Network Security
system security Linux network
system security Linux network The romanticized image of the digital nomad – a laptop on a sun-drenched balcony – rarely accounts for the actual friction of maintaining a professional development environment on the move. . The friction is amplified with Linux. We are looking for a setup that respects our kernel configurations, handles volatile network handovers, and maintains a strict security posture without the hand-holding of a consumer-grade OS – so, put simply, more than just a laptop and a sunny deck. The hardware is...
May 26, 2026
Server Securityopen-source Linux administration
open-source Linux administration Cron has existed in Unix and Linux environments for decades, handling backups, cleanup scripts, patching jobs, log rotation, monitoring tasks, and other maintenance work that administrators do not want to run manually. Most Linux servers rely on it constantly, which is exactly why attackers continue abusing it for persistence after a system has already been compromised. . Persistence through cron is not complicated. Attackers do not need a rootkit or advanced malware framework to maintain...
May 25, 2026
Vendors/Productssecurity breach linux
security breach linux A major internal repository breach at GitHub has exposed a critical and overlooked blind spot in Linux supply chain security. Kernel exploits, exposed SSH services, weak firewall rules, and vulnerable daemons dominated the Linux threat model for years, and in many environments, they still matter. But recent supply-chain incidents involving GitHub ecosystems, npm packages, and malicious developer tooling point somewhere else entirely: the developer workstation. . The breach matters because...
May 21, 2026
Security Trends access control multi-tenant
access control multi-tenant Linux administrators often face an ugly choice in the cloud: prioritize convenience and cost-efficiency by sharing infrastructure, or sacrifice those benefits for the sake of total isolation. Most modern Linux workloads don't live on their own private servers anymore. They live in shared environments like Kubernetes clusters, where multiple teams and services run side-by-side. It sounds efficient, and it usually is. . But cloud isolation isn't as ironclad as it looks on the diagram. If you...
May 21, 2026
Vendors/Productsincident response cloud security
incident response cloud security Managed Extended Detection and Response (MXDR) has become one of the most sought-after security services in the enterprise market — and with good reason. It promises the holy grail: broad visibility across endpoints, network, cloud, email, and identity, combined with the 24/7 human expertise most organizations simply cannot build in-house. . However, the rapid growth of the market has produced a wide range of providers whose capabilities vary considerably beneath the surface. Choosing the...
May 19, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security news
We found 2 articles for you...
83
remote accesscyber threatmalware analysisBarracuda Email Security: Exploitation Of SUBMARINE Backdoor Threat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday disclosed details of a "novel persistent backdoor" called SUBMARINE deployed by threat actors in connection with the hack on Barracuda Email Security Gateway (ESG) appliances. . "SUBMARINE comprises multiple artifacts — including a SQL trigger, shell scripts, and a loaded library for a Linux daemon — that together enable execution with root privileges, persistence, command and control, and cleanup," the agency said . The findings come from an analysis of malware samples obtained from an unnamed organization that had been compromised by threat actors exploiting a critical flaw in ESG devices, CVE-2023-2868 (CVSS score: 9.8), which allows for remote command injection. Evidence gathered so far shows that the attackers behind the activity, a suspected China nexus-actor tracked by Mandiant as UNC4841, leveraged the flaw as a zero-day in October 2022 to gain initial access to victim environments and implanted backdoors to establish and maintain persistence. To that end, the infection chain involved sending phishing emails with booby-trapped TAR file attachments to trigger exploitation, leading to the deployment of a reverse shell payload to establish communication with the threat actor's command-and-control (C2) server, from where a passive backdoor known as SEASPY is downloaded for executing arbitrary commands on the device. SUBMARINE, also codenamed DEPTHCHARGE by the Google-owned threat intelligence firm, is the latest malware family to be discovered in connection with the operation. Executed with root privileges, it resides in a Structured Query Language (SQL) database on the ESG appliance. The link for this article located at The Hacker News is no longer available. . AQUANAUT infiltration tactic leverages SQL procedures and code, targeting a significant vulnerability in Cisco Web Security Appliances.. Barracuda Email Security,SUBMARINE,Command Injection,Cyber Threat. . LinuxSecurity.com Team
Jul 29, 2023
•
Hacks/Cracks
214
security advisorycommand injectionfirmware patchZyxel NAS Devices Critical Update: Command Injection Risk
IoT cybersecurity company Sternum has identified a security vulnerability affecting Zyxel Networks’ Linux-operated NAS drives, including NAS326, NAS540, and NAS542 models, running on firmware version 5.21. . Zyxel Networks’ advisory reads: “The post-authentication command injection vulnerability has been found in the web management interface of some NAS versions,” citing firmware 5.21 and previous versions. Users are being urged to patch their NAS drives with the latest firmware, which is also identified as 5.21, in order to protect their devices. Specifically, NAS326 owners are being told to update from 5.21 (AAZF.12)C0 to (AAZF.13)C0, NAS540 from (AATB.9)C0 to (AATB.10)C0, and NAS542 from (ABAG.9)C0 to (ABAG.10)C0. The updates are available from the Zyxel website . . Safeguard your NAS units against a critical command injection vulnerability by implementing the latest Zyxel firmware upgrades. Maintain your security.. Zyxel NAS Security, Command Injection Risk, Firmware Update Importance. . Brittany Day
Jun 06, 2023
•
IoT Security
210
security advisoryauthentication bypasscommand injectionCacti And Realtek Critical Exploits: MooBot And ShellBot Attacks
