IO_URING IS BACK, THIS TIME AS A ROOTKIT

Summary from the TLDR InfoSec newsletter

ARMO researchers exposed a critical security gap where Linux runtime security tools fail to detect malware using the io_uring interface. Their proof-of-concept rootkit, "Curing," bypasses traditional system call monitoring, affecting tools such as Falco and Microsoft Defender. While some vendors have implemented fixes, most security solutions remain vulnerable to this evasion technique.