Writing
linux privilege escalation
2 articles on this subject.
Linux capabilities: root privileges without the SUID bit, and the container escape they enable
Capabilities split root into 40+ pieces, and about a dozen of them are still root. Which ones matter, how CVE-2022-0492 turned a cgroup detail into a container escape, and how to audit a host and an image.
7 min read
Sudo is a shell in disguise: CVE-2025-32463, GTFOBins, and reading sudo -l properly
A 9.3 in sudo itself, plus twenty ways a single sudoers line hands over root. How to read sudo -l like an attacker, why the chroot bug worked, and what a safe sudoers policy looks like.
7 min read