# apt Published articles for apt. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Loongson loong64 packages on apt.postgresql.org DevFeed: [Loongson loong64 packages on apt.postgresql.org]() Original publisher: [Read original article]() Author: Apt Postgresql Org Published: 2026-08-19T00:00:00Z Content type: news Language: en Sources: [PostgreSQL news]() Topics: [apt](), [PostgreSQL](), [cpu](), [Geographic Information System](), [Exception]() Tags: [apt](), [architecture](), [community](), [postgresql]() ### AI overview apt.postgresql.org now provides PostgreSQL packages for the Loongson loong64 architecture. The GIS package stack is still awaiting the next PostGIS release. ### Source excerpt We have a new architecture on apt.postgresql.org: Loongson loong64, a Chinese processor architecture. The build host for the architecture is running on a Loongson 3B6000 board provided by the loongfans.cn community. Bootstrapping the PostgreSQL packages was completed earlier this month and everything is in place to be used via apt.postgresql.org. The exception is the GIS stack of packages (postgis, pgrouting, mobilitydb, pgsql-ogr-fdw) which are currently still waiting for the next postgis release. Enjoy, Christoph ## How to Install and Configure UniFi Controller on Raspberry Pi? DevFeed: [How to Install and Configure UniFi Controller on Raspberry Pi?]() Original publisher: [Read original article]() Author: Patrick Fromaget Published: 2026-08-13T02:01:39Z Content type: tutorial Language: en Sources: [RaspberryTips]() Topics: [Network](), [configuration](), [Linux](), [Debian](), [apt](), [Software](), [Web](), [Hardware]() Tags: [apt](), [article](), [debian](), [devices](), [guide](), [hardware](), [how-to](), [how-to-tutorials](), [linux](), [network](), [networks](), [raspberry-pi](), [software](), [unifi](), [web-interface]() ### AI overview A practical guide to installing and configuring the UniFi Network Application on a Raspberry Pi using a Debian repository or .deb package, apt, and a web interface. It also explains how the application manages multiple access points and wireless devices. ### Source excerpt I've managed access points for years as a sysadmin, and once you have 10+ devices connected, it can quickly become a nightmare. UniFi solved that problem for us, but its dedicated gateways can be expensive. The good news is that a Raspberry Pi can handle the controller role instead. Here's how to set it up.... ## Install Snap Store on Raspberry Pi for Easy App Management DevFeed: [Install Snap Store on Raspberry Pi for Easy App Management]() Original publisher: [Read original article]() Author: Dhairya Parikh Published: 2026-07-30T01:55:35Z Content type: tutorial Language: en Sources: [RaspberryTips]() Topics: [snap](), [Linux](), [App](), [Command-line interface](), [apt]() Tags: [app](), [applications](), [apt](), [article](), [cheat-sheet](), [guide](), [how-to](), [how-to-tutorials](), [linux](), [pi-4](), [raspberry-pi](), [raspberry-pi-os](), [snap](), [software](), [ssh](), [tool]() ### AI overview A practical guide to installing the Snap Store on Raspberry Pi OS, explaining how Snap packages and the Snap Store simplify application installation, isolation, updates, and dependency management compared with APT. ### Source excerpt I'm not a big fan of Snaps on a regular Linux desktop, but I'll admit they can make life easier. Raspberry Pi OS is fairly minimal, and installing software outside the default repositories can quickly become annoying. In this guide, I'll show you how to install the Snap Store, then use it to find and... ## Create Python GUI Apps on Raspberry Pi With PyQt DevFeed: [Create Python GUI Apps on Raspberry Pi With PyQt]() Original publisher: [Read original article]() Author: Patrick Fromaget Published: 2026-07-30T01:34:44Z Content type: tutorial Language: en Sources: [RaspberryTips]() Topics: [Python](), [GUI](), [Qt](), [apt](), [Terminal](), [Programming](), [Linux](), [C++]() Tags: [apt](), [c-plus-plus](), [cheat-sheet](), [gui](), [how-to](), [linux](), [programming](), [programming-language](), [python](), [raspberry-pi](), [raspberry-pi-os](), [systems](), [user-interface]() ### AI overview A practical tutorial on creating Python GUI applications with PyQt on Raspberry Pi. It introduces PyQt and Qt, then covers installation through APT or pip on Raspberry Pi OS. ### Source excerpt I use Python for many Raspberry Pi projects, especially when working with GPIO pins or automating simple tasks. But running a script in the terminal is one thing; giving it a clean, user-friendly interface is another. PyQt is one of the easiest ways to build this. PyQt is a library that can be used to... ## ClickHouse on Docker Hardened Images DevFeed: [ClickHouse on Docker Hardened Images]() Original publisher: [Read original article]() Author: Karolina Ruiz Rogelj; Melvyn Peignon