A proof-of-concept rootkit called Curing can bypass traditional system call monitoring using a Linux asynchronous I/O mechanism, called io_uring. Security research firm ARMO found such use of io_uring leaves a gap in Linux security tools, with actions not showing as system calls. Current tools, including Falco and Tetragon, are found to be blind to io_uring-based operations due to their reliance on system call hooking.
Microsoft Teams To Block Screen Capture During Meetings
Microsoft will launch a “Prevent Screen Capture” feature for Teams in July 2025 to block unauthorized screenshots during meetings, addressing a key vulnerability. The feature
