The exec() Lie: Linux Doesn’t Run Programs. It Mutates Security Contexts.

fork() clones. exec() mutates. The process survives. The risk survives. Here is how attackers weaponize the leftovers and how you stop them.

Most engineers think fork() spawns and exec() launches.

Wrong.

Figure 1: The exec() attack surface – what survives, how attackers weaponize it, and how you stop it. - THOR