Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 14 articles for you...
83
security advisorysecurity measuresmalwareLinux: Auto-Color Malware Advisory - Advanced Evasion Tactics Explored
A newly discovered Linux malware variant dubbed Auto-Color is making headlines, targeting universities and government organizations across North America and Asia. Palo Alto Networks Unit 42 discovered a sophisticated Linux backdoor that uses advanced evasion techniques to hide within standard system processes, making detection and remediation efforts harder than they otherwise should be. . As admins, we must remain alert for suspicious activity that might signal its presence on our networks and systems. Auto-Color infiltrates systems through compromised software repositories and targeted phishing attacks targeting administrators with admin privileges, giving threat actors access to system resources without admins' knowledge. Attackers can manipulate these resources to gain unauthorized access and control over target systems, potentially compromising sensitive data. By maintaining tight access controls, trusting only reliable sources when selecting software sources, and being vigilant in watching for abnormal system behaviors that indicate compromise, we Linux admins can better safeguard our environments against this emerging menace. Let's examine how Auto-Color works in greater detail and discuss practical measures you can take to safeguard your Linux infrastructure and critical data against it. Understanding Auto-Color's Evasion Techniques Auto-Color Flow Diagram (source: Paloalto) Auto-Color's most worrying trait is its ability to blend seamlessly into standard system processes, making it exceptionally hard to detect. Traditional security measures may fail to recognize this malware due to sophisticated obfuscation strategies that bypass typical security scans. Auto-Color excels at concealing its tracks by merging into legitimate processes to avoid raising alarms. Linux security admins should depend upon more innovative detection methods to mitigate attacks. Anomaly Detection Systems that track for any abnormal patterns or behaviors within their network are critical indetecting Auto-Color. Regular manual audits of system processes are also helpful in detecting any unusual activities that automated systems might have missed. The Path of Infection How does Auto-Color penetrate Linux systems? The malware spreads through compromised software repositories and phishing strategies targeting administrators with elevated privileges. Its dual attack vector allows it to spread directly onto individual systems and indirectly via trusted sources of software downloads. Securing system software and tools by procuring them from reliable, verified repositories is a fundamental way of combatting this threat. Furthermore, raising awareness among users about phishing attacks and using multi-factor authentication can add extra layers of protection against such attempts. Administrators should pay particular attention when receiving suspicious requests for login credentials or unusual updates. These could indicate that someone is trying to commit fraud against your system. Examining Auto-Color's Impact Auto-Color can have devastating consequences on compromised systems. Once it infiltrates, Auto-Color malware can monitor and alter user activity, steal sensitive data, and execute arbitrary commands - providing attackers with total control to steal valuable information while disrupting operations and creating significant system damage. One of the most troubling aspects of this threat is its use in larger botnet activities. By commandeering multiple systems, attackers can launch widespread attacks, amp up their impact, and avoid detection - an impactful disruption for organizations that rely on continuous operations. Reinforcing Your Defenses Due to the nature of Auto-Color, strengthening system defenses is of utmost importance. Implementing strict access controls ensures that only authorized users can perform high-level operations, thus decreasing the chances of a successful attack. Furthermore, regularly updating and patching all software components will closevulnerabilities that malware attacks can exploit. Backing up data regularly is another essential component of an effective defense strategy. Doing this allows systems to remain functional even after they have been compromised by ensuring data can be restored with minimal loss. Backups should ideally be stored offline or in an encrypted cloud environment to avoid being targeted by malware attacks. The Importance of Incident Response Planning No matter how robust your defenses may be, breaches can still happen. A comprehensive incident response plan enables organizations to respond rapidly and effectively when security incidents arise. This plan should include protocols for