Ronen Givon

Co-founder and CEO of @rekkiapp

[Ronen Givon @rgivon]

all software is imperfect. The cost to find exploits was just too high. now all bets are off.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: An AI found a Linux kernel zero-day that roots every distribution since 2017. The exploit fits in 732 bytes of Python. Patch your kernel ASAP.

The vulnerability is CVE-2026-31431, nicknamed "Copy Fail," disclosed today by Theori. It has been sitting quietly in the Linux kernel for nine years.

Most Linux privilege-escalation bugs are picky. They need a precise timing window (a "race"), or specific kernel addresses leaked from somewhere, or careful tuning per distribution. Copy Fail needs none of that. It is a straight-line logic mistake that works on the first try, every time, on every mainstream Linux box.

The attacker just needs a normal user account on the machine. From there, the script asks the kernel to do some encryption work, abuses how that work is wired up, and ends up writing 4 bytes into a memory area called the "page cache" (Linux's high-speed copy of files in RAM). Those 4 bytes can be aimed at any program the system trusts, like /usr/bin/su, the shortcut to becoming root.

Result: the next time anyone runs that program, it lets the attacker in as root.

What should worry most: the corruption never touches the file on disk. It only exists in Linux's in-memory copy of that file. If you imaged the hard drive afterwards, the on-disk file would match the official package hash exactly. Reboot the machine, or just put it under memory pressure (any normal system load that needs the RAM), and the cached copy reloads fresh from disk.

Containers do not help either. The page cache is shared across the whole host, so a process inside a container can use this bug to compromise the underlying server and reach into other tenants.

The original sin was a 2017 "in-place optimization" in a kernel crypto module called algif_aead. It was meant to make encryption slightly faster. The change broke a critical safety assumption, and nobody noticed for nine years. That bug then rode every kernel update from 2017 to today.

This vulnerability affects the following:
🔴 Shared servers (dev boxes, jump hosts, build servers): any user becomes root
🔴 Kubernetes and container clusters: one compromised pod escapes to the host
🔴 CI runners (GitHub Actions, GitLab, Jenkins): a malicious pull request becomes root on the runner
🔴 Cloud platforms running user code (notebooks, agent sandboxes, serverless functions): a tenant becomes host root

Timeline:
🔴 March 23, 2026: reported to the Linux kernel security team
🔴 April 1: patch committed to mainline (commit a664bf3d603d)
🔴 April 22: CVE assigned
🔴 April 29: public disclosure

Mitigation: update your kernel to a build that includes mainline commit a664bf3d603d. If you cannot patch immediately, turn off the vulnerable module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

For environments that run untrusted code (containers, sandboxes, CI runners), block access to the kernel's AF_ALG crypto interface entirely, even after patching. Almost nothing legitimate needs it, and blocking it shuts the door on this whole class of bug...

[Ronen Givon @rgivon]

AI Twitter thinks everyone’s using AI now

90% of the business we work with (SMEs in F&B) barely use even chatgpt

[Ronen Givon @rgivon]

@rwitoff it certainly feels like every employee has become a team. Coordination or sharing are not a primitive anymore. What I see is less dependency between employees so everyone is able to be a 'team' in their own right.

[Ronen Givon @rgivon]

@sytaylor mmm. still probabilistic. Would Brex customers be concerned?

[Ronen Givon @rgivon]

@eraworlds Love the design

[Ronen Givon @rgivon]

@noscroll How does noscroll decide what’s signal vs. noise?

[Ronen Givon @rgivon]

@hobdaydesign you’re spot on.

and whilst the company started in 2016, for the first 3 yrs we just didn’t have a website.

[Ronen Givon @rgivon]

@codinghorror I love this card game https://t.co/KpaPHzN5hn

[Ronen Givon @rgivon]

Who's most likely to see closed shutters? The people who normally work behind them. Mind boggling levels of originality and authenticity from the team. Love it.

[REKKI @rekkiapp]

Today we launch our shutter campaign, with our ads featuring across fifteen restaurants' shutters across London.

It seemed only right that we feed back into hospitality rather than the big billboard companies (no offence).

Huge thanks to the restaurants involved.

[Ronen Givon @rgivon]

Love that place

[REKKI @rekkiapp]

With its cult following and consistent rave reviews, it was about time we set foot in the infamous kitchen at The Gun to have a proper chat with Jenny Phung – aka Ling Ling's – to talk heritage, hospitality, and what's on the horizon.

https://t.co/c4VCwNQ3V6

[George Henry @georgehdf]

If you're passionate about food culture and helping restaurants thrive, there are lots of exciting roles @rekkiapp. Join a team of over 70 people from 22 different countries, working out of London, New York City, Amsterdam and Lisbon: https://t.co/gtODOX2vd1

[REKKI @rekkiapp]

2022 is shaping up to be a massive year for REKKI. And we’re kicking things off with the launch of our brand new website.

Built entirely by our in-house team plus photographer Justinas Vilutis and chef Alix Lacloche.

Click here to check it out: https://t.co/WrUjtjLRkC

[REKKI @rekkiapp]

Here it is! We’re super excited to be launching our brand new video series Lights On.

Lights On captures what life is really like for suppliers, chefs & restaurant owners in the industry.

🎬 https://t.co/evMHvSOti4

[REKKI @rekkiapp]

Diversity of Ingredients:

One major effect on the restaurant supply chain has been how limited menus have become. It also highlights how long specialised farms could take to recuperate given their crops had less customers for the past year. 5/6

[REKKI @rekkiapp]

1/3 Heidi Reeder Director @AllanReederLtd. “Because my customers like it, that's the most important factor, without that you can’t reap benefits, that’s what makes REKKI different. And because my customers like it, use it consistently, at no effort from my team there's benefits.

[Jesse Dunford Wood @dunfordwood]

Free school meals for anyone who needs them this half-term until Friday from our Shop at @parlouruk, 5 Regent Street, Kensal Green, NW10 5LG).

Just pop down between 11am-12pm, no questions asked.
#endchildfoodpoverty

Thanks to @natureschoicelondon @rekkiapp @marcusrashford

[awwwards. @awwwards]

REKKI by @rekkiapp (UK) wins #SOTD & #DEVAWARD Reinventing ordering for chefs and suppliers from the ground up. The new website shows the REKKI design principles: honesty and attitude https://t.co/Ym3kXJk27b #Typography #Design #WebDesign #WebDev

[Jesse Dunford Wood @dunfordwood]

Great event yesterday with Endo San, Suishi & Sake & raising money for @thefelixproject with @rekkiapp @natsukipim - watch this space.

[REKKI @rekkiapp]

Listen to @saltbutterbones of @ChefsinSchools on how they are supporting students at home.
---
We're sharing stories from people across the food industry on how and what they are doing in the time of #COVID19 on our Instagram (find them all here: https://t.co/bEoTCzmwCy)

[Ronen Givon @rgivon]

is asking questions