Critical security flaws in Cacti, Realtek, and IBM Aspera Faspex are being exploited by various threat actors in hacks targeting unpatched systems. . This entails the abuse of CVE-2022-46169 (CVSS score: 9.8) and CVE-2021-35394 (CVSS score: 9.8) to deliver MooBot and ShellBot (aka PerlBot), Fortinet FortiGuard Labs said in a report published this week. CVE-2022-46169 relates to a critical authentication bypass and command injection flaw in Cacti servers that allows an unauthenticated user to execute arbitrary code. CVE-2021-35394 also concerns an arbitrary command injection vulnerability impacting the Realtek Jungle SDK that was patched in 2021. While the latter has been previously exploited to distribute botnets like Mirai, Gafgyt, Mozi, and RedGoBot, the development marks the first time it has been utilized to deploy MooBot, a Mirai variant known to be active since 2019. The link for this article located at The Hacker News is no longer available. . Significant vulnerabilities in Cacti, Realtek devices, and IBM Faspex have been widely exploited. Ensure you’re safeguarded against these persistent dangers.. Cacti Vulnerabilities, Realtek Flaws, Command Injection, Authentication Bypass, IBM Aspera Security. . Brittany Day
Apr 02, 2023
•
Security Vulnerabilities
210
command injectiondevice vulnerabilitysecurity attackExploring Light Commands: Attacks On Siri, Alexa, And Google Assistant
Siri, Alexa, and Google Assistant are vulnerable to attacks that use lasers to inject inaudible -- and sometimes invisible -- commands into the devices and surreptitiously cause them to unlock doors, visit websites, and locate, unlock, and start vehicles, researchers report in a research paper published on Monday. Dubbed Light Commands, the attack works against Facebook Portal and a variety of phones. Learn more in an interesting Schneier on Security blog post: . Shining a low-powered laser into these voice-activated systems allows attackers to inject commands of their choice from as far away as 360 feet (110m). Because voice-controlled systems often don't require users to authenticate themselves, the attack can frequently be carried out without the need of a password or PIN. Even when the systems require authentication for certain actions, it may be feasible to brute force the PIN, since many devices don't limit the number of guesses a user can make. Among other things, light-based commands can be sent from one building to another and penetrate glass when a vulnerable device is kept near a closed window. The link for this article located at Schneier on Security is no longer available. . Utilizing low-intensity lasers on voice recognition systems allows malicious actors to transmit unauthorized instructions, creating significant vulnerabilities.. Voice Assistants, Light Commands, Command Injection, Device Security. . Brittany Day
Nov 12, 2019
•
Security Vulnerabilities
83
security advisoryprivilege escalationarbitrary command executionRed Hat: Severe Command Injection Risks for Unix Systems
Unix-based systems, as used worldwide by sysadmins and cloud providers alike, could be hijacked by hackers abusing a hard-coded vuln that allows them to inject arbitrary commands into shell scripts executed by high-privilege users. . A class of vulnerabilities involving so-called wildcards allows a user to affect shell commands issued by other users through filename manipulation. If the other user is a privileged user, such as root, then the tactic could be used to run elevation of privilege-style attacks. The link for this article located at The Register UK is no longer available. . Glob patterns in Unix environments can result in command injection flaws that compromise administrative accounts.. Unix Exploits, Command Injection, Privilege Escalation. . LinuxSecurity.com Team
Jul 03, 2014
•
Hacks/Cracks
67
security advisorycommand injectiontlsSTARTTLS Command Injection Threats in SMTP: Insights from Venema
Vulnerabilities in implementations of the STARTTLS protocol for establishing an encrypted TLS connection could allow commands to be injected into a connection. According to a description by the discoverer of the problem, Postfix developer Wietse Venema, the key point is that commands are injected into the connection before it has been secured/encrypted, but are only executed once the secure connection has been established.. Venema illustrates the problem with an example involving securing SMTP with TLS. A client sends "STARTTLS\r\n"; using a man-in-the-middle attack an attacker changes this to "STARTTLS\r\nRSET\r\n". The client and server then establish a TLS connection. The server now regards the injected RSET command that was added during the unprotected phase as if it has been transferred subsequent to the TLS connection being established. The RSET command in this example is relatively innocuous as it is a harmless protocol reset command, but other commands could be injected in a similar fashion. The link for this article located at H Security is no longer available. . Postfix engineer Venema elaborates on the STARTTLS vulnerability opening doors for command injection prior to establishing TLS. Discover the potential consequences.. STARTTLS, Command Injection, SMTP Security, TLS Protocol, Encryption Risks. . LinuxSecurity.com Team
Mar 08, 2011
•
Cryptography
78
security advisoryupdateLinux distributionFirefox: 1.0.6 Security Advisory Command Injection Risk
Peter Zelezny has discovered a vulnerability in Firefox, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to the shell script used to launch Firefox parsing shell commands that are enclosed within backticks in the URL provided via the command line. This can e.g. be exploited to execute arbitrary shell commands by tricking a user into following a malicious link in an external application which uses Firefox as the default browser (e.g. the mail client Evolution on Red Hat Enterprise Linux 4). . This vulnerability can only be exploited on Unix / Linux based environments. The vulnerability has been confirmed in version 1.0.6 on Fedora Core 4 and Red Hat Enterprise Linux 4. Other versions and platforms may also be affected. Solution: Update to version 1.0.7. /en-US/firefox/products/ The link for this article located at secunia.com is no longer available. . A security flaw has been identified in Firefox on Linux platforms, enabling command execution through specially crafted URLs. Urgent updates are advised.. Firefox Vulnerability, Linux Command Injection, Command Execution Risk. . LinuxSecurity.com Team
Sep 21, 2005
•
Vendors/Products
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More