DEV Community: Aditya Pidurkar

Installing Apache Hadoop 3.4.2 on Linux 2026 (Single Node Cluster) Complete Step-by-Step Guide

Aditya Pidurkar — Wed, 29 Jul 2026 22:21:03 +0000

S1. Update the System

Before installing Hadoop, update your system packages.

sudo apt update
sudo apt upgrade -y

S2. Install and Configure Java 21

Apache Hadoop is written in Java and requires a compatible Java Runtime Environment (JRE) and Java Development Kit (JDK).

This guide uses OpenJDK 21 (LTS).

Java Compatibility

Installed Java Version	Action
Java 21	Continue with the installation
Java 17	May work with some Hadoop versions, but this guide uses Java 21
Java 22–25	Install Java 21 and switch to it
Java Not Installed	Install OpenJDK 21

S2.1 Check if Java is Installed

java -version
javac -version

If Java is NOT Installed

Install OpenJDK 21.

sudo apt update
sudo apt install openjdk-21-jdk -y

Verify the installation.

java -version
javac -version

If Java is Already Installed

Check the installed version.

java -version
javac -version

Compare the output with the compatibility table above.

If Java 21 is already active, continue to the next step.

Otherwise, switch to Java 21.

S2.2 List All Installed Java Versions

update-java-alternatives -l

Example:

java-1.17.0-openjdk-amd64
java-1.21.0-openjdk-amd64

S2.3 Switch to Java 21

sudo update-alternatives --config java
sudo update-alternatives --config javac

Select the option corresponding to Java 21.

S2.4 Verify the Active Java Version

java -version
javac -version

Both commands should display Java 21.

S2.5 Find the Correct JAVA_HOME

Different Linux distributions may install Java in different directories.

Instead of copying someone else's path, determine it automatically.

readlink -f $(which java)

Example:

/usr/lib/jvm/java-21-openjdk-amd64/bin/java

Therefore,

JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64

Note: Never blindly copy the JAVA_HOME path from a tutorial. Always determine it using the command above.

S3. Download Apache Hadoop 3.4.2

Move to the directory where you want to download Hadoop.

cd ~/Downloads

Download Hadoop from the official Apache Archive.

wget https://archive.apache.org/dist/hadoop/common/hadoop-3.4.2/hadoop-3.4.2.tar.gz

Verify the download.

ls -lh hadoop-3.4.2.tar.gz

Expected output:

-rw-r--r-- 1 user user 734M hadoop-3.4.2.tar.gz

S4. Extract and Install Hadoop

After downloading the Hadoop archive, the next step is to extract it and install Hadoop on your system.

In this guide, Hadoop will be installed under /opt/hadoop, which is the standard location for optional third-party software on Linux.

S4.1 Extract the Archive

Move to the directory where the archive was downloaded.

cd ~/Downloads

Extract the archive.

tar -xvzf hadoop-3.4.2.tar.gz

This will create a directory named:

hadoop-3.4.2

Verify the extraction.

ls

Expected output:

hadoop-3.4.2
hadoop-3.4.2.tar.gz

S4.2 Move Hadoop to /opt

Move the extracted directory to /opt.

sudo mv hadoop-3.4.2 /opt/hadoop

S4.3 Verify the Installation Directory

Check that Hadoop has been moved successfully.

ls /opt

Expected output:

hadoop

View the contents of the Hadoop directory.

ls /opt/hadoop

Expected output:

bin
etc
include
lib
libexec
licenses
sbin
share
NOTICE.txt
README.txt
...

S4.4 Change Ownership

By default, the Hadoop directory is owned by the root user because it was moved using sudo.

Change the ownership so your user can modify the configuration files without requiring root privileges every time.

sudo chown -R $USER:$USER /opt/hadoop

Verify the ownership.

ls -ld /opt/hadoop

Example output:

drwxr-xr-x <username> <username> ...

S4.5 Verify the Hadoop Version

Run the Hadoop executable directly.

/opt/hadoop/bin/hadoop version

Expected output:

Hadoop 3.4.2
Source code repository ...
Compiled by ...

At this point, Hadoop has been successfully installed on the system. However, it cannot yet be executed from any directory because its binaries have not been added to the system's PATH.

Note: We are intentionally using the full path (/opt/hadoop/bin/hadoop) for now. In the next section, we will configure environment variables so that the hadoop, hdfs, and yarn commands can be run from anywhere in the terminal.

S5. Configure Environment Variables

After installing Hadoop, we need to configure environment variables. These variables tell the operating system where Hadoop and Java are installed, allowing Hadoop commands to be executed from any directory.

The main environment variables are:

Variable	Purpose
`JAVA_HOME`	Points to the Java installation directory
`HADOOP_HOME`	Points to the Hadoop installation directory
`HADOOP_CONF_DIR`	Specifies the Hadoop configuration directory
`PATH`	Allows Hadoop commands to be executed from anywhere

S5.1 Check Your Default Shell

Before editing your shell configuration, determine which shell you are using.

echo $SHELL

Possible outputs:

/bin/bash

/bin/zsh

S5.2 Open the Shell Configuration File

If you are using Bash

nano ~/.bashrc

If you are using Zsh

nano ~/.zshrc

S5.3 Add the Hadoop Environment Variables

Append the following lines to the end of the file.

# Java
export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))

# Hadoop
export HADOOP_HOME=/opt/hadoop
export HADOOP_CONF_DIR=$HADOOP_HOME/etc/hadoop

# Hadoop Components
export HADOOP_COMMON_HOME=$HADOOP_HOME
export HADOOP_HDFS_HOME=$HADOOP_HOME
export HADOOP_MAPRED_HOME=$HADOOP_HOME
export YARN_HOME=$HADOOP_HOME

# Native Libraries
export HADOOP_COMMON_LIB_NATIVE_DIR=$HADOOP_HOME/lib/native

# PATH
export PATH=$PATH:$HADOOP_HOME/bin:$HADOOP_HOME/sbin

Why use `$(dirname $(dirname $(readlink -f $(which java))))`?

