We build the software underneath the software.
Exploidus is an independent systems lab shipping software from first principles: a capability kernel, a native language, correlated SIEM layers, self-organizing clusters, driver-level eBPF packet filters, and aerospace state estimation. Every line is open source.
Seven projects, one build philosophy
Exploidus
Reactive capability kernel
A custom x86-64 operating system kernel written from scratch. It boots through GRUB2, manages memory in colored zones, and checks a BLAKE3 capability token before it trusts a process with anything.
- Colored zone physical memory manager: green, yellow, and red regions instead of a flat address space
- Intent-based preemptive scheduler with five priority classes and blocking waitpid
- Crash isolation: a fault in a userspace process kills only that process, the kernel keeps running
- Full TCP/IP stack, including ARP, IP fragment reassembly, TCP, UDP, and ICMP
- The exploish shell, with real ps and audit commands over capability-checked syscalls
Yolish
The native language of Exploidus OS
A fast, capability-aware language with its own compiler. It runs standalone on Linux, Windows, and macOS, and doubles as the intent-aware scripting layer inside the Exploidus kernel.
- One compiler, three native targets: Linux ELF64, Windows PE32+, and macOS Mach-O
- Closures, structs, enums, pattern matching, and a real type system
- @intent annotations compile straight into a kernel scheduler syscall
- No dependencies to install, download the binary and run it
- Interpret a script directly or compile it to a native executable
CNSL
Correlated Network Security Layer
A self-hosted SIEM for Linux. Most tools watch one log and count failures. CNSL watches SSH, web, database, and cloud logs at once, so a coordinated attack shows up as a single incident.
- Tracks how far an attacker has progressed through the kill chain, in real time
- Automatic blocking, dry-run by default until you explicitly add the execute flag
- Learns new attack patterns and shares threat intelligence across a federation of servers
- A live dashboard covering incidents, blocks, kill chain, UEBA, honeypot, and file integrity
HuddleCluster
Self-organizing, penguin-inspired
Emperor penguins survive blizzards with one rule: if you are cold, push inward, if you are warm, drift outward. HuddleCluster applies the same rule to servers, so the cluster finds its own equilibrium.
- Adaptive thermal eviction, scored with an exponential moving average instead of a fixed threshold
- Statistical validation with Welch's t-test built directly into the benchmark suite
- Single-instance mode for one process, or a full multi-node cluster with a master coordinator
- Optional extras for FastAPI, Redis, gRPC, and Kubernetes
aegis-filter
Deterministic state estimation and multi-sensor FDIR
A high-integrity, cyber-resilient Kalman filtering and fault isolation engine in pure Rust with zero heap allocations. It protects mission-critical autonomous navigation and telemetry against GPS spoofing and numerical covariance collapse.
- Joseph-stabilized covariance updates unconditionally guaranteeing positive semi-definiteness
- 3-sigma innovation gating with automated multi-sensor fault quarantine and recovery
- Pure #![no_std] execution running directly on bare-metal ARM Cortex-M and RISC-V targets
- Unscented Kalman Filter (UKF), H-infinity minimax filter, and adaptive noise estimator
- Zero dynamic memory allocations: compile-time const generics for static predictability
xdp-guard
Driver-level volumetric DDoS mitigation via eBPF
A line-rate eBPF firewall engine built with Rust and Aya. It attaches directly to the network interface ring buffer, dropping volumetric UDP and reflection floods before the Linux kernel allocates socket buffers or invokes softirq processing.
- XDP_DROP execution at driver layer preventing CPU softirq saturation on 10G/40G edge nodes
- Two-tier rate limiting: /24 subnet aggregate plus per-IP LRU token buckets
- Ingress admission control suppressing host-rotating and randomized source IP floods
- Sub-millisecond drift-free integer refill arithmetic without floating-point hazards
- Live eBPF telemetry daemon with kernel map inspection and zero C toolchain dependencies
browser-engine
Modular, GPU-accelerated web engine in pure Rust
A security-first web browser engine engineered from scratch without Chromium, WebKit, or Gecko dependencies. Features an arena-based DOM tree, zero-panic CSSOM cascade matcher, box-model layout, and a wgpu hardware-accelerated compositor.
- Zero-panic HTML5 and CSS tokenizer designed for adversarial malformed input resistance
- Arena-indexed DOM tree with constant-time index traversal avoiding Rc borrow-checker overhead
- Full CSS selector matching engine with descendant, child, and sibling combinators
- Hardware-accelerated paint pipeline via wgpu over Vulkan, Metal, and DirectX 12
- Native HTTP/1.1 and TLS 1.3 networking with RFC 6265 cookie persistence
Security as a foundation, not an add-on
Most operating systems treat security as something bolted on after the fact. Exploidus starts from the opposite assumption: every process carries a capability token, every memory region has a color, and every syscall is audited by default. The same discipline carries through the rest of the lab, from the log correlation inside CNSL to the compile-time checks inside Yolish.
Capability over trust
Processes prove what they are allowed to do with a token, instead of inheriting ambient permissions by default.
Intent at compile time
Yolish checks what a program intends to do before it runs, and turns that intent into a real syscall.
Equilibrium over thresholds
CNSL and HuddleCluster both favor systems that correct themselves over ones that need a hand-tuned cutoff.
Behind the lab
Exploidus is founded and engineered by Rahad Bhuiya as an independent systems research lab, building capability-first kernel primitives, native languages, security layers, and distributed balancers from first principles.
Rahad Bhuiya
Founder & Maintainer
Author and primary developer of Exploidus OS, Yolish, CNSL, HuddleCluster, aegis-filter, and xdp-guard. Architecting resilient systems software from first principles.