Published: 2026-07-10T15:28:34Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Docker Hardened Images](), [Docker](), [Security](), [Vulnerabilities](), [Docker Image](), [vulnerability](), [Ubuntu](), [apt](), [Perl](), [Amazon Web Services]() Tags: [apt](), [clickhouse](), [deployment](), [developers](), [docker](), [docker-hardened-images](), [docker-hub](), [docker-image](), [images](), [security](), [ubuntu](), [vulnerability]() ### AI overview ClickHouse is now available as a Docker Hardened Image: a minimal, security-hardened build that preserves ClickHouse behavior while shipping only the components needed to run the database and pass enterprise vulnerability scans. ### Source excerpt ClickHouse is now available as a Docker Hardened Image: a minimal, security-hardened build that passes enterprise vulnerability scans by shipping only what the database needs to run, with no change to how ClickHouse behaves. ## Fix the 'externally-managed-environment' Error on Raspberry Pi DevFeed: [Fix the 'externally-managed-environment' Error on Raspberry Pi]() Original publisher: [Read original article]() Author: Robert Lopez Published: 2026-07-01T05:00:00Z Content type: tutorial Language: en Sources: [RaspberryTips]() Topics: [pip](), [Python](), [apt](), [Debian](), [Cheat sheet]() Tags: [apt](), [debian](), [guide](), [guides](), [how-to](), [programming](), [python](), [raspberry-pi](), [tutorial]() ### AI overview This guide explains why pip installation can fail with an "externally-managed-environment" error on Raspberry Pi systems running Debian 12 or newer. It describes the role of APT in managing system Python packages and helps readers choose an appropriate installation method without damaging the system setup. ### Source excerpt Many older Raspberry Pi tutorials still show a simple pip install command to add Python packages. It worked for years, but on recent operating systems, it can now fail with an "externally-managed-environment" error. If this is the first time you've seen it, here's what changed and how to fix it. The externally-managed-environment error appears when... ## Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances DevFeed: [Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances]() Original publisher: [Read original article]() Author: Zoltán Rusnák Published: 2026-06-25T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Security Attacks]() Tags: [apt](), [cloud](), [dns](), [eset-research](), [infrastructure](), [messaging](), [powershell](), [social-media](), [storage]() ### AI overview ESET Research analyzes Gamaredon's 2025 cyberespionage activity against Ukrainian governmental and military institutions, including spearphishing, new malicious PowerShell tools, cloud-based data exfiltration, and concealed C&C infrastructure. ### Source excerpt ESET Research analyzes Gamaredon's new toolset and the group's growing reliance on legitimate online services to hide its C&C infrastructure and exfiltrate stolen data ## FishMonger's arsenal upgraded: SprySOCKS for Windows DevFeed: [FishMonger's arsenal upgraded: SprySOCKS for Windows]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-16T08:54:04Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Processes](), [telemetry]() Tags: [analysis](), [apt](), [backdoor](), [china](), [communication](), [drivers](), [eset-research](), [government](), [kernel](), [linux](), [malware](), [process](), [processes](), [telemetry](), [virustotal](), [windows]() ### AI overview ESET reports two previously undocumented Windows variants of the SprySOCKS backdoor attributed to FishMonger. The variants use TCP, UDP, and WebSocket communications; WIN_DRV uses a kernel driver to conceal artifacts and redirect specially crafted TCP traffic. ### Source excerpt ESET researchers have discovered SprySOCKS for Windows, FishMonger's backdoor weaponizing a kernel driver for advanced stealthiness ## OceanLotus: From external espionage to domestic targeting DevFeed: [OceanLotus: From external espionage to domestic targeting]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-11T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [networking]() Tags: [apt](), [attacks](), [backdoor](), [dns](), [eset-research](), [linux](), [supply-chain](), [telemetry]() ### AI overview The article analyzes OceanLotus's shift toward domestic espionage and two SPECTRALVIPER campaigns in Vietnam: a targeted supply-chain compromise of investor software and a prolonged intrusion against a construction corporation. ### Source excerpt A shift in operational pattern of the infamous Vietnam-aligned APT group ## LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine DevFeed: [LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine]() Original publisher: [Read original article]() Author: LABScon Published: 2026-06-02T13:00:58Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [LABScon](), [Malware](), [Threat