Instead of hardcoding the Java installation path, this command automatically determines the correct JAVA_HOME directory. This makes the guide more portable across different Linux distributions and Java installation methods.

S5.4 Save the File

For Nano:

Press Ctrl + O
Press Enter
Press Ctrl + X

S5.5 Reload the Configuration

Bash

source ~/.bashrc

Zsh

source ~/.zshrc

S5.6 Verify the Environment Variables

Check that Hadoop is configured correctly.

echo $JAVA_HOME

Example:

/usr/lib/jvm/java-21-openjdk-amd64

Check the Hadoop installation directory.

echo $HADOOP_HOME

Expected output:

/opt/hadoop

Check the configuration directory.

echo $HADOOP_CONF_DIR

Expected output:

/opt/hadoop/etc/hadoop

S5.7 Verify Hadoop Commands

You should now be able to run Hadoop commands from any directory.

Check the Hadoop version.

hadoop version

Check the HDFS version.

hdfs version

Check the YARN version.

yarn version

Each command should report Hadoop 3.4.2.

Note: If any of these commands return command not found, ensure that the shell configuration file has been reloaded using the source command or open a new terminal session.

S6. Configure Passwordless SSH

Apache Hadoop uses SSH to start and stop its daemons. Even in a single-node cluster, passwordless SSH is required for Hadoop scripts such as start-dfs.sh and start-yarn.sh.

S6.1 Check if OpenSSH is Installed

Run the following command:

ssh -V

If OpenSSH is installed, you will see output similar to:

OpenSSH_10.x

If the command is not found, install the OpenSSH server.

sudo apt update
sudo apt install openssh-server -y

S6.2 Start and Enable the SSH Service

Start the SSH service.

sudo systemctl start ssh

Enable it to start automatically on boot.

sudo systemctl enable ssh

Check the service status.

sudo systemctl status ssh

The status should show active (running).

Exit the status screen by pressing Q.

S6.3 Generate an SSH Key Pair

If you do not already have an SSH key, generate one.

ssh-keygen -t rsa -b 4096

When prompted for the file location, simply press Enter to accept the default location.

When prompted for a passphrase, press Enter twice to leave it empty.

Example:

Enter file in which to save the key:
/home/<username>/.ssh/id_rsa

S6.4 Enable Passwordless SSH

Append the public key to the authorized keys file.

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

Set the correct permissions.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

S6.5 Test the SSH Connection

Run:

ssh localhost

The first time you connect, you may see:

Are you sure you want to continue connecting (yes/no)?

Type:

yes

If everything is configured correctly, you will be logged into your own machine without entering a password.

Exit the SSH session.

exit

Why is Passwordless SSH Required?

Hadoop's management scripts use SSH to launch and stop services such as the NameNode, DataNode, ResourceManager, and NodeManager. Without passwordless SSH, these scripts will repeatedly prompt for a password, making automated startup impossible.

S7. Create Hadoop Data Directories

Hadoop requires a few directories to store its metadata and temporary files. These directories are referenced by the Hadoop configuration files.

Create the required directories by running the following commands:

mkdir -p ~/hadoopdata/namenode
mkdir -p ~/hadoopdata/datanode
mkdir -p ~/hadooptmp

You can verify that the directories were created successfully using:

tree -L 2 ~

If the tree command is not installed, install it using:

sudo apt install tree -y

Expected output:

/home/<username>
├── hadoopdata
│   ├── datanode
│   └── namenode
└── hadooptmp

Note: The directory names must match the paths specified in the Hadoop configuration files (core-site.xml and hdfs-site.xml). If you changed those paths, create the directories accordingly.

S8. Install the Hadoop Configuration Files

Instead of manually editing multiple Hadoop configuration files, use the installation script provided in the GitHub repository. The script downloads and installs all the required configuration files automatically.

Download the installation script.

wget https://raw.githubusercontent.com/itsadityapidurkar/hadoop-installation-guide/main/linux/install-configs.sh

Make the script executable.

chmod +x install-configs.sh

Run the script.

./install-configs.sh

The script downloads and installs the following configuration files:

core-site.xml
hdfs-site.xml
mapred-site.xml
yarn-site.xml
workers

These files are automatically copied to:

/opt/hadoop/etc/hadoop

If the script completes successfully, you should see:

========================================
 Apache Hadoop Configuration Installer
========================================

[+] Downloading configuration files...
[✓] Download complete.

[+] Installing configuration files...

[✓] Configuration files installed successfully!

Installed to:
/opt/hadoop/etc/hadoop

Note: The provided configuration files are intended for a Single Node Hadoop 3.4.2 installation. If you modified the directory paths while following this guide, update the configuration files accordingly before installing them.

S9. Configure `hadoop-env.sh`

The hadoop-env.sh file is used to configure environment variables required by Hadoop. The only change required for this guide is to set the JAVA_HOME variable.

Open the file using a text editor.

nano /opt/hadoop/etc/hadoop/hadoop-env.sh

Search for the line containing:

export JAVA_HOME=

# export JAVA_HOME=

Replace it with:

export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))

Save the file and exit.

For Nano:

Press Ctrl + O
Press Enter to save the file.
Press Ctrl + X to exit.

You can verify that the JAVA_HOME path is detected correctly by running:

echo $(dirname $(dirname $(readlink -f $(which java))))

Example output:

/usr/lib/jvm/java-21-openjdk-amd64

Note: This command automatically detects the Java installation directory, making the configuration portable across different Linux distributions and Java installation paths.

S10. Format the NameNode

Before starting Hadoop for the first time, the NameNode must be formatted. This initializes the Hadoop Distributed File System (HDFS) and creates the required metadata.

Run the following command:

hdfs namenode -format

During the formatting process, you may be prompted with the following message if the NameNode directory already contains data:

Re-format filesystem in Storage Directory root=... ? (Y or N)

Type:

and press Enter.

