Sunday, May 3, 2026

The 2026 AI Draft

SUMMARY: Draft guru Brandon Whichard (Software Defined Talk) joins us for the inaugural AI Draft, where we predict the next year of AI winners, losers, trends, and headlines. 

GUEST: Brandon Whichard, Software Defined Talk

SHOW: 1024

SHOW TRANSCRIPT: The Reasoning Show #1024 Transcript

SHOW VIDEO: 

SHOW SPONSORS:

SHOW NOTES:

Brian’s Picks

  1. Google
  2. Major AI-centric IPO in 2026 ($1T valuation)
  3. Amazon (cloud)
  4. Company has more Agents that Employees
  5. TSMC (hardware)
  6. AMD (hardware)
  7. Family asks about AI at the holidays
  8. Data center issue causes a significant change to human existence

Brandon’s Picks

  1. Anthropic
  2. NVIDIA
  3. Broadcom
  4. OpenAI (frontier model)
  5. AI Consumption-based pricing (end of subsidies)
  6. AI Energy Demand
  7. The end of “vibe-coding”
  8. Sam Altman out at CEO of OpenAI

FEEDBACK?



from The Cloudcast (.NET) https://ift.tt/c74zbms
via IFTTT

CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a recently disclosed security flaw impacting various Linux distributions to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.

The vulnerability, tracked as CVE-2026-31431 (CVSS score: 7.8), is a case of local privilege escalation (LPE) flaw that could allow an unprivileged local user to obtain root. The nine-year-old flaw is also tracked as Copy Fail by Theori and Xint. Fixes have been made available in Linux kernel versions 6.18.22, 6.19.12, and 7.0.

"Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation," CISA said in an advisory.

In a write-up published earlier this week, the researchers said Copy Fail is the result of a logic bug in the Linux kernel's authentication cryptographic template that allows an attacker to reliably trigger privilege escalation trivially by means of a 732-byte Python-based exploit. It was introduced through three separate, individually harmless changes to the Linux kernel made in 2011, 2015, and 2017.

The high-severity security vulnerability impacts Linux distributions shipped since 2017, and permits an unprivileged local user to obtain root-level access by corrupting the kernel's in-memory page cache of any readable file, including setuid binaries. This corruption could be carried out by unprivileged users and could result in code execution with root permissions.

"Because the page cache represents the in-memory version of executables, modifying it effectively alters binaries at execution time without touching disk," Google-owned Wiz said. "This enables attackers to inject code into privileged binaries (e.g., /usr/bin/su) and thereby gain root privileges."

The prevalence of Linux in cloud environments means the vulnerability has a significant impact. Kaspersky, in its analysis of the flaw, said Copy Fail poses a serious risk to containerized environments, as Docker, LXC, and Kubernetes "grant processes inside a container access to the AF_ALG subsystem if the algif_aead module is loaded into the host kernel" by default.

"Copy Fail poses a risk of breaching container isolation and gaining control over the physical machine," the Russian security vendor said. "At the same time, exploitation does not require the use of complex techniques, such as race conditions or memory address guessing, which lowers the entry barrier for a potential attacker."

"Detecting the attack is difficult because the exploit uses only legitimate system calls, which are hard to distinguish from normal application behavior."

Adding to the urgency is the availability of a fully working exploit proof-of-concept (PoC), with Kaspersky stating Go and Rust versions of the original Python implementation have already been detected in open-source repositories. 

CISA did not share any details about how the vulnerability is being exploited in the wild. However, the Microsoft Defender Security Research Team said it's "seeing preliminary testing activity that might result most likely in increased threat actor exploitation over the next few days."

"The attack vector is local (AV:L) and requires low privileges with no user interaction, meaning any unprivileged user on a vulnerable system can attempt exploitation," it added. "Critically, this vulnerability is not remotely exploitable in isolation, but becomes highly impactful when chained with an initial access vector such as Secure Shell (SSH) access, malicious CI job execution, or container footholds."

The tech giant has also detailed one possible route attackers could take to exploit the vulnerability -

  • Conduct reconnaissance to identify a Linux host or container running a kernel version susceptible to Copy Fail.
  • Prepare a small Python trigger for use against the endpoint.
  • Execute the exploit from a low-privilege context, either as a regular Linux user on a host or a compromised container process with no special capabilities.
  • Exploit performs a controlled 4‑byte overwrite in the kernel page cache, leading to corruption of sensitive kernel‑managed data.
  • Attacker escalates their process to UID 0 and obtain full root privileges.

Federal Civilian Executive Branch (FCEB) agencies have been advised to apply the fixes by May 15, 2026, as updates have been pushed by impacted Linux distributions. If patching is not an immediate option, organizations are recommended to disable the affected feature, implement network isolation, and apply access controls. 



from The Hacker News https://ift.tt/cdDTlVg
via IFTTT

Friday, May 1, 2026

Microsoft Agent 365, now generally available, expands capabilities and integrations

Microsoft Agent 365

Now generally available for commercial customers.

Choose an ecosystem partner for agent security and governance

AI agents aren’t coming—they’re already in your environment. They show up in places you expect (like Microsoft CopilotMicrosoft Teams, and Microsoft 365) and even more places as technology evolves (a local autonomous personal AI assistant or a new software as a service (SaaS) agent connected to your sensitive data.)

The problem isn’t that agents exist. It’s that they proliferate fast, span apps, endpoints and cloud, and often operate outside the visibility and control of the teams accountable for risk. When an agent can invoke tools, access data, and interact with other agents, any “helpful” workflow can turn into data oversharing, tool misuse, or over-privileged actions in seconds. And as agents become even easier to create and deploy, your attack surface grows with them. 

That’s why end-to-end observability matters: you can’t govern what you can’t see, and you can’t secure what you don’t understand—especially when the number of agents is a moving target. 

Microsoft Agent 365 helps you take control of agent sprawl as your control plane to observe, govern, and secure agents and their interactions—including agents built with Microsoft AI and agents from our ecosystem partners—using the admin and security workflows your teams already run. 

General availability starts today for Agent 365.

Additionally, we’re announcing the previews of new Agent 365 capabilities and integrations to help you scale agent adoption with the right controls in place. 

  • Observability, governance, and security for agents operating independently—Agent 365 is expanding to cover agents that operate with their own credentials and permissions.
  • Discovery of agents and shadow AI, using capabilities of Microsoft Defender and Microsoft Intune for both local and cloud agents.
  • A secured, managed environment for agents to work in Windows 365 for Agents.
  • Coverage for a wide ecosystem of SaaS agents, including agents innovated by software development companies (SDCs).
  • Support for evaluation, adoption, and usage from Microsoft and ecosystem partners worldwide.

