Kubernetes. More info: https://github.com/kubernetes-sigs/lws Project site: https://lws.sigs.k8s.io #kubernetes

A Simple Command to Trigger SCSI Bus Rescan and List Block Devices It's useful for detecting new hard drives in Linux for host_dir in `ls /sys/class/scsi_host/*`; do echo $host_dir;echo "- - -" > $host_dir/scan;ls /dev/sd*; done #linux #disk #vmware

Skopeo This tool is used for working with remote image registeries. e.g: 1. Copy an image from one registry to a private registry skopeo copy docker://docker.io/library/nginx:latest docker://registry.example.com/nginx:latest 2. Delete an image: skopeo delete docker://registry.example.com/nginx:latest 3. Inspect image details skopeo inspect docker://docker.io/library/nginx:latest 4. List tags of an image skopeo list-tags docker://docker.io/nginx 5. Sync all tags of an image to a USB skopeo sync --src docker --dest dir registry.example.com/busybox /media/usb The above command downloads all tags of the busybox image to the /media/usb directory. more info: https://github.com/containers/skopeo?tab=readme-ov-file #docker

Krew is the plugin manager for the kubectl command-line tool. With Krew, you can easily manage over 100 kubectl plugins currently distributed. Here is a list of kubectl plugins: https://krew.sigs.k8s.io/plugins/ Installation: https://krew.sigs.k8s.io/docs/user-guide/setup/install/ Here is top 5 Kubectl plugins: 1. kubectx and kubens: These tools allow you to switch between contexts (clusters) and namespaces via kubectl faster. https://github.com/ahmetb/kubectx 2. Ingress-nginx: This is the second most popular kubectl plugin. https://kubernetes.github.io/ingress-nginx/kubectl-plugin/ 3. Cert-manager: This plugin helps you automate the management and issuance of TLS certificates from various issuing sources. https://github.com/cert-manager/cert-manager 4. Popeye: Popeye is a utility that scans live Kubernetes cluster and reports potential issues with deployed resources and configurations. https://popeyecli.io/ 5. Kyverno: Kyverno is a policy engine designed for Kubernetes. https://github.com/kyverno/kyverno ------------------- #kubernetes #kubectl

Have you ever encountered an error like this when using crictl with containerd? FATA[0000] listing containers: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directory" This error occurs because crictl is trying to connect to Docker, but Docker isn’t running or installed. If you’re using containerd, you need to tell crictl to use it instead. Create or modify the crictl configuration file, typically located at /etc/crictl.yaml vim /etc/crictl.yaml Then add the following lines to it: runtime-endpoint: unix:///run/containerd/containerd.sock image-endpoint: unix:///run/containerd/containerd.sock timeout: 10 debug: false Run again crictl ps , that’s it! #containerd

#useful_commands bandwhich is a command-line utility that provides real-time, comprehensive insights into your network usage. It's written in Rust and can display network usage by process, connection, or remote IP/hostname. Here are some of the things you can do with bandwhich: - Display only the remote addresses table: bandwhich --addresses` - Show DNS queries: bandwhich --show-dns - Show total (cumulative) usage: bandwhich --total-utilization - Monitor a specific network interface: bandwhich --interface eth0 - Show DNS queries with a given DNS server: bandwhich --show-dns --dns-server dns_server_ip https://github.com/imsnif/bandwhich

🔐 Secure your Kubernetes! Install kube-hunter with: pip install kube-hunter Run it with kube-hunter and choose your scan. In the attached screen shot, i selected "Interface scanning", and it detected a vulnerability on my "kind cluster" #Kubernetes #Security

Download multiple files from a list of urls using curl 1.1 create a file with the list of urls, e.g. urls.txt: https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-12.2.0-amd64-netinst.iso https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-edu-12.2.0-amd64-netinst.iso https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-mac-12.2.0-amd64-netinst.iso With xargs ``` xargs -n 1 curl -O < urls.txt ``` with for ``` for url in $(cat urls.txt); do curl -O $url; done ``` With while ``` while read url; do curl -O $url; done < urls.txt ``` #curl @linuxtricks

*should better alternative to GNU/Linux core commands

This table shows the Unix file permissions and their corresponding binary values. The first column represents the permission code, while the second and third columns represent the readable (unix decimal) and writeable (binary equivalent) modes of the file respectively. The last column displays the Kubernetes configMaps default mode for each permission level. #Kubernetes #Linux here is Stackoverflow URL: https://stackoverflow.com/questions/73365727/mounting-a-configmap-as-a-volume-in-kubernetes-how-do-i-calculate-the-value-of

AWK is a powerful command line tool for manipulating and filtering text in Linux. It can be used to extract certain data from files, matching patterns, performing calculations on text, and making decisions based on the results of these calculations, Here…