If the formatting is successful, the last few lines of the output should look similar to:

...
INFO common.Storage: Storage directory ... has been successfully formatted.
INFO namenode.FSImageFormatProtobuf: Saving image file ...
INFO namenode.NameNode: SHUTDOWN_MSG:

Important: Formatting the NameNode permanently removes all existing HDFS metadata and data stored in the configured NameNode and DataNode directories. This command should only be executed during the initial setup or when you intentionally want to reset the Hadoop cluster. Do not run this command every time you start Hadoop.

S11. Start HDFS

Now that the NameNode has been formatted, you can start the Hadoop Distributed File System (HDFS).

Run the following command:

start-dfs.sh

If HDFS starts successfully, you should see output similar to:

Starting namenodes on [localhost]
Starting datanodes
Starting secondary namenodes [<hostname>]

To verify that all HDFS daemons are running, execute:

jps

Expected output:

NameNode
DataNode
SecondaryNameNode
Jps

Note: The order of the processes may vary depending on your system.

You can also verify that the NameNode is running by opening the following URL in your web browser:

http://localhost:9870

If HDFS has started successfully, the NameNode web interface will be displayed, showing information about the cluster, storage usage, live DataNodes, and the HDFS filesystem.

S12. Start YARN

After starting HDFS, the next step is to start YARN (Yet Another Resource Negotiator), which is responsible for resource management and job scheduling in the Hadoop cluster.

Run the following command:

start-yarn.sh

If YARN starts successfully, you should see output similar to:

Starting resourcemanager
Starting nodemanagers

To verify that the YARN daemons are running, execute:

jps

Expected output:

NameNode
DataNode
SecondaryNameNode
ResourceManager
NodeManager
Jps

Note: The order of the processes may vary depending on your system.

You can also verify that YARN is running by opening the following URL in your web browser:

http://localhost:8088

If YARN has started successfully, the ResourceManager web interface will open, displaying information about the cluster, available resources, running applications, and node status.

At this point, your Hadoop Single Node Cluster is up and running.

S13. Verify the Hadoop Installation

After starting both HDFS and YARN, verify that all Hadoop services are running correctly.

Check the running Hadoop daemons.

jps

Expected output:

NameNode
DataNode
SecondaryNameNode
ResourceManager
NodeManager
Jps

View the HDFS cluster report.

hdfs dfsadmin -report

If the cluster is running correctly, the report will display information about the configured capacity, remaining storage, live DataNodes, and other cluster details.

Next, open the NameNode Web UI in your browser.

http://localhost:9870

The NameNode dashboard should display information such as:

Cluster Summary
Live DataNodes
Storage Information
HDFS Overview

Then open the ResourceManager Web UI.

http://localhost:8088

The ResourceManager dashboard should display:

Cluster Metrics
Node Status
Running Applications
Available Resources

If all the above commands and web interfaces are accessible, your Hadoop Single Node Cluster has been installed and configured successfully.

Hadoop Web UI Port Quick-Reference

Service	Web UI URL	Default Port	Description
HDFS NameNode	`http://localhost:9870`	9870	File system status, capacity, browser directories
YARN ResourceManager	`http://localhost:8088`	8088	Job executions, node resource allocation
HDFS DataNode	`http://localhost:9864`	9864	Individual DataNode status & blocks

S14. Shut Down the Hadoop Cluster

To stop the Hadoop daemons and release system resources safely, stop the YARN resource manager and HDFS services in order.

Run the following commands:

stop-yarn.sh
stop-dfs.sh

To verify that all Hadoop services have been stopped successfully, run:

jps

Expected output:

Jps

Only the Jps process itself should be running, confirming that HDFS and YARN have successfully shut down.

wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell

Aditya Pidurkar — Wed, 22 Jul 2026 21:49:38 +0000

Okay, so if you run anything on WordPress, or manage servers for people who do, you've probably already seen this name floating around: wp2shell. It's been viral in every infosec feed for the past few days, and if you haven't patched yet, stop reading in about two minutes and go do that first. I'll wait.

Here's one guide by me summarising from sources how to safeguard

Aditya Pidurkar

Jul 22

How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

#wordpress #wp2shell #cve #cybersecurity

5 min read

Back? Good. Let's actually talk about what this thing is, because most of the coverage I've seen either buries the interesting part under fifteen paragraphs of CVE numbers, or oversimplifies it into "WordPress bad, update now" without explaining why this one is actually worth your attention.

So what actually happened here

On July 17, WordPress quietly shipped 6.9.5 and 7.0.2. Nothing unusual about a point release — except this one came with forced background updates turned on, which WordPress basically never does unless something is genuinely on fire. And something was.

A researcher named Adam Kues, working under Searchlight Cyber's Assetnote arm, had found a way to get remote code execution on a completely default WordPress site. No plugins. No theme customizations. No login. Just an anonymous HTTP request against a fresh install, and you're running code on someone's server. That's about as bad as it gets for a CMS that a huge chunk of the internet runs on.

He did the responsible thing — reported it quietly through HackerOne, gave WordPress time to patch, and didn't publish exploit details right away. Instead his team put up a little checker site (wp2shell.com) so admins could test if they were exposed without anyone needing to hand out a working exploit to the entire internet. Genuinely good disclosure hygiene, and worth calling out because it doesn't always go that way.

Why "wp2shell" and not just a CVE number

Because it's not one bug, it's two, chained together — and the chaining is what makes it dangerous.

Bug one lives in the REST API's batch endpoint (/wp-json/batch/v1), which has been sitting there, enabled by default, since 2020. Turns out the code validates requests and then executes them in two separate steps, and that gap between "checking" and "doing" is exactly the kind of seam attackers love. That's CVE-2026-63030.

Bug two is a SQL injection tucked into WP_Query — specifically how it handles the author__not_in parameter. WP_Query is about as core as core gets in WordPress; it's the thing behind almost every database call the CMS makes. On its own, this lets someone pull data out of the database, including password hashes. That's CVE-2026-60137.

Neither of those alone gets you a shell. Chained together, though, they do. You use the route confusion to reach code you shouldn't be able to reach, use the injection to leverage database access, and the end result is code execution on the server with zero credentials. Hence, "WordPress to shell." wp2shell.

