Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Organizations should combine the NVD and CISA KEV catalog to prioritize vulnerabilities effectively, focusing on managing real risks rather than being overwhelmed by theoretical scores and alert fatigue.. To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the NVD provides baseline technical metrics aligned with the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 24 articles for you...
210
security advisoryRed Hatremote code executionRed Hat: CVE-2024-36904 critical: kernel remote code execution threat
In a startling revelation, researchers have uncovered a critical vulnerability in the Linux kernel that has remained undetected for seven years, posing a significant threat to the security of Linux systems. This flaw, identified in the core TCP subsystem, results from a race condition in the inet_twsk_hashdance function, which could allow attackers to execute remote code and take over compromised devices. . Linux security administrators should be aware that this vulnerability, tracked as CVE-2024-36904 , impacts several major distributions, including Red Hat Enterprise Linux and Fedora. While real-world exploitation demands precise timing and extensive knowledge of kernel internals, the theoretical danger is substantial. Addressing this vulnerability is paramount for maintaining secure and resilient systems. The bug has been patched upstream, and affected distributions are rolling out updates . Admins must ensure their systems are updated with the latest kernel patches their distro vendors provide. This incident is a crucial reminder of the importance of timely system updates and proactive security practices to protect against long-standing and potentially devastating vulnerabilities. Let's take a closer look at this issue and its potential impact on the security of your Linux systems. I'll also explain how you can determine if you are at risk and measures you can take to secure your systems against CVE-2024-36904 and similar bugs. Understanding This Kernel Vulnerability This vulnerability has its roots in a race condition between two functions in the TCP stack: tcp_twsk_unique() and inet_twsk_hashdance() function. Essentially, a race condition occurs when the output depends on the sequence timing of uncontrollable events, potentially causing unpredictable behavior. In this case, the time-wait TCP socket’s reference counter is initialized only after it has been inserted into a hash table and a lock is released. If another lookup happens before this initialization is complete,the object found will have an uninitialized reference counter. The severity of this issue cannot be overstated. The uninitialized reference counter can trigger various warnings and lead to use-after-free conditions. In practical terms, this opens the door for attackers to manipulate this condition to execute arbitrary code within the kernel space. Kernel-level code execution means that an attacker could gain complete control over the affected system, bypassing all conventional security mechanisms and potentially causing severe damage. Who Is At Risk? The vulnerability affects several widely used Linux distributions, including Red Hat Enterprise Linux and Fedora, potentially affecting millions of systems worldwide. The threat is indiscriminate, impacting both enterprise environments and individual users. However, the complexity of exploiting this vulnerability limits its exploitation to highly skilled attackers with an in-depth understanding of kernel internals and precise timing. Despite the technical barriers to exploitation, the risk remains significant due to the broad deployment of the affected distributions. Systems running outdated kernel versions that precede the recent upstream patch are particularly at risk. This broad spectrum of potential targets means that regardless of the specifics of an individual deployment, failing to apply patches could lead to disastrous consequences should an attacker choose to exploit this vulnerability. The Critical Nature of Kernel Protection The nature of this vulnerability underscores a perennial truth in cybersecurity: the most formidable threats often lie in the most overlooked places. Kernel protections are supposed to guard the core of the operating system against such vulnerabilities, yet when flaws like this go unnoticed, it highlights the limitations of existing defenses. The kernel, being the heart of the system, has access to all hardware and system resources. Therefore, any vulnerability at this level can have catastrophic implications. Protection and Remediation The good news is that there is a solution. In May 2024, this vulnerability was patched upstream, and affected distributions have been rolling out these critical updates. The immediate action required is straightforward: update your systems to the latest kernel versions that contain the relevant security fixes. Delaying these updates only increases the window of opportunity for potential attackers. Vendor-specific updates and advisories should be monitored closely. Red Hat Enterprise Linux and other major distribution maintainers have provided clear guidance on applying these patches, and it is crucial to follow these recommendations promptly. Ensuring that automatic updates are enabled where possible can mitigate the risk of manually updating every system, though manual checks should still be conducted regularly to ensure systems remain up-to-date. Beyond merely applying patches, this incident also serves as a reminder of the broader importance of proactive kernel auditing. Routine checks and balances, coupled with comprehensive use of auditing tools such as Syzkaller, can help identify potential vulnerabilities before they can be exploited. These preemptive measures can significantly enhance system resilience. Lessons