Manage agents with a single control plane, regardless of how or where they work

As organizations move from pilot to adoption, AI agents are being deployed across increasingly diverse use cases. Some act with delegated access, working on behalf of users; others operate with their own credentials and permissions, participating in team workflows or operating behind the scenes. 

With Agent 365, you can observe, govern, and secure AI agents whether they act on behalf of users with delegated access—for example, an agent that helps employees organize their inbox—or agents that operate with their own access and scope of work—such as an agent autonomously triaging support tickets. 

Supported by Agent 365
Agents working on behalf of
users (delegated access) 
Generally available 
Agents operating behind
the scenes (own access) 
Generally available 
Agents participating in team
workflows (own access) 
Public Preview   

Discover and manage local and cloud-hosted agents 

Users are installing agents like OpenClaw and Claude Code on their devices and adopting SaaS agents built by developers on new and emerging platforms. Many of these local and cloud-hosted agents run unmanaged and outside of traditional governance, as they autonomously execute tasks, modify code, or access confidential information, creating a new wave of shadow AI.  

To help organizations address accelerating agent sprawl and the rise of unmanaged agents, we’re introducing new capabilities as part of Agent 365, Microsoft Defender, and Intune so you can discover shadow agents, and apply appropriate controls, such as blocking unmanaged agents. 

Discover and manage local agents

With Microsoft Defender and Intune, organizations will be able to discover and manage local AI agents running on Windows devices, starting with OpenClaw agents and expanding soon to other widely used agents like GitHub Copilot CLI and Claude Code. Customers enrolled in the Frontier program can see if OpenClaw agents are being used in the organization, which devices they are running on, and use Intune policies to block common ways that OpenClaw runs on the new Shadow AI page in Agent 365 in the Microsoft 365 admin center and in the Intune admin center. Through Agent 365 registry, the inventory of local agents will be available in Defender and Intune so IT, endpoint management, and security teams can get a consistent view of discovered local agents in their environment and take appropriate action.

Starting in June 2026, Microsoft Defender will also provide asset context mapping for each agent including the devices they run on, MCP servers configured for those agents, the identities associated with them, and the cloud resources those identities can reach. This will give security teams the context needed to assess exposure and potential blast radius. They can then investigate agent activity, such as file access and network behavior, using familiar endpoint data, and use those insights to identify misconfigurations and even define custom detections.

Beyond monitoring, organizations will be able to apply policy-based controls to set guardrails for what agents are allowed to do—helping protect both agents and organizations from compromise and misuse—with initial support delivered for OpenClaw through Intune. If a managed agent exhibits malicious behavior patterns, such as attempting to access or exfiltrate sensitive data, Defender will be able to block coding agents in runtime and generate alerts with rich incident context to support investigation and response.  

Context mapping capabilities, policy-based controls, plus runtime blocking and alerts will be available in Agent 365 through Intune and Defender public preview in June 2026. 

Visibility across clouds and AI-builder platforms

As developers are rapidly building agents with Microsoft Foundry, AWS Bedrock, and Google Gemini Enterprise Agent Platform (formerly Google Vertex AI) and deploying cloud agents across multicloud and multi-platform environments, the agent sprawl challenge intensifies. To manage potential security risks or vulnerabilities before they become breaches, security and IT teams need visibility to which cloud agents are running, what models these agents are built on, and what resources they’re accessing.

Today, we are excited to announce the public preview of Agent 365 registry sync with AWS Bedrock and Google Cloud connections, using IT teams to automatically discover, inventory, and, soon, perform basic lifecycle governance—for example, start, stop, delete agents—across these platforms.

Manage a wide ecosystem of SaaS agents 

Agent 365 works with prebuilt agents in Microsoft 365 Copilot and Teams, agents built with Microsoft Copilot Studio or Microsoft Foundry for your organization, and agents built by software development companies partnered with Microsoft.

Delivering on our promise of control plane for the broad agent ecosystem, we’re excited to announce ecosystem partner agents fully configured to be managed by Agent 365, including Genspark, Zensai, Egnyte, and Zendesk, and agents built on agent factories, including Kasisto, Kore, and n8n. Organizations can observe, govern, and secure these agents in the Agent 365 control plane, with no integration work by IT or security teams.  

Agent 365 software development company launch partners

Enterprises can easily build AI agents today, but scaling them with trust and governance is where most initiatives stall. With Kore.ai deeply integrated into Microsoft Agent 365, identity, security, and governance are built in from the start—empowering enterprises to move from pilots to AI at scale with confidence.

—– Raj Koneru, Chief Executive Officer of Kore.ai

The Agent 365 developer and ecosystem partners play a critical role in extending agents into line-of-business systems, building vertical and scenario-specific integrations, modernizing legacy automation into agent workflows, extending Copilot experiences with custom agents, and helping customers operationalize agent ecosystems at scale. These Agent 365 enabled agents are then observable, governable, and securable in the Agent 365 control plane, accelerating adoption for your organization.

Secure agents as they work in Windows 365 

While Agent 365 provides the control plane to observe, govern, and secure agent activity across the enterprise, Windows 365 for Agents—now available in public preview (in the United States only)—provides a secured, managed environment where agents can carry out that work. It introduces a new class of Cloud PCs purpose-built for agentic workloads and managed in Intune, allowing agents to run in policy-controlled environments, interact with applications, and operate with the same identity, security, and management controls already used for employees.

Now, with Agent 365, you can also observe and secure agents running on Windows 365 for Agents in Microsoft 365 admin center, understanding which agents are connected to the cloud-powered compute. Together, they enable organizations to move from visibility and governance of agents to confidently running them in production environments. 

Secure agents against internet threats with network controls  

AI agents can operate much faster than human users. Without proper guardrails, they can connect to risky web destinations, interact with unsanctioned AI services, handle sensitive files unsafely, or be manipulated through malicious prompt-based attacks. These risks are harder to manage when security teams lack consistent visibility and controls for agent traffic to internet, SaaS, and AI services. 

To give security teams a consistent way to inspect agent traffic at the network layer, in general availability today, Agent 365 extends Microsoft Entra network controls to Microsoft Copilot Studio agents and agents running on user endpoint devices, including local agents such as OpenClaw. These controls can help identify unsanctioned AI usage, restrict connections to only approved web destinations, filter risky file movement, and help block malicious prompt-based attacks before they lead to harmful actions. 

Confidently scale and govern AI agents while maintaining security and control 

Agent 365 extends even further beyond Microsoft platforms to discover, observe, govern, and secure local, SaaS, and cloud agents across your agentic AI ecosystem. Each of today’s announcements build upon Agent 365 capabilities we shared in March 2026 as well as detailed feedback of customers using the Frontier program, developers integrating with the platform, and partners testing Agent 365 capabilities. 