Who's actually affected

If you're on anything from 6.9.0 to 6.9.4, or 7.0.0 to 7.0.1, you were sitting exposed. Fixed versions are 6.9.5 and 7.0.2. If you're still on the 6.8 branch, that's a separate story — you want 6.8.6 to close the standalone SQL injection piece, even though the full chain doesn't reach that far back.

Anything on 6.8.5 or earlier was never part of this particular mess.

Here's the part that should actually worry you

Disclosure was July 17. By the 18th through the 20th, security vendors were already confirming active exploitation in the wild. By the 21st, both CVEs landed on CISA's Known Exploited Vulnerabilities list. And the next day, Searchlight Cyber published the full technical breakdown, and public proof-of-concept code started showing up.

So the window between "this is theoretical" and "this is being actively abused" was something like 24-48 hours. That's the reality of vulnerability disclosure now — even with a responsible researcher holding back details, once WordPress ships a patch, people diff the code, figure out what changed, and reverse-engineer the bug faster than most orgs can even confirm their sites updated.

Which brings me to the thing I actually want you to take away from this post.

"Forced auto-update" doesn't mean "you're fine"

I get it, WordPress flipped the switch, sites update themselves in the background, problem solved, right? Except — managed hosting setups, staging environments, sites where someone installed a "disable auto-updates" plugin eleven months ago and forgot about it, sites where wp-config.php has auto-updates turned off for "stability" reasons... none of those get saved by the forced-update mechanism.

Go check your actual running version. Don't trust that it happened. wp-admin > Updates, or wp core version if you've got WP-CLI. It takes thirty seconds and it's the difference between "I patched" and "I assumed I patched."

If you genuinely can't update right this second — maybe there's a compatibility issue, maybe it's a change-freeze week, whatever — there are stopgaps: block anonymous access to the REST API at the WAF level, or specifically block /wp-json/batch/v1 and its query-string cousin ?rest_route=/batch/v1. Just know that'll probably break something else (the block editor, mobile apps, integrations), so treat it as a bandage, not a fix.

I menttioned more on this on the above post. Do check out.

the bigger point buried in all this

We spend so much energy auditing plugins because that's historically where WordPress compromises come from some abandoned plugin nobody updated since 2019. wp2shell is a good reminder that core itself isn't immune, and when core breaks, it doesn't matter how careful you were about plugin hygiene. Every default install in that version range was exposed, full stop.

Patch your version, verify it actually took, and if you were in the blast radius, assume compromise until you've checked. That's really the whole post.

Written off public reporting from SecurityWeek, The Hacker News, Rapid7, Strobes, Hadrian, SOCRadar, and Korben, current as of July 22-23, 2026. If you're reading this later, double-check the CVE status — it moves fast.

How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

Aditya Pidurkar — Wed, 22 Jul 2026 21:39:42 +0000

Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system?

So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit.

Need more context? I wrote a summarising one here.

Aditya Pidurkar

Jul 22

wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell

#wordpress #wp2shell #cybersecurity #cve

4 min read

S1: Stop assuming you're patched. Go check.

WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT.

Go look at your actual running version right now:

In the dashboard: wp-admin > Updates
Via WP-CLI, if you have shell access: wp core version

You want to see 7.0.2 if you're on the 7.0 line, or 6.9.5 if you're on 6.9.

If you see anything else — 6.9.0 through 6.9.4, or 7.0.0/7.0.1 — you're still exposed. Update it now!! Come back when done.

A few situations where the forced update quietly doesn't happen, in what I read on internet:

Managed hosting environments where the host controls the update pipeline and hasn't pushed it yet
Sites with a "disable auto-updates" plugin installed months ago for stability reasons and never revisited
wp-config.php with WP_AUTO_UPDATE_CORE explicitly set to false
Staging or dev environments nobody thinks of as "production" but that are still internet-facing

If any of that describes you, don't wait on the automation. Update manually.

S2: If you genuinely can't update right now, here's your stopgap

aybe you're facing a compatibility issue, a change freeze, or a custom plugin that isn't ready yet. It happens. If you need a little more time before applying the real fix, here's a workaround that helps.

Block anonymous access to the batch REST endpoint. The vulnerable surface is specifically /wp-json/batch/v1 and its query-string equivalent, ?rest_route=/batch/v1. You can handle this a couple of ways:

At your WAF or reverse proxy (Cloudflare, Nginx, whatever sits in front of your site) — block or challenge requests to those paths from unauthenticated traffic
With a plugin that restricts REST API access to logged-in users only

I want to be upfront about the tradeoff here: both of these can break legitimate things. The block editor uses REST endpoints. So do a lot of mobile apps and third-party integrations. This is a temporary bandage, not a real fix — treat it that way and get back to updating properly as soon as you can.

If you're behind Cloudflare, also check whether their managed ruleset for this specific vulnerability is switched on for your zone. They shipped detection rules pretty quickly after disclosure.

S3: Figure out if you were already hit

This is the part almost everyone skips, and it's the part that actually matters if your site was sitting in an affected version between when this became exploitable and when you patched.

Quick gut check on timeline: disclosure was July 17. In-the-wild exploitation was confirmed within days of that. So if your site was running 6.9.0-6.9.4 or 7.0.0-7.0.1 and internet-facing anytime after that, don't just assume nothing happened please go look.

Things worth checking:

Admin accounts. Anything new that you didn't create? Any password resets you didn't trigger? This is usually the first thing an attacker does once they've got code execution — plant a persistent admin account so they don't need the exploit again.

File timestamps. Look through wp-content, especially theme and plugin directories, for files modified around dates that don't line up with anything you actually did. A stray .php file with a weird name sitting in an upload directory is a classic sign.

Scheduled tasks. Check wp_cron for anything unfamiliar. Attackers sometimes use this for persistence.

Access logs. Search for anonymous POST requests hitting /wp-json/batch/v1 or ?rest_route=/batch/v1 around your exposure window. That's the fingerprint of someone probing or actually exploiting the chain.