Research](), [Reverse Engineering](), [Threat Hunting & Intel](), [backdoor]() Tags: [analysis](), [apt](), [attacks](), [backdoor](), [conferences](), [labscon](), [labscon25](), [malware](), [presentation](), [research](), [reverse-engineering]() ### AI overview ESET researchers present technical evidence that Gamaredon facilitated Turla's access to high-value Ukrainian targets between February and June 2025. The presentation examines their operational collaboration, the deployment of Turla's Kazuar backdoor, and the implications for defenders tracking Russian cyberespionage. ### Source excerpt ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. ## Run Docker containers inside Vercel Sandbox DevFeed: [Run Docker containers inside Vercel Sandbox]() Original publisher: [Read original article]() Author: Brandon Tuttle Published: 2026-05-29T00:01:00Z Content type: news Language: en Sources: [Vercel News]() Topics: [Vercel](), [Docker](), [Docker Sandboxes](), [Containers](), [Redis](), [Ubuntu](), [apt](), [amazon]() Tags: [amazon](), [apt](), [containers](), [docker](), [docker-sandboxes](), [redis](), [sandbox](), [ubuntu](), [vercel]() ### AI overview Vercel Sandbox now supports installing and running Docker inside isolated sandboxes. This enables building containers, running containerized services such as Redis or Postgres, validating images, and previewing containerized applications without modifying the host system. Persistent sandboxes retain Docker installations and pulled images between sessions. ### Source excerpt Update (August 2026): Vercel Sandbox now runs on Vercel Managed Images. Starting with SDK v3, new sandboxes default to the Ubuntu-based vercel/sandbox/universal:latest, where dnf isn't available. The example below applies to the deprecated Amazon Linux runtimes; on Ubuntu, install Docker with apt-get. See the announcement for details. Vercel Sandbox now supports installing and running Docker inside a sandbox. An agent can build containers, install system packages, and modify files without touching your host system. Install Docker, start the daemon, and serve a containerized application: Docker in a Sandbox is useful for running containerized services like Redis or Postgres as test dependencies, validating container images before deploying, or previewing applications served from a container. Combined with persistent sandboxes, the Docker installation and pulled images carry over between sessions. As well as adding support for Docker, sandboxes now support FUSE filesystem drivers and VPN clients, unlocking unlimited capabilities to what can be built. Learn more about these new system specifications in the documentation. Read more ## ESET APT Activity Report Q4 2025-Q1 2026 DevFeed: [ESET APT Activity Report Q4 2025-Q1 2026]() Original publisher: [Read original article]() Author: Jean-Ian Boutin Published: 2026-05-28T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [High Profile Threats]() Tags: [apt](), [china](), [cybersecurity](), [eset-research](), [iran](), [virustotal]() ### AI overview ESET's report summarizes selected APT activity from October 2025 through March 2026, including China-aligned espionage, activity targeting government and strategic-technology entities, and changes in Iran-aligned activity during the war in Iran. ### Source excerpt An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2025 and Q1 2026 ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## Ansible roles: proxy\_env, ssh, etc\_hosts, libvirt released DevFeed: [Ansible roles: proxy\_env, ssh, etc\_hosts, libvirt released]() Original publisher: [Read original article]() Author: Staf Wagemakers Published: 2026-05-03T06:03:00Z Content type: release Language: en Sources: [stafwag Blog]() Topics: [Ansible Roles](), [releases](), [Ansible](), [ssh]() Tags: [ansible](), [apt](), [archlinux](), [changelog](), [debug](), [documentation](), [freebsd](), [kvm](), [libvirt](), [linux](), [pacman](), [releases](), [service](), [ssh]() ### AI overview The article announces releases for four Ansible roles: proxy_env 2.1.0, ssh 1.1.1, libvirt 2.1.0, and etc_hosts 1.1.1. It lists updates including package-management changes, handler fixes, documentation updates, lint corrections, and virtual-machine SSH host-key support. ### Source excerpt Made some time to do some work for a few Ansible roles that I maintain. You'll find the new releases below. ## GopherWhisper: A burrow full of malware DevFeed: [GopherWhisper: A burrow full of malware]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-04-23T08:59:18Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Go Language](), [C++]() Tags: [api](), [apt](), [backdoor](), [c-plus-plus](), [china](), [discord](), [eset-research](), [go](), [malware](), [microsoft-365](), [slack]() ### AI overview ESET Research