With Agent 365, we can scale and govern AI agents with confidence, while maintaining enterprise grade security and control. Agent 365 enables organizations to move beyond experimentation, driving tangible business value and innovation through trusted AI adoption. By providing a robust and integrated platform, Agent 365 empowers teams to confidently embrace AI and accelerate transformation across the enterprise.

—Yuji Shono, Head of the Global AI Office, NTT DATA Group Corporation, a global infrastructure, networking, and IT services provider.

As organizations begin to adopt Agent 365 at scale, we’ve collaborated with strategic partners to create targeted services to help customers onboard, tackle governance challenges and realize the platform’s full value.

Partner services offered today include expertise and guidance for: 

  • Inventory and ownership: What agents exist, who owns them, and where they run.
  • Least privilege: Right-sizing permissions and enforcing access guardrails without slowing delivery.
  • Compliance and data protection: Preventing oversharing and producing audit-ready evidence.
  • Threats and multi-platform estates: Understanding attack paths and governing across vendors and clouds.
  • Ongoing operations: Lifecycle management, monitoring, and continuous governance hygiene. 

These valuable services are typically scoped as workshops and assessments (diagnose and roadmap), governance and enablement (stand up the control plane and guardrails), managed services (run and improve continuously), advisory and readiness (operating model and adoption readiness), and security and integration (harden posture and integrate third-party agents.)

How to get started with Agent 365  

Agent 365 is now available in Microsoft 365 E7 or standalone at USD15 per user per month. Each Agent 365 license covers an individual who manages or sponsors agents, or uses agents to do work on their behalf, ensuring all agent activity is consistently governed across the organization in a way that’s predictable for scaled growth.  

In addition to the expertise of your Microsoft 365 team and partners, Agent 365 resources to support your experience include:

Plus, on Tuesday, May 12, 2026, a team of Agent 365 experts are hosting a live “Ask Microsoft Anything” to answer your questions about Agent 365—we hope you’ll join for the discussion.

Microsoft Agent 365

Now generally available for commercial customers.

Choose an ecosystem partner for agent security and governance

The post Microsoft Agent 365, now generally available, expands capabilities and integrations appeared first on Microsoft Security Blog.



from Microsoft Security Blog https://bit.ly/3RexduJ
via IFTTT

China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists

Cybersecurity researchers have disclosed details of a new China-aligned espionage campaign targeting government and defense sectors across South, East, and Southeast Asia, along with one European government belonging to NATO.

Trend Micro has attributed the activity to a threat activity cluster it tracks under the temporary designation SHADOW-EARTH-053. The adversarial collective is assessed to be active since at least December 2024, while sharing some level of network overlap with CL-STA-0049, Earth Alux, and REF7707.

"The group exploits N-day vulnerabilities in internet-facing Microsoft Exchange and Internet Information Services (IIS) servers (e.g., ProxyLogon chain), then deploys web shells (Godzilla) for persistent access and stages ShadowPad implants via DLL sideloading of legitimate signed executables," security researchers Daniel Lunghi and Lucas Silva said in an analysis.

Targets of the campaigns include Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan. The lone European country that features in the threat actor's victimology footprint is Poland.

The cybersecurity vendor said it observed nearly half the SHADOW-EARTH-053 targets, particularly those in Malaysia, Sri Lanka, and Myanmar, also compromised earlier by a related intrusion set dubbed SHADOW-EARTH-054, although no evidence of direct operational coordination has been observed.

The starting point of the attacks is the exploitation of known security flaws to breach unpatched systems and drop web shells like Godzilla to facilitate persistent remote access. The web shells function as a delivery vehicle for command execution, enabling reconnaissance and ultimately resulting in the deployment of the ShadowPad backdoor via AnyDesk. The malware is launched using DLL side-loading.

In at least one case, the weaponization of the React2Shell (CVE-2025-55182) is said to have facilitated the distribution of a Linux version of Noodle RAT (aka ANGRYREBEL and Nood RAT). It's worth mentioning here that the Google Threat Intelligence Group (GTIG) linked this attack chain to a group known as UNC6595.

Also put to use are open-source tunneling tools like the IOX, GO Simple Tunnel (GOST), and Wstunnel, as well as RingQ to pack malicious binaries and evade detection. To facilitate privilege escalation, SHADOW-EARTH-053 has been found to use Mimikatz, while lateral movement is accomplished using a custom remote desktop protocol (RDP) launcher and C# implementation of SMBExec known as Sharp-SMBExec.

"The primary entry vector used in this campaign were vulnerabilities in internet-facing IIS applications," Trend Micro said. "Organizations should prioritize applying the latest security updates and cumulative patches to Microsoft Exchange and any web applications hosted on IIS."

"In scenarios where immediate patching is not feasible, we strongly recommend deploying Intrusion Prevention Systems (IPS) or Web Application Firewalls (WAF) with rulesets specifically tuned to block exploit attempts against these known CVEs (Virtual Patching)."

GLITTER CARP and SEQUIN CARP Go After Activists and Journalists

The disclosure comes as the Citizen Lab flagged a new phishing campaign undertaken by two distinct China-affiliated threat actors targeting and impersonating journalists and civil society, including Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists. The wide-ranging campaigns were first detected in April and June 2025, respectively.

The clusters have been codenamed GLITTER CARP, which has singled out the International Consortium of Investigative Journalists (ICIJ), and SEQUIN CARP, whose main target was ICIJ journalist Scilla Alecci and other international journalists writing about topics of critical interest to the Chinese government.

"The actor employs well-thought-out digital impersonation schemes in phishing emails, including impersonation of known individuals and tech company security alerts," the Citizen Lab said. "Although the targeted groups vary, this activity employs the same infrastructure and tactics across all cases, frequently reusing the same domains and same impersonated individuals across multiple targets."

GLITTER CARP, besides conducting broad-scale phishing attacks, has been tied to phishing campaigns targeting the Taiwanese semiconductor industry. Some aspects of these efforts were previously documented by Proofpoint in July 2025 under the name UNK_SparkyCarp. SEQUIN CARP, on the other hand, shares similarities with a group tracked by Volexity as UTA0388 and an intrusion set detailed by Trend Micro as TAOTH.

The end goal of the campaigns is to obtain initial access to email-based accounts via credential harvesting, phishing pages, or by socially engineering the target into granting access to a third-party OAuth token. GLITTER CARP's phishing emails also involve the use of 1x1 tracking pixels that point to a URL on the attacker's domain to gather device information and confirm if they were opened by the recipients.

The Citizen Lab said it "observed concurrent targeting of specific organizations using both the AiTM phishing kit (GLITTER CARP, UNK_SparkyCarp) and the delivery of HealthKick using different phishing tactics by a separate group (UNK_DropPitch)." This indicates some level of overlap between these groups, it added, although the precise nature of the relationship remains unknown.