Database. If you're comfortable poking around directly, check wp_users and wp_options for anything that looks off — unexpected serialized data, options keys you don't recognize.

If you find something genuinely anything from that list — this stops being a "patch and move on" situation. At that point:

Rotate every credential tied to the site: WordPress admin passwords, database credentials, API keys, FTP/SSH if applicable
Actually search for backdoors rather than just deleting the one file you found — attackers who get RCE rarely plant just one way back in
If you've got a clean backup from before the exposure window, restoring from that is usually faster and safer than trying to manually clean an infected install
If this is a business-critical site, this is probably the point where you loop in someone who does incident response for a living rather than doing forensics solo at 1am

S4: The stuff that's worth doing regardless of this specific bug

None of this is wp2shell-specific, but it's exactly the kind of thing that determines whether the next core vulnerability catches you exposed or not:

Actually turn on auto-updates for core, and check periodically that it's still working rather than assuming it forever
Keep an eye on whether your host's update pipeline is timely — some managed hosts lag behind official releases
Don't expose more REST API surface than you need; if you're not using the batch endpoint for anything legitimate, there's no downside to restricting it permanently
Have a "did this site get patched" checklist for exactly moments like this one, so you're not scrambling to remember which of your fifteen WordPress installs is still on an old version

telling simply, if that's all you needed(so longer one)

Check your actual WordPress version, don't trust that the forced update ran. Get to 7.0.2, 6.9.5, or 6.8.6 depending on your branch. If you can't update immediately, block anonymous access to /wp-json/batch/v1 as a temporary measure. If your site was exposed anytime after July 17, go check for signs of compromise before you assume patching was the end of it. That's the whole job.

Based on public source from WordPress.org, and Cloudflare's reporting on wp2shell (CVE-2026-63030 / CVE-2026-60137), current as of late July 2026.

How to run Kali Linux from USB

Aditya Pidurkar — Fri, 03 Jul 2026 10:06:31 +0000

Why Live Boot?

Advantages of a Kali Linux Live Boot:

Provides direct access to the computer's hardware.
Portable just plug and play.
Offers near-native performance with no virtualization overhead.
Supports Wi-Fi monitor mode and packet injection more reliably.
Allows better access to USB devices, Bluetooth adapters, and other peripherals.
Delivers improved GPU and graphics performance.
Does not require installation, so it can be used temporarily without modifying the host system.

Requirements

Before starting, make sure you have:

USB drive(8 GB minimum, 16 GB or larger recommended)
Windows, Linux, or macOS computer
Stable internet connection
Rufus (for Windows users) or Use Etcher
Kali Linux ISO image

I will be using a HP 16GB Pendrive and Rufus Portable.

S1:

Download Kali Linux Live Image from here Download

S2:

Open Rufus.

CLick No.

Select your USB device and set the following settings

Boot Selection: ISO and select the iso that we downloaded.
Persistent Partition Size: Maximum Possible if you want to keep your session saved and not lose data.
Partition Scheme to GPT
Volume Label: Any name you want to give
Keep rest settings same if you don't know what it actual does.

and then click Start.

After done just restart your desktop or laptop and based on your model of device open bootloader and select your USB.

After selecting your USB Drive this screen will load.

Select 4th option Live system with USB persistence if you want persistence.

You finally have a pendrive you can plug into any pc or laptop and use your kali for whatever you want 👀.

If you face any issues or need help message at
t.me/adityapidurkar

How to Get Your CTF Listed on CTFtime

Aditya Pidurkar — Mon, 08 Jun 2026 07:19:19 +0000

If you're organizing a CTF, getting it listed on CTFtime can significantly increase visibility and attract participants from around the world.

Some benefits of listing on CTFtime

Reach a global cybersecurity audience
Increase registration numbers
Build credibility for their event
Gain recognition within the CTF community

Before you submit collect this info

Event name
Start and end dates/times (UTC recommended)[Use this tool to convert to UTC easily]
Event website
Registration link
Event description
Organizer information
Format of the competition (Jeopardy, Attack-Defense, Mixed, etc.)
Eligibility requirements (if any)
Prize details (optional)

Now do this

S1: Go to CTFtime site

Open

S2: Log in with anything

S3: Create a team

New Team

Fill in the details and click save and continue.(Team Name will be organizer name in the CTF)

S4: Register your CTF Series name

CTF Series name is a general name of your CTF.

Open the below form to fill details

Form

Fill the form properly and click Send.

Note: Put a general name for the CTF name. Don't put your whole event name. It can't be changed in future.

Done

Now you will have to wait for their approval, once they approve you can view the CTF Details at CTF.

Once approved then follow steps from the next article of this series to finally put your CTF on CTFtime.

Thank You for reading! Suggestion in comments are always welcome!

Agentic AI: The Next Big Cybersecurity Threat?

Aditya Pidurkar — Thu, 26 Feb 2026 06:21:40 +0000

Few years till today we used to have tools like chatbots who replied to what we asked, what we required with and only with specific info. But there was a problem it always required us to put something in it if we wanted it to find us something or do a task. It is way too tedious task.

Now the AI world is changing with a new concept, something which can think on its own, take action on its own .. Known as Agentic AI.

What Exactly Is Agentic AI?

Let's take a example

"Find vulnerabilities in this system and report them."

A normal AI might help analyze logs or scan code when told to.

But Agentic AI would
Decide where to start scanning -> Choose which tools to use -> Analyze data -> Adjust strategy if something fails -> Keep working until the objective is achieved

All without our interaction. It doesn't just follow instructions, it takes decisions!

Why Cybersecurity Experts Are Getting Nervous

Till now, we fought war(Attackers vs Defenders) but the point was it was all human driven.
Even with the automated tools, the main strategies were planned by Humans.

For the first time now, attackers can deploy systems that

Think
Adapt
Persist
Scale infinitely
Operate 24/7 without fatigue

1. Attacks Could Become Fully Automated

Right now, hackers spend a lot of time doing manual work: - Searching for weak points - Testing exploits - Trying different attack methods

Agentic AI could do all of this automatically.