Learned The discovery of this vulnerability brings several important lessons to the forefront. First and foremost, it highlights the necessity of consistent and rigorous kernel auditing practices . The ability of a bug like this to remain undetected for seven years is a stark reminder of the depth and complexity of modern operating systems and the constant vigilance required to secure them. Furthermore, the accident of its discovery—researchers found the flaw while trying to reproduce another known bug—highlights the often serendipitous nature of security research. It underscores the importance of extensive testing and fuzzing, not only when dealing with known vulnerabilities but as a routine part of system development and maintenance. The widespread nature of this vulnerability also emphasizes the need for comprehensive patch management policies. With so many systems potentially at risk, ensuring that patches are rolled out effectively and efficiently is critical. This also extends to communication. Keeping users informed about vulnerabilities and the availability of patches helps ensure broad compliance and reduces the overall threat landscape. Finally, this incident reinforces the value of community and collaboration in the open-source world. The rapid identification, disclosure, and patching of this vulnerability were made possible thanks to the collaborative efforts of researchers, developers, and distribution maintainers. This cooperative approach is one of the pillars of open-source security and is essential for addressing the dynamic and evolving challenges in the cybersecurity landscape. Looking Forward: Our Final Thoughts on the Implications of CVE-2024-36904 The Linux community must continue creating an environment that fosters proactive security measures, timely updates, and open collaboration. The cybersecurity landscape is constantly shifting, and the discovery of a seven-year-old vulnerability is an alert that constant vigilance must always be maintained. We Linux security admins have an unmistakable path forward: prioritize updates, engage in rigorous security practices, and stay abreast of new developments and advisories to protect existing and potential vulnerabilities in their environments. By doing this, we can ensure our environments remain protected against known and emerging risks. By learning from this incident and reinforcing proactive security measures, we can ensure a more secure future for all Linux users. . Linux kernel administrators must address CVE-2024-36904 to prevent severe security threats from this long-undetected flaw.. startling, revelation, researchers, uncovered, critical, vulnerability, linux, kernel. . Brittany Day
Feb 12, 2025
•
Security Vulnerabilities
210
security advisoryred hatdebianDebian, Ubuntu, Red Hat: CVE-2024-1086 Critical Threat of Kernel Exploit
In the world of open-source software , security vulnerabilities can have widespread consequences. The recent publication of a Linux privilege-escalation proof-of-concept exploit has sent shockwaves through the Linux community, demanding the immediate attention of Linux admins, infosec professionals, internet security enthusiasts, and sysadmins. . This flaw in the Linux kernel, CVE-2024-1086 , affects versions between 5.14 and 6.6.14 and can be exploited to gain root access on vulnerable machines. This could allow malicious actors to perform virtually any action they wish and could enable malware already on a computer to cause further damage. While the vulnerability has been patched, the implications and long-term consequences of such vulnerabilities warrant a closer examination. Using vulnerability management software can prevent such attacks. What Are the Implications of This Flaw? How Can I Secure My Systems Against It? Several critical aspects of this Linux kernel flaw should be highlighted. First, the vulnerability's extensive reach should be noted. It affects well-known Linux distributions such as Debian, Ubuntu, Red Hat, and Fedora. This broad scope raises concerns regarding the number of systems that might still be vulnerable despite the availability of patches. The bug hunter Notselwyn, who developed the proof-of-concept exploit, states, "Never had I ever gotten so much joy developing a project, specifically when dropping the first root shell with the bug." The Linux kernel flaw, with a CVSS severity rating of 7.8 out of 10, poses significant security risks to Linux systems. From a critical perspective, the immediate question arises: how was such a vulnerability present in the Linux kernel and remained undetected for so long? This highlights the need for robust security protocols and thorough code reviews within the open-source community to prevent such critical flaws from being exploited. Furthermore, this issue draws attention to the specific technical details ofthe exploit, encompassing the double-free bug in the Linux kernel's netfilter component involving nf_tables. A method called "Dirty Pagedirectory" is also used in this exploit, which builds on an earlier Linux kernel universal exploit technique. This technique grants unlimited, stable read/write access to all memory pages in a Linux system, ultimately providing an attacker complete control over the compromised system. This revelation raises questions about the potential misuse of this technique beyond the current exploit, highlighting the long-term consequences that this vulnerability may have on Linux security. Security practitioners, Linux admins, infosec professionals, and sysadmins must protect their systems against such vulnerabilities by applying the necessary patches and closely examining their security protocols to detect and prevent future vulnerabilities. Moreover, staying updated on security news and developments within the Linux community is crucial. Our Final Thoughts on This Recent Kernel Bug This article aims to shed light on a critical Linux kernel flaw that exposes systems to a privilege-escalation exploit and raise awareness among Linux admins, infosec professionals, and sysadmins about such vulnerabilities' potential risks and implications. By fostering a proactive approach to security, prioritizing patching, and continuously enhancing their security measures, admins can safeguard against future threats. . A significant flaw in the Linux kernel presents a danger of system compromise. Explore its consequences and mitigation techniques for enhanced security.. Linux Kernel Flaw, Privilege Escalation Threat, Security Risks, Vulnerability Management. . Brittany Day
