What do you restore after a credential is stolen?

Notice how confident your answer is for almost everything else. A disk dies, you restore from backup. Ransomware hits, you fail over to the replica. The whole discipline of disaster recovery exists to make failure survivable, and for data it works — RAID isn't a backup, so you keep a backup, and you're covered either way.

Then you get to the credential, and thirty years of that machinery has nothing to hand you. There is no clean copy of trust to restore from. Once a key is taken you don't roll back the breach — you revoke, reissue, and rebuild the trust fabric from zero. And while you do, everything that authenticates through those credentials is down with them: payroll, deploys, the databases your own apps reach, the agents you spent a year rolling out.<br>The business doesn't slow down — it stops. You can back up data. You cannot back up trust. So the honest answer to the question you opened with is the uncomfortable one: nothing. You do not restore your way out.

What actually happened

2026 is making that distinction expensive. A new family of Linux attacks — Copy Fail, DirtyClone, pedit COW — takes root on a machine without changing a single file on disk. They poison the copy of a trusted system binary living in the kernel's memory and run that instead. The file on disk is never touched, so your integrity monitor checksums it, finds it identical to yesterday, and reports green; your antivirus scans the disk and finds nothing wrong, because nothing on the disk is wrong. The attacker is holding a root shell while every instrument you own certifies the machine is clean — and a reboot erases the evidence, because it only ever lived in memory.

Your tools aren't broken. They watch the bytes at rest on the disk, which was the right place to watch for twenty years, back when changing what a program does meant changing its file. The ground moved under the assumption, not the tool. Keep them — but be clear about what they are: a wall, graded on whether it holds.

The question we skip

For thirty years we have scored security on one thing: did you keep them out? Firewall, EDR, integrity monitor — all of it is prevention, and prevention is a fair question. It is just no longer one you can bet a company on, because when a break-in can be invisible, leave no trace, and survive your best tools reporting clean, "keep them out" stops being a strategy and becomes a hope.

The question we skip is the one that decides how bad the day actually is: when they get in — and they will — what can they take? And whatever it is, the first rule is the one storage taught us: you can't back it up. You don't get the trust back.

Built for this, on purpose

So the move was never to find a backup for your credentials. There isn't one — that's the whole point. The move is to make sure that when the wall comes down, there is nothing standing behind it worth carrying off.

A credential issued the Clavitor way never sits at rest on the box an attacker just rooted. It is bound to that one machine, so a copy lifted anywhere else is dead weight. It is scoped to a single job and it expires, so even root — even invisible, traceless root — gets one short-lived token for one task, not the keys to everything. And the record of what it touched lives off the box, on the vault, hash-chained, where someone who owns the machine cannot quietly rewrite history. The break-in still succeeds. The heist comes up empty, and the one log they can't reach already wrote down what happened.

None of this makes you unbreachable, and anyone selling that is lying. It makes the breach survivable — it takes the one outcome you can't recover from, the trust you can't restore, off the table. Paste a long-lived master key into a file on that box yourself and root will read it; nothing saves you from standing up the very thing this exists to remove. A backup doesn't stop ransomware either. It just means ransomware doesn't end you.

The lesson isn't "buy a better wall"

So maybe the security review shouldn't open with the question we've asked for thirty years. Not "is it secure" — everyone says yes, and everyone is eventually wrong. Ask the one storage already learned to ask: when this fails, does it matter? You answered it for your data the day you realized RAID wasn't enough and kept a backup. Your credentials don't get a backup. So the only answer left is to make sure there is nothing there to lose.

We wrote down the rules a credential tool should keep for the day the wall comes down.

Clavitor (@clavitorai) is the credential vault built for AI agents, and against them. clavitor.ai

Sources

[1] Unit 42 (@Unit42_Intel) — Copy Fail (CVE-2026-31431): What You Need to Know. A page-cache write corrupts the in-memory copy of a privileged binary like /usr/bin/su without touching the on-disk file; affects nearly all distributions, kernels 2017 on.

[2] The Hacker News (@TheHackersNews) — New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries (CVE-2026-46331). Poisons the cached /bin/su; file-integrity checks come back clean.

[3] The Hacker News (@TheHackersNews) — New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets (CVE-2026-43503). The modification lives only in memory; no audit trail, and a reboot restores the original binary.