detecting malware attacks, quickly alerting stakeholders, and returning systems to normal operations. Training and drills are critical to ensure each team member understands their role during an emergency. Regular sessions help keep security protocols top-of-mind among everyone involved and enable a quick response during an incident. Our Final Thoughts on Mitigating the Auto-Color Linux Malware Threat Auto-Color represents a sophisticated and potentially devasting malware threat to our Linux systems. With advanced evasion techniques combined with its ability to spread through both repository downloads and phishing emails, Auto-Color is an impressively persistent adversary. Yet, by understanding its operation and taking appropriate security precautions, Linux admins can protect their systems effectively against it. From tight access controls and frequent software updates to proactive anomaly detection and robust incident response plans, many strategies exist to mitigate the risks posed by Auto-Color. Staying informed and prepared , keeping systems updated, and informing users about threats like Auto-Color are all part of maintaining a strong security posture. . Stay vigilant against Auto-Color malicious behavior targeting Linux environments and learn crucial strategies to counter its sophisticated methods.. LinuxMalware, Auto-Color, Threat Mitigation, Attack Prevention, Security Practices. . Brittany Day
Feb 26, 2025
•
Hacks/Cracks
210
security advisorycritical issuemalware threatExploring Major Security Threats Affecting IT Systems In The Last Decade
Thank you to Skynats for contributing this article. This past decade has been plagued with security vulnerabilities. Let’s have a look at the top vulnerabilities that have recently crippled the IT world. Badlock: Badock is a crucial security bug affecting Windows computers and Samba servers. It is identified using the following reference: (CVE-2016-0128(Microsoft) CVE-2016-2118(samba). The RPC services allowed an attacker to become a man in the middle to intercept the communication between a client and a server hosting a SAM database to exploit and force the authentication to downgrade, allowing the attackers to access the SAM database. Blueborne: Blueborne is a virus that spreads through the air. Yes, it of course through the Bluetooth on your device. Everything from your smartphone to other devices (TV, Computer, smart cars, laptops) are Bluetooth enabled and active almost all the time, leaving these devices vulnerable to malware attacks that can remotely seize them without user permission. Cloud Bleed: This was another leading cloud-based security vulnerability affecting Cloudflare's reverse proxies which was discovered on February 17, 2017. Most of the busiest websites and the apps rely on Cloudflare's protection. This security bug caused their edge server to run past the end of a buffer and then return the memory which contained private information such as: 1. HTTP cookies 2. Authentication tokens 3. HTTP post bodies 4. Tons of sensitive data and more The worst part was that some of this data was cached by search engines. Dirty Cow: This was another serious security problem discovered in the way the Linux kernel memory handled the copy on write (COW) that affects Linux-based OSes including Android devices that used an older version (before 2018) of the Linux kernel. Dirty Cow is a local privilege escalation vulnerability bug that exploits a rare condition by implementing the copy on write mechanism. Computers and devices that still using an older version of theLinux kernel remain vulnerable, and any user can become root in less than five seconds. The exploitation of this bug doesn't leave any trace in the log, so you can't detect if someone has used this exploit against your server. Foreshadow: This bug (L1TF or foreshadow) affecting Intel/AMD processors will allow attackers unprecedented access to sensitive information that is stored on a personal computers and cloud server. Foreshadow has two versions: the original attack which extracts data from SGX enclaves and the second version (next-generation) which targets virtual machines (VMs), hypervisors (VMM), OS Kernel memory and system management mode (SMM) memory. Foreshadow is similar to the Spectre security bug which affects the Intel and AMD chips, and the Meltdown security bug also affects Intel. Nevertheless, applying software patches may help mitigate some concern, but the users may see some considerable changes in overall PC or server power by doing so. Heartbleed: Heartbleed is a serious vulnerability in the popular open SSL cryptographic software library, used widely in implementation of the transport layer security (TLS) protocol. The Heartbleed vulnerability was publicly disclosed in April of 2014. iSee You: This is an Apple webcam vulnerability which is a silent malware attack. Apple