describes GopherWhisper, a China-aligned APT group targeting a Mongolian government entity. Its largely Go-based malware toolset uses backdoors, injectors, loaders, and legitimate services including Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control and exfiltration. ### Source excerpt ESET Research has discovered a new China-aligned APT group that we've named GopherWhisper, which targets Mongolian governmental institutions ## Sednit reloaded: Back in the trenches DevFeed: [Sednit reloaded: Back in the trenches]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-03-10T09:58:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [apt](), [Cloud](), [obfuscation](), [PowerShell](), [Code](), [Network](), [Open Source]() Tags: [apt](), [attacks](), [backdoor](), [cloud](), [code](), [department-of-justice](), [eset-research](), [network](), [obfuscation](), [open-source](), [powershell](), [us]() ### AI overview This article examines the resurgence of Sednit, also known as APT28, and its modern espionage toolkit. It describes the BeardShell and Covenant implants, their use of legitimate cloud providers for command and control and resilience, PowerShell execution, obfuscation, and links to Sednit's earlier tools and operations. ### Source excerpt The resurgence of one of Russia's most notorious APT groups ## Using Mitmproxy to Observe kubectl Traffic DevFeed: [Using Mitmproxy to Observe kubectl Traffic]() Original publisher: [Read original article]() Author: Scott Lowe Published: 2026-03-04T22:30:00Z Content type: tutorial Language: en Sources: [Scott's Weblog]() Topics: [Kubernetes](), [kubectl](), [Linux](), [Ubuntu](), [Authentication](), [Network](), [macOS](), [Amazon Web Services]() Tags: [apt](), [authentication](), [aws](), [certificates](), [cilium](), [cli](), [cloud](), [cni](), [commands](), [containers](), [cri-o](), [devops](), [docker](), [go](), [iac](), [k8s](), [kubectl](), [kubernetes](), [linux](), [macos](), [networking](), [oci](), [security](), [tutorial](), [ubuntu]() ### AI overview This tutorial explains how to use mitmproxy to observe traffic between kubectl and the Kubernetes API Server. It describes the tested Linux and Ubuntu environment, notes that the commands should work similarly on macOS, and discusses extracting client certificates from a Kubeconfig file for certificate-based authentication. ### Source excerpt When I first started learning Kubernetes, I had the idea that observing the network traffic between a client system using kubectl and the Kubernetes API Server would be a useful thing to do. The source of the idea is unclear; I am unsure why I thought this would be useful as a learning tool. Regardless, I continued on with learning Kubernetes and never really pursued this idea--until this week. I found it can be a useful troubleshooting technique, but I will leave it up to you to determine if it is a useful learning technique. In this post, I will show you how to observe kubectl traffic using mitmproxy. This technique is inspired by/informed by Ahmet Alp Balkan's similarly-named blog post from 2019. Unfortunately, I found the instructions there to be incomplete (most likely just due to the passage of time and continued evolution of the tools involved). I used the following tools and environments in my testing: The tests were conducted on a Linux system running Ubuntu 24.04.4. The commands should work similarly on macOS. Mitmproxy was installed from the Ubuntu repositories using apt. kubectl version 1.33.3 was used to communicate to a self-managed cluster on AWS (in other words, not Amazon EKS) running Kubernetes 1.32.9. The cluster was bootstrapped using kubeadm. I wouldn't expect any major/significant differences with other versions of kubectl or Kubernetes. I was using a client certificate to authenticate to Kubernetes. It's unclear to me how this might work--if it works at all--with alternate authentication mechanisms. Prepare Client Certificates Before you can start mitmproxy, you'll first need to extract the client certificates from the Kubeconfig file. A couple of ways exist to do this; a blog post of mine from 2022 contains what I believe is the easiest way. The method involves yq (to extract information from the Kubeconfig) and base64 (to decode the client certificate and client key). Refer to the linked blog post for full details. First, extract the client cer ## ESET Research: Sandworm behind cyberattack on Poland's power grid in late 2025 DevFeed: [ESET Research: Sandworm behind cyberattack on Poland's power grid in late 2025]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-01-23T16:58:26Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [ESET research](), [Critical Infrastructure](), [apt](), [Malware](), [data]() Tags: [analysis](), [apt](), [critical-infrastructure](), [energy](), [eset-research](), [history](), [infrastructure](), [malware](), [research](), [security]() ### AI