Apr 19, 2024
•
Security Vulnerabilities
210
security advisoryvulnerabilitycritical threatUbuntu 24.04 Postponed Release Due to XZ-Utils Critical Threat
The recent security issue with xz-utils has delayed the latest Ubuntu beta release and other major Linux distros. The delay follows the discovery of a critical vulnerability, CVE-2024-3094 , which has prompted developers to push back the release by a week to ensure the safety of the upcoming Ubuntu version, codenamed Noble Numbat. . The impact of this security concern is not limited to just one distribution. It affects a multitude of Linux distros and requires a significant response from their respective development teams to tackle the vulnerability effectively. How Has This Issue Impacted Linux Distro Releases? What Are the Repercussions of These Delays? A pseudonymous attacker introduced the vulnerability to XZ version 5.6.0 through 5.6.1. This underscores the extent of the vulnerability, indicating that it has remained unnoticed across successive versions. This revelation could undoubtedly impact system administrators and infosec professionals in understanding the depth and persistence of the security threat within their infrastructures. This vulnerability has delayed the upcoming official release of the Ubuntu 24.04 version. Initially scheduled for April 25, the final version launch might also face delays, as reflected by comments from a Mastodon survey where only a slim majority anticipated the release to be on time. This uncertainty could have broader implications for users and organizations relying on the timely deployment of the Ubuntu 24.04 release, prompting questions about contingency plans and the readiness of alternative security measures. Our Final Thoughts: What Are The Implications of Delays Due to This Flaw? In light of these issues and their potential long-term consequences, security practitioners and Linux administrators must urgently reevaluate their approach to vulnerability management. This includes proactive risk assessment regarding the immediate impact on the pending releases and the broader implications for ongoing system security. Furthermore, the emergenceof open-source vulnerability detection tools presents a glimmer of hope. These tools offer efficient surveillance and showcase the community's collaborative efforts to address these security issues promptly. . The newly discovered xz-utils flaw resulted in postponements for Ubuntu beta and various other distribution launches, underscoring essential security concerns.. xz-utils vulnerability, Ubuntu 24.04, Linux distro threats, system admin security. . Brittany Day
Apr 05, 2024
•
Security Vulnerabilities
210
security advisorycriticalcritical threatUtil-Linux Advisory: CVE-2024-28085 Critical Wall Command Exploit
A critical vulnerability has been found in the wall command of the util-linux package that poses a severe security threat to Linux systems. This vulnerability, known as WallEscape and tracked as CVE-2024-28085 , has been present in every package version for the past 11 years. . It allows an attacker to exploit escape control characters to create a fake SUDO prompt on other users' terminals, ultimately tricking them into revealing their sensitive information, such as administrator passwords. The vulnerability can be exploited under certain conditions, mainly when the "mesg" utility is active and the wall command has setgid permissions. What Are the Implications of this Issue? How Can I Mitigate My Risk? This longstanding vulnerability in Linux systems poses potential risks, as attackers with access to multi-user Linux servers can leverage it to deceive unsuspecting users. This vulnerability has remained undiscovered and unpatched for over a decade, raising questions about the effectiveness of security auditing processes in open-source software developmen t. One exploitation scenario involves a fake SUDO prompt being created for the Gnome terminal, tricking users into entering their passwords. This prompts us to consider the wide-ranging implications of this vulnerability. Does this mean similar vulnerabilities may exist in other commonly used Linux utilities and commands? Are there additional attack vectors that could exploit similar flaws in terminal emulators? These questions highlight the broader security implications that necessitate further examination. This vulnerability serves as a wake-up call for Linux admins, infosec professionals, and sysadmins to prioritize patching vulnerabilities promptly . The fact that the exploitation of WallEscape requires local access limits its severity to some extent. However, in multi-user environments like organizational servers, the risk is heightened. System administrators are advised to upgrade to linux-utils v2.40 or implement mitigations byremoving setgid permissions from the wall command or disabling the message broadcast functionality using the 'mesg' command. In terms of long-term consequences, this issue highlights the need for continuous security monitoring and regular updates in the Linux ecosystem. The discovery of this decade-old vulnerability reveals the importance