It could: - Scan thousands of systems at once - Identify vulnerabilities instantly - Launch attacks continuously, day and night

Unlike humans, AI doesn't sleep, take breaks, or lose focus.

This means cyberattacks could become faster, cheaper, and massively scalable.

2. AI Can Adapt Faster Than Humans Can Defend

One of the scariest things about Agentic AI is its ability to learn while attacking.

Imagine this scenario:

A security system blocks an intrusion attempt.

A human hacker might take hours or days to figure out another approach.

But an Agentic AI could: - Analyze why it failed - Generate new attack strategies - Try again immediately

This creates a situation where defenses are constantly playing catch‑up.

3. Social Engineering Could Become Extremely Powerful

Many cyberattacks don't rely on technical hacks --- they rely on
tricking people.

Agentic AI could take social engineering to a whole new level.

Future AI agents may be able to: - Write highly personalized phishing
emails - Hold realistic conversations with victims - Create deepfake
voices or videos - Study a person's behavior to manipulate them

In simple terms, scams could become almost impossible to distinguish
from reality.

4. The Rise of Self‑Evolving Malware

Traditional malware is static --- once created, it has a fixed design.

Agentic AI could change that completely.

We may soon see malware that can: - Rewrite its own code - Change its
attack patterns - Hide intelligently - Decide when to attack or stay
silent

This kind of malware would behave less like software... and more like a
living digital organism.

5. Attacks That Never Stop

Human hackers usually work in phases.

Agentic AI could operate continuously for years.

It could: - Monitor systems quietly - Collect data slowly - Expand
access over time - Avoid detection strategically

This would create a new category of threats: long‑term autonomous
intrusions.

Real‑World Threat Scenarios We Might See Soon

Autonomous Corporate Espionage

An AI agent infiltrates a company network and silently gathers trade
secrets for months without human involvement.

AI‑Driven Ransomware

Instead of random attacks, AI could choose the most valuable targets and
time the attack for maximum damage.

Autonomous Cyber Warfare

Governments could deploy AI agents to: - Disrupt power grids - Attack
financial systems - Interfere with communication networks

This could lead to a future where cyber wars are fought largely by
machines.

But It's Not All Doom --- AI Can Also Defend

The same technology can also protect us.

Security teams are already developing AI agents that can:

Monitor networks 24/7 -> Detect unusual behavior instantly -> Automatically patch vulnerabilities -> Respond to attacks in seconds

In the future, cybersecurity may become a battlefield of AI vs AI,
where autonomous defenders fight autonomous attackers.

The Bigger Questions We Need to Answer

Agentic AI raises serious ethical and legal challenges:

Who is responsible if an AI launches an attack?
Can autonomous cyber weapons be controlled?
Should there be global rules limiting AI autonomy?

These are questions governments and tech leaders are still struggling to
answer.

The biggest challenge ahead isn't just building smarter AI.

It's making sure we can control it, secure it, and defend against it
before it becomes a tool that attackers can fully exploit.

Because one thing is clear:

The future of cybersecurity will not just involve protecting systems...

It will involve managing intelligent digital agents themselves.

And that future has already begun.

Nobody Talks About This Cyber Threat, But It's Everywhere

Aditya Pidurkar — Wed, 04 Feb 2026 11:35:11 +0000

There's a class of attacks I see in incident reports again and again, TBs of data leaving the network but not a single security tool raised a red flag.

No flashy zero-days. No nation-state tooling. No malware that triggers
antivirus.

Just someone who logged in.

That's it.

Not all breaches starts with dramatic zero days, ransomwares or any alert popping up saying Data Hacked!!!

The threat I am talking about is Credential Abuse : using valid credentials to walk straight in like invited ones!

Why This Matters More than any Vuln

We focus more on CVEs, patch cycles, and EDR signatures but attackers skip those coz why stress over that if you can login directly!

Your firewall won't care, EDR won't care and the SIEM will barely notice it even SOC Analyst will see it as normal user logging in.

From the defender's side, it looks legitimate.
From the attacker's side, it's perfect camouflage.

In most enterprise breaches, the initial foothold was not malware.

How Credential Abuse Works (Under the Hood)

This is not guessing passwords blindly. It's much smarter.

1) Credential Harvesting

Phishing kits (evilginx-style reverse proxies)
Infostealers
Data breaches from unrelated websites
Keylogging malware
Browser password dumps
OS cred dumping
Credentials from Password stores
unhashed or plain text creds passing over network

2) Credential Validation (Password Spraying)

python3 o365spray.py --domain company.com --userlist users.txt --password 'Winter@123'

3) Living Off the Land After Login

PowerShell
RDP
SMB
Azure portal
AWS console

No malware required.

Real-Life Case: The Uber Breach (2022)

A contractor working with Uber had their password stolen. Not from Uber. From their own personal machine earlier, thanks to an infostealer. Those logs were purchased by a hacker.

He attempted login on Uber's VPN but
MFA pops up!

Instead of bypassing it or using any exploit the attacker simply kept spamming MFA Prompts and the contractor kept denying it but being tired he clicked Approve to make it stop and done was the play!

Instant Access

Where Most Organizations Mess This Up

I’ve seen this pattern so many times it’s almost predictable.

“We have MFA, so we’re fine.”
Nobody looks at impossible travel if the login worked
Password spray attempts get ignored because no one got locked out
A user adds a new MFA method and no alert is generated
Mailbox rules get created and nobody ever checks them

All of this comes from one dangerous assumption:

If the login is successful, it must be the real user.

That’s exactly what attackers rely on.

