Detection Engineering

Detecting copyfail (CVE-2026-31431) exploitation using eBPF

For years, Linux security and observability have relied on a patchwork of tools. We scraped user-space logs, parsed Auditd events, and heavily monitored network traffic. But as adversaries have grown more sophisticated, moving deeper into the system to exploit kernel-level vulnerabilities, traditional monitoring has started to show its age. It’s often too noisy, too slow, or simply blind to exactly what is happening in the dark corners of the operating system.