"Our analysis of the GLITTER CARP and SEQUIN CARP attacks shows that digital transnational repression increasingly operates through a distributed network of actors," the research unit said. "The targets we identified in both GLITTER CARP and SEQUIN CARP align with the intelligence priorities of the Chinese government."

"The breadth of targeting documented in this report and by others, combined with the available information on China's past and current use of contractors which mirrors the activity we have observed, suggests with a medium level of confidence that commercial entities hired by the Chinese state may have been behind both clusters of activity described here."



from The Hacker News https://bit.ly/3OzDh0g
via IFTTT

The Good, the Bad and the Ugly in Cybersecurity – Week 18

The Good | Authorities Dismantle State-Backed Espionage & Cybercrime Rings

This week, authorities successfully secured the extradition of Xu Zewei, an alleged Chinese Ministry of State Security (MSS) contract hacker, from Italy to the U.S. to face severe federal cyberespionage charges. Operating alongside the Silk Typhoon group, Xu systematically compromised internet-facing systems during a highly coordinated intelligence-gathering campaign between February 2020 and June 2021. The DoJ says that the attackers relentlessly targeted COVID-19 research organizations, stealing critical vaccine and treatment data by exploiting Microsoft Exchange Server zero day vulnerabilities and deploying malicious web shells for deep network access. Xu is set to appear in federal court where he faces multiple counts of computer intrusions and conspiracy.

Source: Italian Justice System

European law enforcement agencies have dismantled a widespread cryptocurrency investment fraud network responsible for inflicting over €50 million in estimated global losses. Operating almost identically to a legitimate enterprise, the syndicate employed up to 450 individuals across several specialized call centers located in Albania. Threat actors worked by luring vulnerable victims through online advertisements, assigning “retention agents” who wore down the targets through intense pressure and remote access software to manipulate deposits. Illicit funds were then channeled into international money-laundering pipelines to evade authorities worldwide.

Evan Tangeman is receiving a nearly six year prison sentence for laundering $230 million in a cryptocurrency heist that took place between October 2023 and May 2025. Based on court documents, attackers initially breached a Washington D.C. victim by aggressively impersonating Gemini customer support, leveraging remote desktop software to steal thousands of Bitcoin after bypassing two-factor authentication protocols. Tangeman systematically obfuscated the stolen proceeds through a network of cryptocurrency mixers, exchanges, and virtual private networks. The ill-got funds financed the criminal organization’s lavish lifestyle until his eventual arrest by law enforcement officials.

The Bad | New Report Shows Scammers Stole $2.1 Billion from Social Media Users

A new warning has come from the U.S. Federal Trade Commission (FTC) regarding a pointed surge in social media fraud, with reported consumer losses exceeding $2.1 billion in 2025. Representing an eightfold increase since 2020, malicious actors actively leveraged platforms like Facebook, Instagram, and WhatsApp to exploit nearly 30% of all fraud victims last year. Remarkably, individuals reported losing significantly more money to Facebook-originated schemes than to traditional text and email campaigns combined, establishing the platform as the primary threat vector for almost every age demographic.

Operating with a global reach and minimal overhead, threat actors systematically hijack legitimate user accounts, analyze personal posts to craft highly targeted social engineering lures, and actively purchase deceptive advertisements. These criminal syndicates utilize the exact same marketing tools legitimate businesses employ, filtering potential victims by age, precise interests, and specific shopping habits to maximize the returns.

In direct response to these findings, Meta has already removed more than 159 million scam advertisements and taken down nearly 11 million malicious accounts tied to criminal operations last year. Additionally, the tech giant has introduced advanced anti-scam protections across its product ecosystem, proactively flagging suspicious friend requests, implementing intelligent chat detection systems, and introducing critical screen sharing warnings on WhatsApp to disrupt fraudulent video calls.

To successfully navigate and mitigate social engineering tactics, federal authorities strongly urge users to strictly limit profile visibility, independently verify unfamiliar online vendors, and reject any unsolicited investment advice originating from unknown social media contacts.

The Ugly | Threat Actors Poison SAP-Related npm Packages in Supply Chain Attack

Cybersecurity researchers are tracking a highly sophisticated supply chain attack targeting SAP-related npm packages with credential-stealing malware. Dubbed “Mini Shai-Hulud”, the campaign recently compromised vital packages within SAP’s cloud application development ecosystem, including @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, @cap-js/sqlite@2.2.2, and mbt@1.2.48. Threat actors executed the breach by exploiting an npm OIDC trusted publishing configuration gap, allowing them to exchange a token and publish poisoned package versions to the registry.

Source: Aikido

Once installed, the malicious releases deploy a preinstall script acting as a runtime bootstrapper to immediately download and execute a platform-specific Bun binary. The malware then harvests local developer credentials, GitHub and npm tokens, GitHub Actions secrets, cloud secrets from major providers, and passwords across multiple web browsers. To establish persistence, the payload targets AI coding agent configurations by injecting malicious files into Claude Code and Visual Studio Code settings. This ensures automated execution whenever an infected repository is opened. To add to this, the malware deliberately terminates on Russian-locale systems, strongly linking the entire operation to previous TeamPCP threat actors.

The stolen data is securely encrypted using AES-256-GCM and exfiltrated to public GitHub repositories created on the victim’s own account. By leveraging GitHub as their primary command and control (C2) infrastructure, the attackers make tracing and blocking exfiltration exceptionally difficult for security and development teams.

Since the massive payload utilizes stolen tokens to aggressively self-propagate, injecting malicious workflows into newly discovered repositories further spreads the poisoned packages across environments. Package maintainers have rapidly released updated, safe versions of the affected software to immediately mitigate this expanding threat.



from SentinelOne https://bit.ly/48C7bHX
via IFTTT

Security Onion and Linux Kernel Copy Fail Vulnerability CVE-2026-31431

A flaw was found in the Linux kernel that allows for local privilege escalation:

https://access.redhat.com/security/cve/cve-2026-31431


Updated kernel packages should be coming soon to resolve this issue.


If you can't wait until updated kernels are released and need to apply a temporary mitigation, you can run the following command and then reboot:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"


After updated kernels are released, that temporary mitigation can be reverted by running the following command and then rebooting:

sudo grubby --update-kernel=ALL --remove-args="initcall_blacklist=algif_aead_init"

 



from Security Onion https://bit.ly/4cT8JzX
via IFTTT

Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks

The U.S. Department of Justice (DoJ) on Thursday announced the sentencing of two cybersecurity professionals to four years each in prison for their role in facilitating BlackCat ransomware attacks in 2023.

Ryan Goldberg, 40, of Georgia, and Kevin Martin, 36, of Texas, were accused of deploying the ransomware against multiple victims located throughout the U.S. between April and December 2023. The two defendants, who pleaded guilty to their crimes in December 2025, conspired with Angelo Martino, 41, of Florida, to conduct the attacks.