laptops affected are capable of running all sort of operating systems, including macOS, Microsoft Windows and Linux. Researchers have released iSightDefender, a macOS kernel extension to reduce the attack surface under the macOS operating system. KRACK: (Key Reinstallation Attack) is a replay attack (a type of exploitable flaw) on the Wi-Fi protected Access protocol (WPA) used to secure the Wi-Fi connections. It was discovered in 2016 by Belgian researchers. All the major software platforms that use Wi-Fi protected access are affectedincluding Microsoft windows, macOS, iOS, Linux, Andriod and OpenBSD. Lazy: Lazy, which is also referred to as Lazy FP State Restore or LazyFP, is a securityvulnerability affecting Intel CPUs. The vulnerability is caused by a combination of flaws in the speculation execution technology. This vulnerability is used to leak the content of the FPU registers that belongs to another process. Lazy is related to the Spectre and Meltdown vulnerabilities which were publicly disclosed in January of 2018. Linux .encoder: This is considered to be the first ransomware Trojan targeting computers and cloud servers running Linux. There are additional variants of this Trojan that target other UNIX and UNIX-like systems which were discovered on November 5, 2015. Meltdown: Meltdown is a severe security vulnerability in tech media that is found in almost all CPUs used in modern devices. Mobile phones, laptops, systems and internet of things (IoT) devices are vulnerable. Meltdown CPU vulnerabilities and exposures will break the fundamental isolation between the user and the application. This will allows a rogue process to access the memory of other programs and the operating system. The Meltdown vulnerabilities primarily affect Intel microprocessors, but will also affect the ARM Cortex-A75 and IBM's Power microprocessors. It does not affect AMD CPUs. Microarchitectural: The Microarchitectural Data Sampling (MDS) vulnerabilities are a set of weaknesses in Intel x86 microprocessors that use hyper-threading to leak data across the protection boundaries that are architecturally supposed to be secure. After Meltdown, Spectre and Foreshadow, Microarchitectural is considered the most critical vulnerability in modern processors. The attack exploits vulnerabilities have been labeled as Fallout, RIDL (rogue in-flight Data load) and Zombiaload and allows attackers to steal sensitive data and keys. Have another vulnerability that you feel belongs on this list? Please do not hesitate to reach out and let us know! . . Thank you to Skynats for contributing this article. This past decade has been plagued with security . thank, skynats, contributing, article, decade, plagued,security. . Brittany Day
Jan 14, 2021
•
Security Vulnerabilities
83
malwareattack vectorswormNew Gitpaste-12 Worm Affects Linux Servers and IoT Devices
The newly discovered Gitpaste-12 worm exploits GitHub and Pastebin to house component code, and harbors 12 different initial attack vectors. . Researchers have uncovered a new worm targeting Linux based x86 servers, as well as Linux internet of things (IoT) devices (that are based on ARM and MIPS CPUs). Of note, the malware utilizes GitHub and Pastebin for housing malicious component code, and has at least 12 different attack modules available – leading researchers to call it “Gitpaste-12.” It was first detected by Juniper Threat Labs in attacks on Oct. 15, 2020. “No malware is good to have, but worms are particularly annoying,” said researchers with Juniper Threat Labs in a Thursday post. “Their ability to spread in an automated fashion can lead to lateral spread within an organization or to your hosts attempting to infect other networks across the internet, resulting in poor reputation for your organization.” . Scientists discovered a novel Gitpaste-12 malware aimed at Linux systems and IoT gadgets, employing various strategies to infiltrate.. Gitpaste-12, Linux Worm, IoT Malware, GitHub Exploits. . LinuxSecurity.com Team
Nov 09, 2020
•
Hacks/Cracks
210
open sourceattack vectorssecurity issuesIdentifying Hidden Risks in FOSS and Enhancing Security Awareness
A preliminary study released February 18, which we directed alongside the Linux Foundation, numerous troubling trends in open source security underscore the importance of understanding where open source is most used and could be vulnerable to attack. . Commonly used free and open source software (FOSS) is one of the most significant technological trends of the decade. After all, 80-90 percent of a typical application contains FOSS components (pdf) . And that trend is only increasing with its use in smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure. But without appropriate investment and maintenance, that widespread adoption has the potential to become a liability. The link for this article located at Harvard Business School is no longer available. . Widely utilized free and open source software (FOSS) highlights notable security patterns and possible vulnerabilities.. Open Source Vulnerabilities, FOSS Security Risks, Software Supply Chain, Open Source Software Challenges. . Brittany Day
