Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
67
certificate managementcryptographic protocolTLS securityUnderstanding Delegated Credentials for TLS and Their Security Benefits
Mozilla, in partnership with Facebook, Cloudflare, and other IETF community members, has announced technical specifications for a new cryptographic protocol called "Delegated Credentials for TLS." Delegated Credentials for TLS is a new simplified way to implement "short-lived" certificates without sacrificing the reliability of secure connections. Learn more about Delegated Credentials for TLS in an informative The Hacker News article: . In short, the new TLS protocol extension aims to effectively prevent the misuse of stolen certificates by reducing their maximum validity period to a very short span of time, such as a few days or even hours. Before jumping into how Delegated Credentials for TLS works, you need to understand the current TLS infrastructure, and of course, about the core problem in it because of which we need Delegated Credentials for TLS. The link for this article located at The Hacker News is no longer available. . Uncover the advantages of Utilizing Delegated Credentials in TLS to bolster security through diminished certificate lifespan for reinforced safeguarding.. Delegated Credentials,TLS Security,Short-Lived Certificates,Cryptographic Protocol,Certificate Management. . LinuxSecurity.com Team
Nov 06, 2019
•
Cryptography
81
certificate managementsecurity incidentkey leakTrustico: 23,000 HTTPS Certs Axed Due to Private Key Exposure
Customers of HTTPS certificate reseller Trustico are reeling after being told their website security certs – as many as 23,000 – will be rendered useless within the next 24 hours. . This is allegedly due to a security blunder in which the private keys for said certificates ended up in an email sent by Trustico. Those keys are supposed to be secret, and only held by the cert owners, and certainly not to be disclosed in messages. In the wrong hands, they can be used by malicious websites to masquerade as legit operations.. This is allegedly due to a security blunder in which the private keys for said certificates ended up. customers, https, certificate, reseller, trustico, reeling, being, their, website, security. . LinuxSecurity.com Team
Mar 01, 2018
•
Privacy
67
data protectioncertificate managementweb securitySSL Misconfiguration Study Shows 97% of Certificates Incorrectly Configured
Secure Sockets Layer is a standard mechanism websites use to help secure data and transactions, but according to Qualys security researcher Ivan Ristic, most SSL sites are actually misconfigured. Ristic delivered his study here at the Black Hat security conference as an update to the preliminary data he published last month. . In the final study, Ristic said he examined 867,000 SSL certificates in which the name on the certificate matched the name of the domain. In his preliminary research, Ristic documented that the vast majority -- nearly 97 percent -- of SSL certificates do not have the proper name on them and don't match the underlying domain. The link for this article located at eSecurity Planet is no longer available. . Research indicates that a significant number of SSL certificates are improperly set up, jeopardizing security measures and online exchanges.. SSL Configuration, Certificate Management, Vulnerability Awareness. . LinuxSecurity.com Team
Nov 08, 2013
•
Cryptography
81
certificate managementdigital signaturesecurity risksImpact of Certificate Revocation on Software Integrity and Risks
Revoking a digital certificate does not automatically invalidate, for instance, software signatures that have been made with this certificate. What matters is the revocation date, which determines the point in time after which a signature will no longer be validated. . According to a report from anti-virus specialist Norman, the signatures of several recently discovered trojans were validated by Windows as a result, and no warning was issued before installing the malware. The trojans were signed with a key that had been stolen from a Japanese company. The corresponding certificate was reported as compromised on 29 July 2011 and revoked by its issuing Certificate Authority (CA), VeriSign, which is now part of Symantec. However, that date was also entered as the revocation date. The link for this article located at H Security is no longer available. . According to a report from anti-virus specialist Norman, the signatures of several recently discover. revoking, digital, certificate, automatically, invalidate, instance, software, signatures. . LinuxSecurity.com Team
Nov 18, 2011
•
Privacy
78
security advisoryred hatcertificate managementRed Hat Security In A Networked World: User Verification Initiative
Red Hat has unveiled an initiative dubbed 'Security in a Networked World' at the LinuxWorld tradeshow in San Francisco. As part of the programme, the Linux vendor showcased its Red Hat Certificate System that allows organisations to manage security certificates used to sign emails, or authenticate users for online banking applications. It also supports authentication through the use of smartcards. Red Hat has been working with the Apache Foundation to add support for the Firefox browser and Thunderbird email client through the use of Apache's open source Network Security Service Libraries. . The collaboration will allow users of both systems to send and receive authenticated emails with Thunderbird, while organisations including online banks and web stores can use the system to authenticate users through smartcards in combination with Firefox. The link for this article located at VNUNet is no longer available. . The collaboration will allow users of both systems to send and receive authenticated emails with Thu. unveiled, initiative, dubbed, 'security, networked, world', linuxworld, tradesho. . LinuxSecurity.com Team