"The three men agreed to pay the ALPHV BlackCat administrators a 20% share of any ransoms received in exchange for access to the ransomware and ALPHV/BlackCat's extortion platform," the DoJ said.

"All three men worked in the cybersecurity industry – meaning that they had special skills and experience in securing computer systems against harm, including the type of harm they themselves were committing against the victims in this case."

In one case, the defendants are said to have successfully extorted a victim for approximately $1.2 million in Bitcoin, splitting their 80% share three ways and subsequently laundering the funds to cover up the tracks.

Although the BlackCat ransomware-as-a-service (RaaS) scheme no longer exists, the group is estimated to have targeted the computer networks of more than 1,000 victims around the world.

The development comes a week after Martino pleaded guilty to the same crime, and is scheduled to be sentenced in July 2026. In addition, Martino is said to have abused his role as a negotiator to extract higher payouts from victims by sharing confidential information about their insurance policy limits with the BlackCat operators.

Martino and Martin worked for DigitalMint, while Goldberg was employed as an incident response manager for cybersecurity company Sygnia.

"These defendants exploited specialized cybersecurity knowledge not to protect victims, but to extort them," said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida. "They used ransomware to lock down critical systems, steal sensitive data, and pressure American businesses into paying to regain access to their own information."



from The Hacker News https://bit.ly/4tM034k
via IFTTT

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence.

The activity has been attributed to the GitHub account "BufferZoneCorp," which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of writing, the packages have been yanked from RubyGems, and the Go modules have been blocked. The names of the libraries are listed below -

  • Ruby:
    • knot-activesupport-logger
    • knot-devise-jwt-helper
    • knot-rack-session-store
    • knot-rails-assets-pipeline
    • knot-rspec-formatter-json
    • knot-date-utils-rb (Sleeper gem)
    • knot-simple-formatter (Sleeper gem)
  • Go:
    • github[.]com/BufferZoneCorp/go-metrics-sdk
    • github[.]com/BufferZoneCorp/go-weather-sdk
    • github[.]com/BufferZoneCorp/go-retryablehttp
    • github[.]com/BufferZoneCorp/go-stdlib-ext
    • github[.]com/BufferZoneCorp/grpc-client
    • github[.]com/BufferZoneCorp/net-helper
    • github[.]com/BufferZoneCorp/config-loader
    • github[.]com/BufferZoneCorp/log-core (Sleeper module)
    • github[.]com/BufferZoneCorp/go-envconfig (Sleeper module)

The identified packages masquerade as recognizable and well-known modules like activesupport-logger, devise-jwt, go-retryablehttp, grpc-client, and config-loader so as to evade detection and trick users into downloading them.

"The account is part of a software supply chain campaign targeting developers, CI runners, and build environments across two ecosystems," Socket security researcher Kirill Boychenko said in an analysis published today.

The Ruby gems are designed to automate credential theft during install time, harvesting environment variables, SSH keys, AWS secrets, .npmrc, .netrc, GitHub CLI configuration, and RubyGems credentials. The stolen data is then exfiltrated to an attacker-controlled Webhook[.]site endpoint.

On the other hand, the Go modules harbor broader capabilities to tamper with GitHub Actions workflows, plant fake Go wrappers, steal developer data, and add a hard-coded SSH public key to "~/.ssh/authorized_keys" for remote access to the compromised host. The modules do not all have the same payload; instead, they are spread across the cluster.

"The module executes through init(), detects GITHUB_ENV and GITHUB_PATH, sets HTTP_PROXY and HTTPS_PROXY, writes a fake go executable into a cache directory, and appends that directory to the workflow path so the wrapper is selected before the real binary," Boychenko explained.

"That wrapper can then intercept or influence later go executions while still passing control to the legitimate binary to avoid breaking the job."

Users who have installed the packages are advised to remove them from their systems, review for signs of access to sensitive files or unauthorized changes to "~/.ssh/authorized_keys," rotate exposed credentials, and inspect network logs for outbound HTTPS traffic to the exfiltration point.



from The Hacker News https://bit.ly/4teDVOR
via IFTTT

Thursday, April 30, 2026

Btrfs vs ZFS: An In-Depth Comparison

Compare Btrfs and ZFS to understand their key differences in performance, architecture, and data integrity. Learn which filesystem fits your workload, from lightweight setups to enterprise storage.

For years most Linux machines just ran ext4. Drives were small, datasets were small, and the worst that usually happened was a power loss. That is no longer the world we work in. Drives got bigger, data picked up more value attached to it, and silent corruption stopped being a theoretical concern. So the question of “what filesystem do I run?” got more interesting, and Btrfs and ZFS are usually where the conversation lands.

Both are copy-on-write. Both check data with checksums, do snapshots, manage pools of disks, and try to use space efficiently. Same general targets – very different routes to get there.

Below is a real comparison: how each one performs, what features they actually ship, where they break, and which one fits which kind of workload.

What are Btrfs and ZFS?

 

Btrfs and ZFS file systems difference

Figure 1: Btrfs and ZFS file systems difference

 

Btrfs (B-tree File System) is a Linux-native file system. Oracle started it around 2007, and it has been part of mainline Linux kernel for years. It focuses on flexibility – snapshots, subvolumes, online resizing, RAID 0/1/10, and RAID 5/6 with caveats. Because it sits in the kernel, installing it is essentially nothing.

ZFS (Zettabyte File System) is older and much more mature. Sun Microsystems built it for Solaris in the early 2000s. After Oracle bought Sun, the open-source side continued as OpenZFS, and that is what almost everyone runs today. ZFS is built around data integrity and very large pools.

The easiest way to think about them: Btrfs is a filesystem with extra features. ZFS is a complete storage system that also includes a filesystem.

Origins and design philosophy

The two filesystems were designed with very different goals in mind, and you can still see those goals in how they work today.

Btrfs was built for Linux, by Linux developers. The idea was to bring modern filesystem features such as snapshots, checksums, and flexible pooling to the Linux kernel without the need for a separate volume manager. It is modular and designed to work alongside the rest of the Linux storage stack. That makes it easier to install and use, but it also means Btrfs relies on other kernel components for things like encryption.

ZFS was never meant to be just a filesystem. It combines the filesystem, volume manager, and software RAID layer into one integrated package. Such bundling is what makes ZFS reliable – the layers communicate directly, so corruption or hardware glitches do not slip between abstractions. The trade-off is that ZFS is heavier, more complex, and lives outside the Linux kernel because of license incompatibility (CDDL vs GPL).

Key differences between Btrfs and ZFS

On paper they look similar. Both are copy-on-write. Both do snapshots. Both checksum the data. Once you sit down with them, the differences are big enough to drive the choice.

