Faith Ariyo

Cybersecurity | Photography | Lover of God

[Faith Ariyo @cybergbeja]

2024: I will starve my doubt.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[Central Bank of Nigeria @cenbank]

Press Release

CBN Alerts Public To Fraudulent Messages, Cyber Security Hack Attempts

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Mololuwa | Cybersecurity - (The God Complex) @cyber_rekk]

Two weeks after launch, we were at 3.6k users
The vibes in Slack was on point. We were disrupting the space
Then our Lead engineer sent me a DM at 2 AM that turned my stomach.
"Affa , we have a problem. Look at the server logs."

One IP address from a cheap VPS provider was hitting our /api/v1/get-loan-details/ endpoint every 0.5 seconds.
They weren't hacking. They weren't using Kali Linux or doing some Mr. Robot type shiid
They were just using a simple Python loop

Here’s the mistake that almost killed us:
Our URLs looked like this: https://t.co/p4ItRQDy3n
The person just changed 1044 to 1045.
Then 1046. Then 1047.
They were literally walking through our database and downloading every customer’s loan amount, home address, and next of kin

The worst part? Our dashboard showed everything was fine because the user was Authenticated
The system said: Yes, this person is logged in
But the system never asked: Is this person allowed to see loan #1045?

In the world of OWASP, this is BOLA (Broken Object Level Authorization).
In Nigeria, this is how you end up in front of a regulatory committee explaining why 3600+ people's private data is on a random Telegram group

The Technical Debt we had to pay in blood:
1. The iD Trap
If your database uses auto-incrementing integers (1, 2, 3...), you are handing a map to the thief
We had to migrate everything to UUIDs.
Now, instead of .../loans/1044, the URL is .../loans/550e8400-e29b-41d4-a716-446655440000.
Good luck guessing the next one. It will take a billion years.

2. The Scope Check (The Where Clause)
We realized our backend code was lazy.
Before: db.find(loan_id)
After: db.find_one({ "id": loan_id, "user_id": current_user.id })
If the user ID in the session doesn't match the owner ID of that specific loan, the database returns nothing.
Even if you guess the ID, the door is locked from the inside.

3. The Rate Limit wahala
No normal human being checks 500 loan applications in 60 seconds
We implemented a strict rate limiter
If you hit our API more than 20 times a minute on sensitive endpoints, your IP gets auto-blacklisted and our security lead gets a Telegram/slack alert

We spent 72 hours straight rewriting the entire auth logic.
We didn't sleep. We lost a week of growth.
But we saved the org

If you’re a founder or a CTO, go to your laptop right now.
Open your API docs.
Pick an endpoint that shows user data.
Try to change the ID in the request to another user's ID.
If it works, you have an issue

Africa doesn't need more features.
Africa needs more trust
If you can't protect the data, don't ask for it

[Ghost St Badmus @commando_skiipz]

If I start sharing my encounters with developers daily, I could post something new every day for a year and still not run out of stories 😅

Especially with Naija devs, they often come off rude at first, but the moment they realize you’re as technical (or even more technical) than them, you suddenly become “Boss” or “Chief.”

Meanwhile, asian and north/south american devs usually just calm down, listen, and tell you exactly how many hours or days it’ll take them to fix the issue, no argument, no drama.

[Andrew Thompson @ImposeCost]

Even as a 19 year old Marine, I had bosses that would have me brief their boss if I was better positioned to provide the insight they needed. Being comfortable putting the right person at the podium independent of their position in the organization is important to being an effective leader.

[Josh Barzon @JoshuaBarzon]

🧵 Mephibosheth: The Forgotten Prince of Israel

Mephibosheth’s story in the Bible is short but powerful. It is a tale of tragedy, grace, & covenant faithfulness.

But above all of that… he points us to Christ. Here’s his story 🧵👇🏼

[Kayode Alese @AleseKayode]

Apply before it closes

[Faith Ariyo @cybergbeja]

That’s the action they want. That’s the urgency we must be ready for.

So keep sharpening your skills. Stay ready.

And when the moment comes, act like the cyber pro you’ve prepared to be. 3/3

#CyberSecurity #IncidentResponse #Preparedness #Infosec

[Faith Ariyo @cybergbeja]

One thing that consistently stands out in my recent engagements is this: when responding to a cyber threat, time is never in abundance.

I’ll say it plainly: the most critical phase of incident response is preparation. Once a breach occurs, it’s time to take action. 1/3

[Faith Ariyo @cybergbeja]

There’s no room to start reading up on what you should have known. The faster your response, the better the outcome for you and your organisation/customer.

I’ve heard this repeatedly from teams:

“How soon can we get back to business?”
2/3

[Deeper Life Bible Church @dclmhq]

I am called
I am courageous
I will conquer

#SundayWorshipService
#SundayService
#DeeperLife
#PastorKumuyiSaid
#PastorKumuyi

[Faith Ariyo @cybergbeja]

@PastorMarvy Lm. ......... ....

.
.....
.

........
..
...

[Faith Ariyo @cybergbeja]

@PastorMarvy Km..

[Faith Ariyo @cybergbeja]

@PastorMarvy .........,...
,..
..,.
,..,......,............,m...................l
,.
......m...m
....,......m...l..
..

[Faith Ariyo @cybergbeja]

@PastorMarvy ,,,,

[Faith Ariyo @cybergbeja]

@aa__emmanuel Emmanuel hope this will get to me. This will equip me with the needed skill.

[Layer3 NIGERIA @Layer3NIGERIA]

We’re 20! 🎉

For two decades, Layer3 has been at the forefront of innovation — helping businesses transform, scale, and thrive with cutting-edge technology.

Thank you for being part of our journey.

#Layer3At20 #20YearsOfInnovation #Layer3Solutions #ThankYou

[Ndubuisi Ekekwe @ndekekwe]

Good People, join me to congratulate my FUTO classmate, Oyaje Idoko, as his company, Layer3, celebrates the 20th anniversary. If you can start a company in Nigeria and it stays alive for 20 years, you sabi well well. Oyaje knows his stuff and is built with FUTO’s peerless and unmatched excellence in technology leadership and service.

Layer3 is the only cloud provider that has the 3S in Nigeria and that means with Layer3, you get Data Sovereignty (your data is there in Nigeria), Data Infrastructure (the infrastructure is there in Nigeria) and Personnel Sovereignty (Nigerians run the show). No other company can brag about that, and that is why when security matters, Layer3 has served Nigeria.

I was checking his LinkedIn page and noticed the 20th year anniversary and moved to commend how he has provided hundreds of jobs in our nation. I went to check how he is coping with the security challenges in his state of Benue. To our brothers and sisters in Benue and beyond, we wish everyone strength over the incessant security paralysis in Nigeria. What is going on?

Back to focus, let us wish Layer3 many more business years ahead. I have many classmates who run many amazing businesses in Nigeria, and whenever I remember them, I am moved on the power of education., Yes, some went straight to business without working for anyone, just on the pure knowledge they acquired from FUTO. (Those days it was a tough call because there were many jobs for great grads; every week, banks and telcos were hiring thousands)