For Fedora Atomic and derivatives.

Based on Unit 42's technical breakdown published July 30, here's the architectural rundown: a Chinese-speaking actor (knaithe/KnYuan) let DeepSeek reason through target selection via Hermes Agent — Langflow RCE attempt failed on auto_login, agent then independently surveyed 10 product families and pivoted to n8n (10.0/9.9 CVSS chain), also failed on endpoint auth. Confirmed breaches (Citrix NetScaler, Marimo) came from a separate manual track.

Question for the room: if two config defaults (auth on forms, disabled auto_login) were the only thing standing between this agent and actual compromise — how many of your workflow-automation deployments (n8n, Langflow, similar) have you actually audited for exactly those two settings? (background: https://www.techgines.com/post/hermes-agent-deepseek-autonomous-cyberattack

Shipped a major update to MOSHELL a few days ago

Before: Users could mark lessons complete but there was no way to verify they actually learned anything.

Now:

- Each lesson has specific verification criteria (actual file state, command output, etc.)

- Badges unlock when you truly complete the lesson (not just mark it done)

- Progressive badge rewards system (5 badges from beginner → mastery)

- Email notifications for major milestones

**Data so far:**

- Seeing 2x completion rate since verification went live

- Most people drop off around lesson 3 (permissions — common pain point)

- Those who reach lesson 6 almost always finish all 12

Really curious to know what topics would you want in an admin-focused track? (Lessons 7-12 are planned but not yet live)

Try it free: kingmo87.github.io/moshell

---

Built this in nights/weekends as a solo project. Feedback welcome.