Architecture: Btrfs is modular and lives in the kernel. It works alongside other Linux storage tools, and you can mix and match them – for example, using LUKS for encryption and Btrfs on top. ZFS is a fully integrated stack that handles storage from the physical disk all the way up to the filesystem. Disks, RAID, volumes, snapshots, and encryption – all live in one piece of software. This makes ZFS more capable out of the box, but also less flexible if you want to combine it with other tools. Btrfs trades some power for being easier to fit into a typical Linux setup.

Maturity: ZFS has been running production storage for over twenty years. Many companies use it to manage petabytes of data. That kind of mileage means most of bugs were fixed years ago. Btrfs is younger – it was declared stable for general use around 2014 and still has rough edges, especially around RAID 5/6. The core filesystem itself is solid these days, but anything off the well-trodden path is more likely to surprise you than ZFS will.

RAID: ZFS has its own RAID system, RAID-Z. It is one of the most trusted software RAID implementations out there, and it comes in three flavors – RAID-Z1, Z2, Z3 – differing in how many drives can fail before data is lost. Btrfs has its own RAID modes too. The simple ones (0, 1, 10) are fine. The parity ones (5 and 6) are still not considered production-ready. The Btrfs developers have been working on it for a long time, but as of now anyone who needs reliable parity RAID on Linux usually goes ZFS, or stacks Btrfs on top of mdraid.

Memory usage: ZFS is resource-intensive. It uses RAM aggressively for caching through the Adaptive Replacement Cache (ARC). The ARC keeps frequently used data in memory, so reads return almost instantly. This is a big reason why ZFS feels fast. The downside is that on a busy system, ZFS can consume gigabytes of RAM that other applications might need. However, you can set limits on memory usage to mitigate this. Btrfs is much lighter and runs comfortably on machines with limited memory. A small home server with 4 GB of RAM is no problem for Btrfs, while ZFS on the same machine may feel slow. If you are working with limited hardware, this difference alone can make the decision for you.

High-level comparison table

A quick side-by-side across the categories most people care about:

 

Btrfs ZFS
Architecture Modular, lives in Linux kernel Integrated stack, separate from kernel
Maturity Stable since ~2014, RAID 5/6 still rough 20+ years in production storage
RAID 0/1/10 solid; 5/6 not production-ready RAID-Z1/Z2/Z3, mirrors, all trusted
RAM footprint Light, fine on 4 GB boxes Heavy, ARC will eat what you give it
Native encryption No, use LUKS underneath Yes, per-dataset
Snapshots Subvolume snapshots, send/recv exists First-class, polished send/recv
Default in distros Fedora, openSUSE TrueNAS, Proxmox, ports for Ubuntu
License vs Linux GPL, in-tree CDDL, ships out-of-tree

 

Btrfs vs ZFS performance comparison

Performance is where people expect one to crush the other. In practice it depends entirely on the workload and how the pool is set up. Synthetic benchmarks rarely tell you anything useful here – what matters is how the filesystem behaves under your real workload.

ZFS is strong on large datasets and sequential I/O. Most of that comes from caching: the ARC in memory and the optional L2ARC on a fast SSD. ARC keeps hot data in RAM so repeat reads come back almost instantly; L2ARC extends that cache onto an SSD when working set is bigger than RAM. Given enough memory, ZFS read performance is very consistent.

Writes are a different story. Sequential writes are fine. Random writes are a weak point. Every write goes to a new location because of copy-on-write, which fragments the data over time and puts pressure on the disks. RAID-Z makes it worse, because small random writes often turn into full-stripe operations across every disk in a vdev. For random-heavy workloads – busy databases are the obvious example – mirrored vdevs perform far better than RAID-Z, and you need a lot of RAM to keep things smooth.

Synchronous writes deserve their own paragraph. A sync write is one the application requires to land on disk before continuing. Databases do this constantly to protect data. By default ZFS satisfies sync writes through the ZFS Intent Log (ZIL), which lives on the same drives as the data. Every sync write hits the disks twice, which is brutal on spinning rust. A separate log device (SLOG) on a fast SSD or NVMe drive moves the ZIL off the main pool so sync writes can be acknowledged quickly without stalling everything else. Without a SLOG, a database server on ZFS-on-spinning-disks can feel painful.

Btrfs is lighter and quicker to set up, which makes it feel snappier in casual use. There is no big cache to warm up and not much to tune. It also has its own performance limits. Heavy writes hurt – especially on spinning disks and especially with metadata-heavy workloads. The fragmentation problem that used to torture Btrfs is better than it used to be, but it still appears in database-style workloads where the same files are rewritten constantly. There is a nodatacow mount option that turns CoW off for specific files, which fixes the problem and also disables checksums for them. That kind of defeats one of the reasons you picked Btrfs in the first place. Random write performance is generally below ext4 or XFS, and unlike ZFS there is no caching layer or log device you can point at the problem.

For a desktop, a home server, or a small NAS, you probably will not notice much difference. The bottleneck is usually network or drives, not the filesystem.

For a busy database server with dozens of users, ZFS is usually the safer choice. Reasons are not purely technical – it has been in production for two decades, the community of admins who know how to tune it is large, and the documentation is extensive. When something goes wrong, the chance of finding an answer is much higher with ZFS than with Btrfs.

That said, ZFS is not a fix for everything. It cannot rescue a setup that does not have enough RAM or the right vdev layout, and a badly designed pool can perform worse than plain ext4 on the same hardware. ZFS rewards the people who learn it and punishes anyone treating it as a drop-in replacement.

Workload-based performance

Different workloads require different tools. Here is how the two filesystems handle common workloads:

Different workloads, different tools. Here is roughly how the two handle common patterns:

 

Btrfs ZFS
Sequential reads Fine, no real cache layer Excellent once ARC warms up
Random reads Decent on SSDs Strong, especially with L2ARC
Sequential writes Fine on SSDs, weaker on HDDs Fine, integrates well with vdevs
Random writes Weak point, fragments quickly Mirrored vdevs OK, RAID-Z is rough
Database (sync writes) Use nodatacow, lose checksums Needs SLOG to be usable on HDDs
Lots of small files Reasonable Reasonable, tune recordsize
VM image storage Subvolumes work well zvols are first-class for this

 

SSD optimization: Both filesystems support TRIM and work fine on SSDs. ZFS offers more tuning options – you can adjust record sizes, enable specific caches, and tweak compression per dataset. Btrfs is simpler but performs well on SSDs with default settings.