overview ESET Research attributes a late-2025 cyberattack on Poland's power grid to the Russia-aligned Sandworm APT group with medium confidence. The attack used data-wiping malware named DynoWiper, although no successful disruption has been identified. The article places the incident in the context of Sandworm's history of attacks on critical infrastructure, including the 2015 Ukrainian power-grid blackout. ### Source excerpt The attack involved data-wiping malware that ESET researchers have now analyzed and named DynoWiper ## Disable the pager for apt search DevFeed: [Disable the pager for apt search]() Original publisher: [Read original article]() Author: Tom Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [apt](), [Debian](), [configuration](), [systems]() Tags: [apt](), [apt-cache](), [bash](), [command-line](), [configuration](), [debian](), [how-to](), [less](), [linux](), [pager](), [terminal](), [ubuntu]() ### AI overview This tutorial explains how to disable the pager used for apt search results on Debian-based systems. It compares older search commands and an environment-variable setting, then recommends a permanent configuration-file change that keeps colorized output. ### Source excerpt Learn how to disable the annoying pager for apt search results on Debian-based systems, and find the best permanent solution. ## Code And Let Live DevFeed: [Code And Let Live]() Original publisher: [Read original article]() Published: 2026-01-09T00:00:00Z Content type: opinion Language: en Sources: [The Fly Blog]() Topics: [Cloud](), [Linux](), [apt](), [Amazon EC2](), [Network](), [ssh](), [Docker]() Tags: [apt](), [cdn](), [close-to-users](), [cloud](), [code](), [deploy-app-servers](), [docker](), [elixir](), [fly](), [fly-io](), [heroku-alternative](), [heroku-competitor](), [hosting](), [i](), [linux](), [network](), [networking](), [postgresql-clusters](), [servers](), [ssh]() ### AI overview Fly.io presents Sprites as durable, rapidly created cloud computers designed to replace ephemeral, read-only sandboxes. A Sprite provides a persistent Linux environment with substantial storage, automatic sleep, checkpoint and restore, networking, and low-cost operation at scale. ### Source excerpt The state of the art in agent isolation is a read-only sandbox. At Fly.io, we've been selling that story for years, and we're calling it: ephemeral sandboxes are obsolete. Stop killing your sandboxes every time you use them. My argument won't make sense without showing you something new we've built. We're all adults here, this is a company, we talk about what we do. Here goes. So, I want to run some code. So what I do is, I run sprite create. While it operates, I'll explain what's happening behind the-- Wrap text Copy to clipboard ✓ Created demo-123 sprite in 1.0s ● Connecting to console... sprite@sprite:~# Shit, it's already there. That's a root shell on a Linux computer we now own. It came online in about the same amount of time it would take to ssh into a host that already existed. We call these things "Sprites". Let's install FFmpeg on our Sprite: Wrap text Copy to clipboard sudo apt-get install -y ffmpeg >/dev/null 2>&1 Unlike creating the Sprite in the first place, installing ffmpeg with apt-get is dog slow. Let's try not to have to do that again: Wrap text Copy to clipboard sprite@sprite:~# sprite-env checkpoints create # ... {"type":"complete","data":"Checkpoint v1 created successfully", "time":"2025-12-22T22:50:48.60423809Z"} This completes instantly. Didn't even bother to measure. I step away to get coffee. Time passes. The Sprite, noticing my inactivity, goes to sleep. I meet an old friend from high school at the coffee shop. End up spending the day together. More time passes. Days even. Returning later: Wrap text Copy to clipboard > $ sprite console sprite@sprite:~# ffmpeg ffmpeg version 7.1.1-1ubuntu1.3 Copyright (c) 2000-2025 the FFmpeg developers Use -h to get full help or, even better, run 'man ffmpeg' sprite@sprite:~# Everything's where I left it. Sprites are durable. 100GB capacity to start, no ceremony. Maybe I'll keep it around a few more days, maybe a few months, doesn't matter, just works. Say I get an application up on its legs. Install more pa ## LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan DevFeed: [LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan]() Original publisher: [Read original article]() Author: Anton Cherepanov Peter Strýček Published: 2025-12-18T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [.NET](), [enterprise deployment]() Tags: [apt](), [backdoor](), [browser](), [c-sharp](), [china](), [cloud](), [cloud-services](), [eset-research](), [google](), [japan](), [malware](), [microsoft](), [net](), [policy](), [techniques](), [windows]() ### AI overview ESET describes LongNosedGoblin, a