What You (or Your SOC) Should Actually Watch For

Pay attention to things like:

A successful login from a country the user has never been to
A new MFA device getting added to an existing account
Inbox rules being created, especially ones that hide or forward emails
Large downloads from OneDrive or SharePoint
Users granting permissions to random OAuth apps inside Microsoft 365

If You Think This Already Happened to You

If you faced something like this:

You got MFA prompts you didn’t request
Your mailbox had rules you don’t remember creating
Security emails were marked as read or moved to folders
Colleagues said you sent emails you don’t recall writing
Login history shows locations you’ve never been to
Your account suddenly asked you to re-authenticate everywhere
Files in OneDrive or SharePoint show unusual download activity
An unfamiliar app shows up in your Microsoft 365 app permissions

Then Do this

Check and delete all mailbox rules
Review MFA methods and remove anything you don’t recognize
Force sign-out from all sessions
Revoke OAuth app permissions you didn’t approve
Inform your IT/SOC team with the timeline of what you noticed
Ask for sign-in logs to be reviewed for the past 30–60 days

So stay safe, stay secure.
Thank You for reading!

References

Setup Oracle VirtualBox in Windows 11

Aditya Pidurkar — Tue, 20 Jan 2026 12:30:00 +0000

Today lemme demonstrate how to download and setup Oracle VirtualBox in Windows 11. I know its a vary basic thing to do but some of us dont know where and how to do this.

Lets start with Downloading required files

Oracle VirtualBox

Download

Extension Pack

Download

Now lets install it
Double click to open the setup and proceed with this steps

Click Next

Check the I accept the terms of the license agreement and click Next

Simply click Next

Click Yes

Click Install

Click Finish Now and open VirtualBox

Now press Ctrl+T to go to Extensions tab

Then click on install and select the extension file we downloaded

Click Install and press Agree

Done!!!

If you face any issues contact me at

Mail

20% of internet down: Why X, ChatGPT, and Cloudflare were Down

Aditya Pidurkar — Tue, 18 Nov 2025 13:39:11 +0000

Date: November 18, 2025
Status: Ongoing / Recovering

If you cannot refresh your X (Twitter) feed or log into your favorite game right now, you aren't alone. A massive chunk of the internet struggles at this moment.

Rumors suggest a massive cyberattack causes this, but the reality involves a more technical explanation. Here is the full list of what broke, why it broke, and when it returns.

The Full List of Affected Services

Cloudflare causes the issue. Cloudflare acts as a "backbone" provider for millions of websites. Because Cloudflare faces issues, every app that relies on them faces issues too.

Based on Downdetector spikes and user reports, the following services currently fail:

Social Media:
- X (formerly Twitter): Fails to load feeds globally; users cannot post.
- Facebook / Meta: Rejects logins and fails to load pages.
- Truth Social: Displays accessibility errors.
- Grindr: App fails to connect.
AI & Productivity:
- OpenAI: ChatGPT and even the new video tool, Sora, deny access or show capacity errors.
- Canva: The editor runs slowly or fails to load entirely.
- Amazon / AWS: Specific services show instability (though core AWS remains up).
Entertainment & Gaming:
- Spotify: Stops music streams and prevents app access.
- League of Legends: Login servers and matchmaking systems fail.
- Letterboxd: The site refuses to load properly.
- bet365: Cloudflare error messages block access to the betting site.
Utilities:
- NJ Transit: Commuters face disruptions on the app and site.
- Downdetector: Ironically, the outage briefly took down the very site used to track outages.

Did a DDoS Attack Cause This?

Short Answer: No, a maintenance error caused this.

Long Answer: Confusion exists because two big stories broke at the same time:

The Real Issue (Cloudflare Outage): Cloudflare officially attributes the problem to internal infrastructure issues. Engineers performed scheduled maintenance in several data centers, but the traffic re-routing failed. This failure created a cascade of "500 errors."
The "Fake" News (Azure Attack): You might read headlines today about the "Largest DDoS Attack in History" (15.7 Terabits per second). Microsoft blocked this attack weeks ago. They simply released the report today. That attack did not cause the outages you see right now.

Current Status (As of 7:10 PM IST)

Cloudflare: Engineers identified the fix and are implementing it now.
Recovery: Services slowly return online, but expect error pages for the next few hours as traffic stabilizes.

The Bottom Line: Do not change your passwords or reset your router. Engineers are currently fixing the internet's plumbing. We simply wait for the water to flow again.

More Updates coming soon!!!

OWASP Top 10 2025 What You Need To Know as a Security Engineer or Hacker

Aditya Pidurkar — Fri, 14 Nov 2025 12:30:00 +0000

The OWASP Top 10 is one of the first things people mention when they talk about web security. But if you work in security long enough, you learn that most people talk about it without ever reading the details.

So let me explain you through the 2025 edition in a clear, direct way. I’ll mention what changed, why it matters, and where you should focus if you break, test, or defend web apps.

Why the 2025 Edition Matters

OWASP didn’t just reshuffle the list. They added two new categories, expanded supply-chain risk, and grouped weaknesses by root cause, not by symptom. That gives you a more precise view of where systems actually fail today.

The 2025 Top 10 focuses on:

Bad access rules
Misconfigured systems
Compromised dependencies
Weak cryptography
Injection flaws
Poor design
Broken authentication
Integrity failures
Missing alerts
Unsafe error handling

A01 — Broken Access Control

Developers still trust user input too much and protect data too little. You’ll see users reaching admin functions, bypassing role checks, or escalating privileges. SSRF now lives here because it crosses trust boundaries.

A02 — Security Misconfiguration

Cloud, containers, and complex frameworks create endless ways to misconfigure systems: debug modes left open, unsafe headers, open buckets, or weak CORS rules.

A03 — Software Supply Chain Failures

Expanded beyond “Vulnerable Components.” This covers malicious packages, poisoned builds, dependency confusion, and unsafe update paths.

A04 — Cryptographic Failures

Most crypto issues come from bad implementation: outdated ciphers, hardcoded keys, weak TLS, or plaintext secrets.

A05 — Injection

Still a core issue: SQLi, OS command injection, XSS, template injection, LDAP injection. Assume injection exists until proven otherwise.

A06 — Insecure Design

Deep structural flaws: missing threat modeling, unsafe workflows, weak trust boundaries, and flawed business logic.

A07 — Authentication Failures

Modern frameworks help, but issues remain: broken session handling, missing MFA, weak password rules, and leaked tokens.