Features comparison: Btrfs vs ZFS

Both filesystems have many modern features, but the quality and depth of those features vary. Here are the most important ones and how they compare:

 

Feature Btrfs ZFS
Snapshots Yes, fast and simple to create Yes, mature and integrated with send/receive
Compression Yes (zlib, LZO, Zstd) Yes (LZ4, Zstd, gzip) – more mature implementation
Deduplication Limited (offline dedup tools only) Native inline deduplication (RAM-heavy)
RAID 0 / 1 / 10 Yes, stable Yes, stable
RAID 5 / 6 Available but not production-ready RAID-Z1, Z2, Z3 – all production-ready
Encryption Relies on dm-crypt / LUKS Native encryption built in
Online resize Grow and shrink Grow only

 

ZFS features are generally more integrated and production-hardened, while Btrfs focuses on flexibility and ease of use. The sections below break down how these differences play out.

Snapshots: Both filesystems create snapshots in seconds and use almost no extra space at first. ZFS snapshots are a bit more polished – you can send them to another machine over the network with a single command, which is very useful for backups and replication. Btrfs offers similar functionality, but the tooling is less refined.

Compression: Both support modern compression algorithms like Zstd and LZ4. In practice, ZFS compression tends to be more tunable. You can set it per dataset and get very good control over the setup. Btrfs compression is simpler and works well out of the box.

Deduplication: This is where ZFS has a clear advantage. It can deduplicate data inline as you write it, saving space automatically. The downside is that it requires a significant amount of RAM. A common rule of thumb is roughly 5 GB per 1 TB of deduplicated data. Btrfs does not have native inline deduplication. You can use offline tools like duperemove, but this is a separate process rather than an integrated feature.

RAID: ZFS wins here. RAID-Z is well-trusted and very good at handling drive failures. Btrfs RAID 1 and 10 are solid, but RAID 5 and 6 still have known data loss risks in certain failure scenarios. If you need parity RAID, ZFS is the clear choice between the two.

Copy-on-write and snapshots explained

 

Copy-on-write makes snapshots cheap and crashes safe.

Figure 2. Copy-on-write makes snapshots cheap and crashes safe.

 

Copy-on-write (CoW, for short), is the most important feature that makes these filesystems special. When you change a file on a CoW filesystem, the original data is not overwritten. Instead, the new data is written to a new location, and the filesystem updates its internal pointers to use the new version.

This sounds like a small detail, but it unlocks three big benefits:

  • Instant snapshots: Because the old data is still there, taking a snapshot is almost free. The filesystem just remembers where the old pointers were. No data is copied, and no space is used until you start making changes.
  • Efficient backups: Because the filesystem tracks which blocks changed since the last backup, it can send just those changed blocks to a backup target. Instead of copying entire files every time, you send small differences. This makes incremental backups fast and efficient in terms of bandwidth.
  • Crash consistency. Writes always go to new locations first, so a crash mid-write cannot corrupt data already on disk. Either the whole change is committed or none of it is. No half-written files.

This approach has a small downside. Over time, CoW can fragment data more than traditional filesystems. Both Btrfs and ZFS have mitigations for this, but it is something to be aware of if you store large files that change frequently.

Scalability and storage architecture

Scale is one of the clearest differences between ZFS and Btrfs.

ZFS was built for large-scale environments from day one. It uses 128-bit addressing, which means the theoretical maximum storage size is enormous. In practice, ZFS manages petabyte-scale storage pools without issues. Enterprise storage systems built on ZFS can easily manage dozens of drives in a single pool.

Btrfs also scales well, but less predictably. It is comfortable with multi-terabyte volumes and works fine on home NAS setups with up to a dozen drives or so. Beyond that, Btrfs is less proven. There are fewer Btrfs implementations at true enterprise scale, and its RAID limitations hold it back in larger setups.

Storage pool vs filesystem approach

One of the biggest differences between the two is how they manage multiple disks.

 

ZFS gives you an explicit pool layer, while Btrfs collapses the pool into the filesystem and uses subvolumes for organization.

Figure 3. ZFS gives you an explicit pool layer, while Btrfs collapses the pool into the filesystem and uses subvolumes for organization.

 

ZFS uses storage pools, called zpools. You add disks to a pool, and the pool presents itself as one giant storage resource. From there, you create datasets and volumes on top of the pool. You can add more disks later, create as many datasets as you want, and apply different settings (compression, quotas, snapshots) to each dataset.

Btrfs manages everything at the filesystem level. You do not really have pools like in ZFS. Instead, a Btrfs filesystem can span multiple devices, and you use subvolumes to organize them. Subvolumes are lightweight and flexible, but the overall arrangement feels more improvised compared to the clean separation you get with ZFS zpools.

For someone just getting started, the Btrfs approach is probably simpler. For anyone managing large storage, the ZFS pool architecture is better in the long run.

Data integrity and reliability

If there is one area where these file systems show their strengs, it is data integrity. Both use checksums to detect corruption, and both can repair damaged data, but they do it in different ways.

ZFS uses end-to-end checksums. Every block of data and every block of metadata is checksummed. When ZFS reads a block, it verifies the checksum. If something does not match, ZFS knows the data is corrupt. In a redundant setup (mirror or RAID-Z), ZFS then takes a good copy from another drive and replaces the bad one. This is called self-healing, and it happens automatically in the background.

Btrfs also uses checksums, but its self-healing capability depends on the RAID mode. When Btrfs reads a file, it compares the data against its stored checksum. If they do not match, Btrfs knows that the block is corrupt. In RAID 1 and RAID 10, there is a second copy of every block on another drive, so Btrfs can take the good copy and automaticaly overwrite the bad one. In RAID 5 and 6, the story is messier. Btrfs is supposed to use parity data to rebuild the corrupted block, but there are known issues with how it handles parity in certain failure situations. That is why those layouts are still not recommended for production.

Bit rot protection and self-healing

Bit rot is the slow, silent corruption of data on storage media. It eventualy happens to every drive. Without a filesystem that checks its own data, files can degrade in the background for years without anyone noticing. The problem usually appears only when something important fails to open.

 

The self-heal flow looks similar on paper. The differences are in coverage and RAID modes you can trust.

Figure 4. The self-heal flow looks similar on paper. The differences are in coverage and RAID modes you can trust.

 

ZFS was designed with this problem in mind. It runs regular scrubs. A scrub is a background scan that reads every block, verifies every checksum, and fixes any corruption it finds. If you run ZFS on a mirrored or RAID-Z pool, bit rot is essentially a solved problem. You will read about corruption in the logs, and the filesystem will fix it for you.

Btrfs has the same scrub feature and handles bit rot well on RAID 1 and RAID 10. On single-drive setups, it can detect corruption but cannot repair it (there is no redundant copy available). For most users running redundant setups, Btrfs scrubs are reliable and work as expected.

Quick summary: Both filesystems protect against bit rot far better than ext4 or XFS. ZFS is a little more thorough and polished. Btrfs gets you 90 percent of the way with less complexity.

Ease of use and management

This is where Btrfs and ZFS differ. One is in your kernel and ready to use. The other takes some work to install, but the tools are very good once you have it.

