Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 26 articles for you...
82
encryptionweb securitybrowser securityArticle 45: Assessing Risks to EU Web Security and User Privacy Concerns
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from enforcing modern security requirements on certain CAs without the approval of an EU member government. Which CAs? . Specifically, the CAs that were appointed by the government, which in some cases will be owned or operated by that selfsame government. That means cryptographic keys under one government’s control could be used to intercept HTTPS communication throughout the EU and beyond. This is a catastrophe for the privacy of everyone who uses the internet, but particularly for those who use the internet in the EU. Browser makers have not announced their plans yet, but it seems inevitable that they will have to create two versions of their software: one for the EU, with security checks removed, and another for the rest of the world, with security checks intact. We’ve been down this road before when export controls on cryptography meant browsers were released in two versions: strong cryptography for US users and weak cryptography for everyone else. It was a fundamentally inequitable situation, and the knock-on effects set back web security by decades. Read what LinuxSecurity.com Founder and Linux Security expert Dave Wreski has to say about the implications of this proposed regulation in a new LinkedIn update. . Investigating the impact of Article 45 on digital safety and personal data protection for online users within the European Union framework.. Web Security Regulations, Certificate Authorities EU, Privacy Encryption Laws, Internet Governance Compliance. . Brittany Day
Nov 08, 2023
•
Government
79
open source securitycertificate authoritycode signingSigstore v1.0 Launch for Open-Source Software Supply Chain Security
Sigstore that is backed by Google, Red Hat, GitHub, and other prominent organizations with an aim to secure the open-source software supply chain has reached general availability and issued the "v1.0" releases for their key software components. . This week Sigstore celebrated its general availability milestone and releasing the v1.0 software of their Rekor transparency log and Fulcio certificate authority software. Sigstore now considers itself to be production-grade for software artifact signing and verification. Sigstore provides the means of easily and cryptographically-backed means of signing code, verifying signatures using a transparency log, and monitoring of activity for safely vetting the software supply chain. The link for this article located at Phoronix is no longer available. . Recently, Sigstore marked a significant achievement with the announcement of its general availability and the launch of version 1.0 of its essential software tools.. Sigstore, Software Supply Chain, Code Signing, Open Source Security, Fulcio. . LinuxSecurity.com Team
Oct 30, 2022
•
Security Projects
67
security advisorycertificate authoritydomain validationLet's Encrypt Issues Advisory For 3 Million TLS Certificates Revocation
The most popular free certificate signing authority Let's Encrypt is going to revoke more than 3 million TLS certificates within the next 24 hours that may have been issued wrongfully due to a bug in its Certificate Authority software. . The bug, which Let's Encrypt confirmed on February 29 and was fixed two hours after discovery, impacted the way it checked the domain name ownership before issuing new TLS certificates. As a result, the bug opened up a scenario where a certificate could be issued even without adequately validating the holder's control of a domain name. The link for this article located at The Hacker News is no longer available. . A flaw in Let's Encrypt's system was acknowledged, resulting in the inappropriate granting of TLS certificates, which have since been rescinded to ensure security.. TLS Certificate Revocation, Let's Encrypt Bug, Certificate Authority Issues. . LinuxSecurity.com Team
Mar 04, 2020
•
Cryptography
81
encryptionweb securityopen sourceLet's Encrypt: Free Digital Certificate Introduces Enhanced Web Security
. . Explore how Let's Encrypt launched its first free digital certificate, enhancing web security for sites.. Lets Encrypt, Free Digital Certificate, Open Source Security, Web Encryption. . LinuxSecurity.com Team
Sep 16, 2015
•
Privacy
67
browser securitySHA-1certificate authorityGoogle's CA Updates Schedule: A Key to Elevating Web Security Standards
Miffed certificate authorities are calling on Google to give websites more time to upgrade the security used in browser-to-server communications before displaying warnings in Chrome.. The CAs are upset over Google's roughly six-month timetable for ratcheting up the notices that begin this month for Chrome users visiting sites that do not upgrade from SHA-1 to SHA-2. The link for this article located at CSO Online is no longer available. . The schedule set by Mozilla for browser certificate renewals raises alarms among regulators impacting online safety.. Certificate Security, Browser Communication, SHA-1 Upgrade. . LinuxSecurity.com Team
Sep 11, 2014
•
Cryptography
78
security advisorybrowser securitycertificate authorityMozilla Firefox 32: Critical Change In 1024-Bit Certificate Support
When Firefox 32 shipped this week, Mozilla also officially ended its support of 1024-bit certificate authority certificates in its trusted store.. While it still takes a considerable amount of resources to factor and crack a 1024-bit RSA key, important organizations such as NIST have been advising organizations to move to 2048-bit keys or higher going as far back as 2011. Microsoft announced a change to its certificate key length requirements shortly thereafter, yet others including Google, have been slow to follow suit. The link for this article located at ThreatPost is no longer available. . Google's decision to phase out SHA-1 certificates affects more than 85,000 domains, enhancing security standards.. 1024-bit Certificates, Browser Security, Key Management, Encryption Protocols. . LinuxSecurity.com Team
Sep 08, 2014
•
Vendors/Products
67
cryptographydigital certificatesSHA-1Google's SHA-1 Support Withdrawal: Effects on Certificate Authorities
Google's recent announcement that they will begin to deprecate support for SHA-1 TLS/SSL digital certificates in Chrome is meeting resistance from certificate authorities (CAs). Google made their announcement on August 20 on their Security-dev mailing list, although they had been warning of this decision for months.. SHA-1 is a hash algorithm, a critical component of secure cryptography. A hash algorithm takes a block of data as input and outputs a value of a certain size (SHA-1 hashes are 160 bits long). This value is called a hash or digest. With a good hash algorithm, two different blocks of data will always produce a different hash, and even a small change in the input data will result in a significant change in the output. There should be no way to learn anything about the input data from the hash output. The link for this article located at ZDNet Blogs is no longer available. . The discontinuation of SHA-1 by Google creates challenges for Certificate Authorities and the wider impact on secure digital certificates.. SHA-1 Support,Cryptography,Digital Certificates,Certificate Authority,Google Security. . LinuxSecurity.com Team
Sep 03, 2014
•
Cryptography
82
security advisorycyber threatcertificate authorityGoogle Identifies Unapproved Digital Certificates by Indian NIC
Google has identified and blocked unauthorized digital certificates for a number of its domains issued by the National Informatics Centre (NIC) of India, a unit of India. National Informatics Center (NIC) holds several intermediate Certification Authority (CA) certs trusted by the Indian government The link for this article located at The Hacker News is no longer available. . National Informatics Center (NIC) holds several intermediate Certification Authority (CA) certs trus. google, identified, blocked, unauthorized, digital, certificates, number, domains. . Alex
Jul 10, 2014
•
Government
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!