Feb 27, 2020
•
Security Vulnerabilities
76
security risksattack vectorsmalware threatsSecurity Risks Unveiled at Black Hat and Def Con Conferences
It's that time of year again: The wonderful, terrifying week when hackers and security gurus descend upon Las Vegas to show off their skills and unleash presentation after presentation full of scary-sounding exploits. This year is no different. Over the previous week, we've heard tales of planes brought down by rogue code, snoops spying on your security cameras, and secretive, undetectable code that can turn any USB drive into an unstoppable malware vessel.. If the past is any indication, most of these exploits are scarier in theory than in fact The link for this article located at Network World is no longer available. . Discover crucial insights from elite hacker conventions, where ethical hackers unveil serious vulnerabilities and threats, driving awareness and security discussions. Security Nightmares, Hacker Conferences, Cyber Vulnerabilities. . Anthony Pell
Aug 12, 2014
•
Organizations/Events
83
security breachattack vectorsidentity theftNew Phishing Technique: HTML Files Evade Detection in Browsers
Criminals are reportedly using a new phishing technique that allows them to bypass the fraud warnings issued by modern browsers such as Firefox and Chrome. On its blog, security firm M86Security reports that the trick involves attaching an HTML document instead of sending a link. It remains unclear how many users have become victims so far.. Email recipients opening the HTML document in their browsers are, for example, presented with a bogus PayPal form with the usual request to enter their access data due to alleged security issues. As the form is being processed locally on the user's computer, the phishing filter doesn't issue a warning because it only filters external URLs. A click on the "Submit" button then transmits the entered data to a PHP script on a (hacked) server using a POST request. According to M86Security, the browser doesn't warn about this either. The link for this article located at H Security is no longer available. . Email recipients opening the HTML document in their browsers are, for example, presented with a bogu. criminals, reportedly, using, phishing, technique, allows, bypass, fraud, warning. . LinuxSecurity.com Team
Mar 17, 2011
•
Hacks/Cracks
83
security practicesmalwarecybersecurityVerizon Warns: Poor Security Practices Enable Malware Attacks
The lack of a secured infrastructure is typically the reason hackers are able to gain access to enterprise servers and from there, implant malware to launch an attack, according to Verizon.. While malware remains a key element in security attacks, it is often not the trigger point, Peter Tippett, vice president of security solutions and enterprise innovation at Verizon Business, told ZDNet UK's sister site ZDNet Asia. "These criminals get in through unsafe passwords, SQL injections or other simple remote controls that are usually ignored. While these [security] practices may seem less effective than antivirus software, they are critical in reducing attacks, as each of these controls add up to form a critical resistance," Tippett said. The link for this article located at ZDNet UK is no longer available. . While malware remains a key element in security attacks, it is often not the trigger point, Peter Ti. secured, infrastructure, typically, reason, hackers. . LinuxSecurity.com Team
Oct 11, 2010
•
Hacks/Cracks
78
threat analysismalwarecybersecurityExploring Low Malware Threats in Linux and MacOS Environments
No one is really focusing attacks on Mac and Linux, namely because there're not enough users," Steckler said in an interview. "Viruses, just like [those] in humans, need lots of hosts to propagate. Since there are very few Mac and Linux machines in the ecosystem, it's very difficult to propagate [and] to target.". The Mac platform seemingly appears more secure because only a few hackers write attacks against the OS, and not because it is inherently safer, he added. "If you're a hacker and you want to infect a Web site, if you can get 93 out of 100 computers by writing an attack focused on Windows versus seven [or fewer] out of 100 visitors The link for this article located at ZDNet Asia is no longer available. . The Mac platform seemingly appears more secure because only a few hackers write attacks against the . really, focusing, attacks, linux, namely, because, there're, enough, users, steck. . LinuxSecurity.com Team
May 12, 2010
•
Vendors/Products
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!