Btrfs is very simple to start with. Every mainstream Linux distribution ships it in the kernel. Fedora and openSUSE use it by default for the root filesystem. To create a Btrfs volume, you just run mkfs.btrfs and mount it. Snapshots are a one-line command. Most of what you need is already there, and the tools follow standard Linux conventions.

ZFS requires more effort to install on Linux. Because of its licensing, ZFS cannot be shipped inside the Linux kernel. You install OpenZFS as a separate package, and on some distributions, you need to rebuild the module when the kernel updates. Once it is installed, the command-line tools are very good. zpool and zfs are among the best-designed storage commands in any operating system.

Administrative complexity

Managing storage at scale is always a challenge. Here is how the two filesystems compare in day-to-day tasks:

 

Task Btrfs ZFS
Create filesystem One command (mkfs.btrfs) Two commands (zpool create + zfs create)
Take a snapshot btrfs subvolume snapshot zfs snapshot
Send to another host btrfs send | btrfs receive zfs send | zfs receive (more features)
Add disk to pool btrfs device add zpool add
Replace failed disk btrfs replace zpool replace
Monitoring btrfs scrub status, dmesg zpool status (cleaner output)
Learning curve Gentle Steeper but well documented

 

ZFS has a reputation for complexity, but that reputation is somewhat unfair. The tools themselves are very clean. For example, zpool status gives you an immediate health snapshot of your entire storage setup. The complexity mainly comes from the concepts (pools, vdevs, datasets, volumes), rather than the commands themselves.

Btrfs is simpler on the surface, but it can become confusing when something goes wrong. Error messages are often unclear, and recovery tools are less mature. For most day-to-day use, Btrfs is easier. For debugging a failing array, ZFS provides clearer and more informative results.

Use cases: When to choose Btrfs or ZFS

After all this discussion, the real question is: which one should you actually use? The answer depends on what you are building.

Choose Btrfs if you want the following:

  • A simple snapshot for your desktop or laptop. It integrates well with tools like Snapper and Timeshift, giving you easy rollback after bad updates.
  • A standard Linux distribution without dealing with external modules or extra packages.
  • Lightweight filesystem management on a modest server with limited RAM.
  • A small to medium-sized NAS with RAID 1 or RAID 10.
  • Subvolumes for organizing container storage, VM images, or development branches.

Choose ZFS if:

  • You need maximum data integrity. It is a gold standard for protecting data against silent corruption.
  • You run an enterprise or large-scale storage environment where downtime is not an option.
  • You require advanced RAID and want to trust your parity RAID.
  • You are building a backup server or a replication target. ZFS send/receive is a good replication tool.
  • You run workloads where consistent sequential performance matters more than simplicity.
  • You have plenty of RAM and want to take advantage of the ARC cache for faster reads.

There is also a middle ground worth mentioning. Many home labs and NAS appliances use ZFS because the appliance handles the complexity for you. You get the benefits of ZFS without having to manage it all manually.

Challenges and limitations

Neither filesystem is perfect. Both have real drawbacks that you should understand before committing.

Btrfs has a RAID 5 and RAID 6 problem. For years, these parity layouts had a known issue called the write hole, where a crash during a write could cause data corruption. The Btrfs developers have improved it, but the official project page still warns against using RAID 5 or 6 for important data. If you need parity RAID on Btrfs, most people recommend using it on top of a traditional RAID like mdraid, but this defeats part of its design.

ZFS has a significant memory appetite. The ARC cache will happily consume most of your system RAM if you let it. A common rule is to assign 1 GB of RAM per 1 TB of storage, and that is before enabling deduplication. This is not a problem on a dedicated storage server, but it requires planning.

ZFS also has a licensing issue on Linux. It is released under the CDDL, which is not compatible with the GPL license that governs the Linux kernel. As a result, ZFS cannot be shipped as part of the kernel. You have to install OpenZFS separately and rely on your distribution to keep it up to date as the kernel evolves. This is mostly a paperwork problem, but it creates some friction.

Known issues and trade-offs

These are not deal-breakers, but they are practical limitations that tend to surface once you move beyond basic setups:

  • ARC memory overhead: The ARC is a key reason ZFS performs well, but it also means ZFS does not perform in the same way on memory-limited systems. You can limit ARC size through kernel parameters, but doing so sacrifices some of the performance benefits. On a machine with 8 GB of RAM running a lot of other software, this can be annoying.
  • Kernel integration: Because ZFS lives outside the Linux kernel, it can lags behind new kernel releases. If you run a bleeding-edge distribution, you may occasionally end up with a kernel that OpenZFS has not caught up to yet. Stable distributions like Ubuntu LTS or Debian handle this better.
  • Btrfs recovery tools: When a Btrfs filesystem goes bad, recovery can be painful. The tools exist, but they are less polished than ZFS tools, and the community knowledge base is smaller. Maintaining good backups is very important with Btrfs.
  • Shrinking a zpool: ZFS does not allow easy shrinking of a storage pool. You can add drives, but removing them from most vdev types is either impossible or very limited.

Future of Btrfs and ZFS

Both are actively developed and have strong communities behind them, but they are heading in slightly different directions.

ZFS is going deeper. OpenZFS keeps adding enterprise features – persistent L2ARC, improved encryption, raw encrypted send/receive, better support for high-performance NVMe setups. TrueNAS, Proxmox, and other storage platforms rely on ZFS, which means continued investment and refinement. ZFS is not going anywhere in enterprise segment of the market.

Btrfs is going broader. Major distributions keep adopting it. openSUSE made Btrfs the default years ago. Fedora switched to Btrfs as the default for its workstation edition in 2020. Ubuntu has been steadily expanding its support. Development effort focuses on stability, performance, and eventually fixing the RAID 5/6 issues. Btrfs is becoming the default modern filesystem for Linux desktops.

Conclusion

So which one is better? The honest answer is: neither. They are built for different jobs.

ZFS is the right choice when reliability and “enterprise-grade” is the hard requirement. If you are managing a big server, running databases under heavy load, or just want the most robust filesystem money can buy (well, download), ZFS is your choice. Complexity is real, RAM appetite is real, but the payoff is a storage system that takes care of your data better than almost anything else.

Btrfs is the right choice when flexibility and ease of use matter more. For Linux desktops, home servers, and anywhere you want modern filesystem features without the operational overhead, Btrfs does the job. It is already in your kernel, works with standard Linux tools, and gives you all necessary tools with almost no setup.

Both filesystems are far ahead of the old standards like ext4 in terms of what they can do. Whichever one you choose, you are in a good company. The key is to pick the one that fits your workload, your hardware, and your operational comfort level. That is what actually makes the difference.



from StarWind Blog https://ift.tt/MbfSs9e
via IFTTT