Mitigation code available
PHP2Shell and the Brotli decoder bug were patched the same day. One got the emergency response, the other did not, and the quiet one is harder to find on your estate because the obvious version strings lie about it. There is a role you can run to work out what you have.
CFS gave way to EEVDF over 6.6 to 6.12. Most people who tune a scheduler are solving a problem that isn't a scheduling problem, and the cases where it really is are narrower than the tuning guides let on.
The verifier is the whole story, and you learn more from what it turns down than from what it waves through. A boundary built out of static analysis; you pay at load time and it is free thereafter.
Mitigation code available
regreSSHion is unauthenticated root on sshd, and the published workaround turns it into a denial of service. Five days of reading advisories to find that the only safe verdict a scanner can reach, on a lot of hosts, is "unknown".
Mitigation code available
PwnKit is a local privilege escalation in pkexec affecting every version since 2009. Qualys published a one-line workaround; Red Hat published a note saying do not use it. We shipped a role that does both things, and the interesting part is which hosts get which.
Containers won on ergonomics and spent the decade paying for the boundary they gave up. The answer that arrived in 2018 was a smaller virtual machine rather than a stronger container: tens of thousands of lines of Rust, a boot measured in milliseconds and a device model with almost nothing in it.
Control groups shipped in Linux 2.6.24 in January 2008 and spent six years as plumbing almost nobody touched. The v2 rework is already under way now that containers have made the subsystem famous.
Docker hit 1.0 last week. What is spreading is a packaging format and a registry rather than a new isolation primitive; cgroups and namespaces have been in the kernel for years. The distinction matters, because the isolation we have just traded away is going to have to come back.