Aug 09, 2005
•
Vendors/Products
82
encryptioncertificate managementsecurity challengesUnderstanding Public-Key Infrastructure Security Issues and Challenges
Public-key infrastructure technology was once so cool. Its combination of encryption, digital certificates and other technologies appeared to be a foolproof way to ensure the security of electronic transactions. It gave agencies the tools they needed to replace paper documents with . . . . Public-key infrastructure technology was once so cool. Its combination of encryption, digital certificates and other technologies appeared to be a foolproof way to ensure the security of electronic transactions. It gave agencies the tools they needed to replace paper documents with electronic ones and paved the way for electronic government. Sometimes, though, when organizations look more closely at deploying PKI, the technology loses its allure. Instead of finding a universal remedy, many agencies have become mired in the taxing policy and technical issues that come with PKI. Encryption techniques rely on randomly generated keys that must be mapped to user identities using digitally signed documents called certificates. Managing those certificates -- developing policies and processes to issue and revoke them efficiently -- is an enormously complex and expensive task that has hampered many agency efforts to build their own PKIs. The infrastructure required to effectively deploy a PKI must include the processes involved in looking up certificates for encryption and maintaining certificate revocation lists for users who have left an agency or are otherwise no longer authorized to use the certificate. The link for this article located at FCW is no longer available. . Public-key infrastructure technology was once so cool. Its combination of encryption, digital certif. public-key, infrastructure, technology, combination, encryption, digital, certif. . Anthony Pell
Sep 16, 2003
•
Government
81
certificate managementcryptographyemail protectionSecuring Documents With Public Key Infrastructure And Cryptography
Your company is negotiating a big deal with a partner, making you a bit nervous about the security of exchanging documents via email. There is a non-disclosure agreement in place, but you'd like to be absolutely certain that only the recipients can see the plans for your company's new product initiative.. . .. Your company is negotiating a big deal with a partner, making you a bit nervous about the security of exchanging documents via email. There is a non-disclosure agreement in place, but you'd like to be absolutely certain that only the recipients can see the plans for your company's new product initiative. When the partner emails their agreement to the final version of the proposed deal, you also want to be able to prove absolutely that the email really is from them. Is there a proven technology that can fulfill both needs? Public Key Infrastructure (PKI) can handle these requirements and more. You may already be using PKI without knowing it if you have relied on certificates or "certs" to identify a web server or to confirm the identity of external websites. It is a critical technology for the Internet and is used in applications as diverse as e-commerce and VPNs. Let's explore the world of PKI cryptography to learn about keys, signatures, and certificates, and to see how PKI can benefit you and protect your company's valuable digital assets. The link for this article located at is no longer available. . Your company is negotiating a big deal with a partner, making you a bit nervous about the security o. company, negotiating, partner, making, nervous, about, security. . LinuxSecurity.com Team
Jun 19, 2003
•
Privacy
74
data protectioncertificate managementbrowser securitySun Microsystems Alerts on Compromised Keys and Cert Issues
A mishap that compromised the integrity of two security keys used by Sun Microsystems is fueling criticism of current methods for scrambling sensitive data and verifying identities on the Web. Sun last week issued a warning that two of its applications' . . . . A mishap that compromised the integrity of two security keys used by Sun Microsystems is fueling criticism of current methods for scrambling sensitive data and verifying identities on the Web. Sun last week issued a warning that two of its applications' "certificates" had been compromised after the company inadvertently included certificate numbers in early-stage, or "alpha," code it sent to partners. A certificate verifies the identity of an application's source, in this case Sun. The alert, posted on Sun's Web site and distributed through security groups, has precipitated criticism from Internet security analysts who say the system for getting the word out about compromised certificates is inadequate. The link for this article located at News.com is no longer available. . An incident involving dual encryption tokens from Sun Microsystems brings to light issues regarding digital certificate notifications and security measures.. Certificate Management, Browser Security, Data Integrity. . Anthony Pell
Oct 31, 2000
•
Network Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!