A08 — Software or Data Integrity Failures

Covers unsafe deserialization, unverified updates, manipulated files, and missing integrity checks.

A09 — Logging & Alerting Failures

Systems that fail to log events, never alert, or log the wrong data leave teams blind during attacks.

A10 — Mishandling of Exceptional Conditions

A new category highlighting failures under stress: resource exhaustion, unexpected states, bad error handling, or fail-open behavior.

How OWASP Built the List

OWASP used real-world testing data and expert survey feedback. Instead of counting raw vulnerabilities, they looked at whether an app had at least one instance of a weakness. That paints a clearer picture of prevalence and risk. The data has came from reputated companies and community surveys.

What This Means for Security Professionals

If you test or defend applications:

Start with access control
Hunt for misconfiguration early
Treat supply-chain attacks as routine
Encourage secure design from day one
Verify crypto correctness
Review logging and alerting for IR readiness
Stress-test error paths

This version reflects real attacks and real failures more than past editions.

Got questions about these 10? Don’t worry — I got a full series coming your way, each topic explained with ease!

STAY CONNECTED!!

Blackbird: The AI-Powered OSINT Account Enumeration Tool

Aditya Pidurkar — Fri, 10 Oct 2025 04:11:28 +0000

About

Blackbird is a fast and powerful Open Source Intelligence (OSINT) tool designed to search for user accounts by username and email address across a massive range of online platforms, often exceeding 600 sites.

It distinguishes itself by including free AI-powered profiling, which analyzes the platforms a target is found on to generate a behavioral and technical summary of the user. It ensures high-quality results by leveraging community-driven data sources like WhatsMyName.

Overview

Detail	Value
Github link	https://github.com/p1ngul1n0/blackbird
Devloper	`p1ngul1n0`
License	Open Source (Check the repository for the specific license file.)

How to set it up

Blackbird requires Python 3 and its dependencies.

Clone the repository:

git clone [https://github.com/p1ngul1n0/blackbird](https://github.com/p1ngul1n0/blackbird)

Navigate to the directory:
```
cd blackbird
```
Install the necessary dependencies:
Use pip or pip3 depending on your system's Python configuration.
```
pip install -r requirements.txt
OR
pip3 install -r requirements.txt
```

Usage

The tool can be run using the Command Line Interface (CLI) or as a self-hosted Web interface.

Command Line Usage	Description
Search by Username	Search across platforms using a target username (e.g., `johndoe`).
`python blackbird.py --username johndoe`
Search by Email	Search platforms to see if an account is registered with the provided email.
`python blackbird.py --email johndoe@example.com`
Export Results (PDF)	Execute a search and save the output, including the AI analysis, as a formatted PDF report.
`python blackbird.py --username johndoe --pdf`
Export Results (CSV)	Export the findings into a CSV file for further data analysis.
`python blackbird.py --username johndoe --csv`
Web Interface Mode	Start a local web server to use the tool with a Graphical User Interface (GUI).
`python blackbird.py --web`	Access the GUI via your browser (usually `http://127.0.0.1:5000`).
Advanced Filtering	Use filters to limit the search to specific categories (e.g., only "social" networks).
`python blackbird.py --filter "cat=social" --username johndoe`

DEV Community: Aditya Pidurkar

Installing Apache Hadoop 3.4.2 on Linux 2026 (Single Node Cluster) Complete Step-by-Step Guide

S1. Update the System

S2. Install and Configure Java 21

Java Compatibility

S2.1 Check if Java is Installed

If Java is NOT Installed

If Java is Already Installed

S2.2 List All Installed Java Versions

S2.3 Switch to Java 21

S2.4 Verify the Active Java Version

S2.5 Find the Correct JAVA_HOME

S3. Download Apache Hadoop 3.4.2

S4. Extract and Install Hadoop

S4.1 Extract the Archive

S4.2 Move Hadoop to /opt

S4.3 Verify the Installation Directory

S4.4 Change Ownership

S4.5 Verify the Hadoop Version

S5. Configure Environment Variables

S5.1 Check Your Default Shell

S5.2 Open the Shell Configuration File

If you are using Bash

If you are using Zsh

S5.3 Add the Hadoop Environment Variables

Why use $(dirname $(dirname $(readlink -f $(which java))))?

S5.4 Save the File

S5.5 Reload the Configuration

Bash

Zsh

S5.6 Verify the Environment Variables

S5.7 Verify Hadoop Commands

S6. Configure Passwordless SSH

S6.1 Check if OpenSSH is Installed

S6.2 Start and Enable the SSH Service

S6.3 Generate an SSH Key Pair

S6.4 Enable Passwordless SSH

S6.5 Test the SSH Connection

Why is Passwordless SSH Required?

S7. Create Hadoop Data Directories

S8. Install the Hadoop Configuration Files

S9. Configure hadoop-env.sh

S10. Format the NameNode

S11. Start HDFS

S12. Start YARN

S13. Verify the Hadoop Installation

Hadoop Web UI Port Quick-Reference

S14. Shut Down the Hadoop Cluster

wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell

How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

So what actually happened here

Why "wp2shell" and not just a CVE number

Who's actually affected

Here's the part that should actually worry you

"Forced auto-update" doesn't mean "you're fine"

the bigger point buried in all this

How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell

S1: Stop assuming you're patched. Go check.

S2: If you genuinely can't update right now, here's your stopgap

S3: Figure out if you were already hit

S4: The stuff that's worth doing regardless of this specific bug

telling simply, if that's all you needed(so longer one)

How to run Kali Linux from USB

Why Live Boot?

Requirements

S1:

S2:

How to Get Your CTF Listed on CTFtime

Before you submit collect this info

S1: Go to CTFtime site

Open

S2: Log in with anything

S3: Create a team

New Team

S4: Register your CTF Series name

Form

Done

Agentic AI: The Next Big Cybersecurity Threat?

What Exactly Is Agentic AI?

Why use `$(dirname $(dirname $(readlink -f $(which java))))`?

S9. Configure `hadoop-env.sh`