grsecurity (@grsecurity) profile picture

grsecurity

@grsecurity

Foundational security for the Linux kernel. Solving the most difficult memory unsafety problems. Created by @opensrcsec

grsecurity.net
Joined June 2012
  • Tweets3.6K
  • Following1
  • Followers9K
279Media
Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)Photo by grsecurity (@grsecurity)
It's now available!
grsecurity (@grsecurity) profile picturegrsecurity@grsecurityNov 1
We expect our 7.2 beta to be available for testing within the next two weeks.
1
7
892
grsecurity retweeted
GCC Rust (@gcc_rust) profile picture
GCC Rust@gcc_rustNov 3
New gccrs report for October: rust-gcc.github.io/2026/11/0…
5
6
556
We expect our 7.2 beta to be available for testing within the next two weeks.
2
1
3
1,613
All affected users must patch against php2shell (CVE-2026-109618 / CVE-2026-109619). Due to the nature of some of the primitives involved, ASLR is not effective and arbitrary code execution/reuse/filesystem-level execution isn't a necessary component of exploitation in this case.
3
12
1,176
grsecurity retweeted
Calif (@calif_io) profile picture
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
Image from Calif (@calif_io)
19
250
29
783
189,218
KERNSEAL™ is now officially KERNSEAL®
3
11
1,426
It's now available to beta testers!
grsecurity (@grsecurity) profile picturegrsecurity@grsecurityAug 15
We expect our 7.1 beta to be available for testing within the next two weeks.
2
5
1,430
We expect our 7.1 beta to be available for testing within the next two weeks.
2
1
10
3,402
If you're just now hearing about GhostLock and looking to fix it, make sure you don't introduce two unpriv-reachable DoSes associated with its fixes. The fix the Linux CNA lists for CVE-2026-43499 introduces a NULL deref, which caused CVE-2026-53166 to be issued. Unfortunately...
1
5
18
3,284
the fix referenced by that CVE introduces a worse DoS (busy loops on all CPUs in the kernel), and has no CVE yet to inform users. We discovered this second DoS early last month through routine inspection. Our recommendation:
1
1
6
1,063
Apply the initial fix: git.kernel.org/pub/scm/linux… Ignore the fix for CVE-2026-53166 which introduced the worse DoS and was reverted just recently: git.kernel.org/pub/scm/linux… Apply this fix which addressed the same initial DoS issue without introducing another: git.kernel.org/pub/scm/linux…
1
8
801
KERNSEAL makes the linear page cache overflow in cyberstan.co.uk/fuse-readdir… deterministically unexploitable. Serial log below 👇
Image from grsecurity (@grsecurity)
9
29
2,806
It's now available!
grsecurity (@grsecurity) profile picturegrsecurity@grsecurityJun 3
We expect our 7.0 beta to be available for testing within the next two weeks.
4
5
2,055
We expect our 7.0 beta to be available for testing within the next two weeks.
1
1
8
3,539
Exploits are now appearing targeting pidfd, which is forced into all Linux kernels since 5.10 (2020), no module or initcall to blacklist this time, must patch ASAP!
grsecurity (@grsecurity) profile picturegrsecurity@grsecurityMay 14
We've just sent a detailed mail to all customers notifying them of this issue, with split-out fixes available for 5.15, 6.6, and 6.18. We'll share more information on our Knowledge Base as it becomes available.
2
30
5
112
25,353
Correcting the above: in terms of LTS kernels it's 5.10+, but the 2020 commit came in Linux 5.6 (so would affect for instance some Ubuntu 20.04 kernels as well on 5.8)
1
2
1,275
As mentioned at openwall.com/lists/oss-secur… , distro users can echo 2 > /proc/sys/kernel/yama/ptrace_scope to mitigate. Keep in mind this will break some normal usage, like preventing unprivileged use of strace, gdb, etc entirely.
1
1
847
We don't recommend the '3' setting (which rejects all attach-like ptrace_may_access() requests, regardless of privilege level) as once set, it is locked to that value until reboot.
610
We've just published a Knowledge Base article with more information about the vulnerability, current published/unpublished exploits, and current mitigations. We still recommend patching ASAP.
grsecurity (@grsecurity) profile picturegrsecurity@grsecurityMay 14
Exploits are now appearing targeting pidfd, which is forced into all Linux kernels since 5.10 (2020), no module or initcall to blacklist this time, must patch ASAP!
2
3
13
4,015
Load more