China-aligned APT group conducting cyberespionage against governmental entities in Southeast Asia and Japan. The group deploys malware through Group Policy and uses tools including the NosyDoor backdoor and the C#/.NET NosyHistorian application. ### Source excerpt ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions ## Blog: GPG Key Rotation for Falco Packages (2026) DevFeed: [Blog: GPG Key Rotation for Falco Packages (2026)]() Original publisher: [Read original article]() Published: 2025-12-12T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Security](), [Package manager](), [releases](), [apt]() Tags: [announcements](), [apt](), [falco](), [import](), [installation](), [releases](), [rotation](), [rsa](), [security]() ### AI overview Falco maintainers are rotating the 4096-bit RSA GPG key used to sign official RPM and DEB packages because the existing key expires on January 17, 2026. The transition uses a soft launch followed by a hard cut-over, and existing users should update their keyrings before January 12, 2026. ### Source excerpt The GPG key used to sign official Falco packages (RPM and DEB) is set to expire on January 17, 2026. To ensure the security and continuity of our software distribution, the Falco maintainers will be rotating to a new 4096-bit RSA key. We have designed a two-phase "Soft Launch" strategy to make this transition as smooth as possible, providing a one-month transition window before the old key is retired. The Rotation Plan To avoid immediate disruption, we are rolling out the new key in two distinct phases. You can follow the detailed progress in our tracking issue #3750. Phase 1: Soft Launch (Dec 12, 2025) What happens: The new GPG key has been published and added to our repository configuration. Dev Builds: Will begin using the New Key immediately. Stable Builds: No stable releases are planned for this phase. If any hotfixes are released, they will be signed with New Key as well. Key Bundle: The official key URL has been updated to serve a bundle containing both the Old (valid) and New (valid) keys. Phase 2: Hard Cut-Over (Jan 12-17, 2026) What happens: This is the maintenance window where we fully switch to the new key. Mass Resign: All existing stable packages on download.falco.org will be resigned with the New Key. Revocation: The Old Key will be officially revoked and removed from the active bundle. Impact: If you have not updated your keyring by this date, your package manager (apt or yum) will reject updates with a signature verification error. Action Items for Users We strongly recommend all users update their GPG keyring before January 12, 2026 to avoid interruption. New Users If you are installing Falco for the first time following our Install on a host (DEB,RPM) instructions, no action is required. The installation process will guide you to fetch the new key bundle, ensuring you are ready for both phases. Existing Users If you have an existing Falco installation, you must manually import the new key. We have updated the key file at our standard URL to includ ## MuddyWater: Snakes by the riverbank DevFeed: [MuddyWater: Snakes by the riverbank]() Original publisher: [Read original article]() Author: ESET Research Published: 2025-12-02T10:00:15Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [C++]() Tags: [analysis](), [api](), [apt](), [backdoor](), [c](), [c-c-plus-plus](), [c-plus-plus](), [critical-infrastructure](), [cryptographic](), [eset-research](), [iran](), [malware](), [memory](), [persistence](), [socks5](), [techniques](), [tools](), [windows]() ### AI overview ESET analyzes a MuddyWater campaign targeting organizations in Israel and Egypt that uses custom loaders, credential stealers, reverse tunnels, and the MuddyViper backdoor to evade defenses and maintain access. ### Source excerpt MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook ## Using a Package Manager in GitHub Actions DevFeed: [Using a Package Manager in GitHub Actions]() Original publisher: [Read original article]() Author: Sidrah Abdullah Published: 2025-08-31T19:08:15Z Content type: tutorial Language: en Sources: [Baeldung - Ops]() Topics: [ci](), [CI/CD](), [C++]() Tags: [apt](), [ci](), [deployment-tools](), [deployment-tools-git-docker-container-github-actions-package-management-ubuntu](), [docker-container](), [git](), [github-actions](), [package-management](), [tutorial](), [ubuntu](), [workflow]() ### AI overview A tutorial on installing packages with apt-get in GitHub Actions workflows, including why clean Ubuntu runners need setup, a basic lcov example, and potential permission errors. ### Source excerpt Learn how to safely and wisely use a package manager within GitHub Actions. Related Stories Get Files Modified in a PR in GitHub Actions Use Private Docker Image in GitHub Actions Using GitHub Actions to Create .env File in the Workflow [Next page]()