of comprehensive security audits and continuous testing to uncover hidden weaknesses that might have been overlooked. Additionally, it highlights the significance of collaboration within the open-source community to ensure timely vulnerability identification and patching. Our Final Thoughts on This Linux 'wall' Bug This article aims to shed light on a critical vulnerability in Linux systems and raise important questions about the overall security landscape of open-source software. It is an urgent reminder for Linux admins and security practitioners to prioritize vulnerability patching and continuous security monitoring. By addressing the long-standing vulnerability and emphasizing the need for r obust security practices , admins can mitigate risk and improve Linux system security. . An alarming vulnerability has been identified within the wall command, enabling deceptive SUDO prompts to mislead individuals into disclosing their passwords.. Util-Linux, Wall Command, Critical Advisory, SUDO Exploits. . Anthony Pell
Mar 29, 2024
•
Security Vulnerabilities
210
security advisorysecurity updateaccess controlDebian & Ubuntu OpenSSH: CVE-2021-41617, 2023-28531 Critical Issues
In the wake of the infamous “ Terrapin vulnerability ,” which allows a man-in-the-middle (MITM) attacker to access impacted users’ sensitive information in transit, Debian and Ubuntu have released security updates addressing five OpenSSH flaws. Let's explore the intricacies of these vulnerabilities, how they work, and recommended measures to fortify your OpenSSH environment. . What Are These New OpenSSH Vulnerabilities? CVE-2021-41617 Cvss 3 Severity Score: 7.0 High This issue involves a flaw in initializing supplemental groups when executing AuthorizedKeysCommand or AuthorizedPrincipalsCommand. Specifically, when a directive such as AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser is set to run the command as a different user, sshd fails to initialize supplemental groups correctly. This oversight results in these commands inheriting the groups that sshd was originally started with, potentially leading to unintended access. This issue could result in privilege escalation attacks, enabling malicious hackers to view additional infrastructure to attack, add or delete users, or modify permissions of files or other users. CVE-2023-28531 Cvss 3 Severity Score: 9.8 Critical This OpenSSH vulnerability stems from an error preventing the communication of constraints to the ssh-agent when adding smartcard keys. The issue occurs when per-hop destination constraints are in place, causing keys to be added to the agent without the intended constraints. This could potentially lead to unauthorized access or misuse of keys. CVE-2023-48795 Cvss 3 Severity Score: 5.9 Medium Known as the Terrapin attack , this flaw exploits a prefix truncation weakness in the SSH protocol, allowing a Man-in-the-Middle (MITM) attacker to compromise the integrity of the early encrypted SSH transport protocol. By sending extra messages before encryption starts and deleting an equal number of consecutive messages immediately after encryption begins, an attacker can achieve alimited break in the system’s security. This issue could result in privilege escalation attacks, enabling malicious hackers to view additional infrastructure to attack, add or delete users, or modify permissions of files or other users. CVE-2023-51384 Cvss 3 Severity Score: 5.5 Medium This OpenSSH bug highlights an issue with PKCS#11-hosted private keys. When adding these keys while specifying destination constraints and the PKCS#11 token returns multiple keys, only the first key has the constraints applied. This oversight could potentially lead to unintended access or misuse of keys. CVE-2023-51385 Cvss 3 Severity Score: 9.8 Critical This flaw exposes a potential command injection threat when an invalid user or hostname containing shell metacharacters is passed to ssh. If a ProxyCommand, LocalCommand directive, or match exec predicate references the user or hostname via expansion tokens, an attacker who can supply arbitrary user/hostnames to ssh might exploit this vulnerability. This scenario could arise, for example, in git repositories with submodules containing shell characters in user or hostname information. What Can I Do to Secure My Systems Against These OpenSSH Bugs? It is crucial to take proactive measures to secure your OpenSSH environment. Updating your OpenSSH packages to patch these vulnerabilities is highly recommended to ensure the ongoing security of your systems. Other mitigation strategies, such as using multi-factor authentication, network segmentation, and monitoring for compromise, are also highly recommended. Be sure to subscribe to our weekly newsletters to stay up-to-date on the latest advisories, information, and insights impacting the security of your Linux systems. Stay safe out there, OpenSSH users! . Timely patches addressing OpenSSH weaknesses are essential for safeguarding Debian and Ubuntu platforms. Prioritize your system security!. OpenSSH Security Update, Debian Security, Ubuntu SecurityPatches, Command Injection Threats. . Brittany Day
Jan 09, 2024
•
Security Vulnerabilities
210
security advisorysecurity issuecritical threatNVIDIA: Driver Update Advisory for Multiple Security Issues
NVIDIA issued a new Security Bulletin, to advise you to update your GPU drivers due to multiple security issues discovered. This bulletin went out today with the email arriving in my inbox moments ago, so here's the details of the issues that affect Linux. . Firstly all driver versions below these are affected: 530.41.03, 525.105.17, 515.105.01 and 470.182.03. So make sure you upgrade if you're on a driver below the version number listed there in each series. The driver actual series doesn't matter, they fixed it it all listed. Driver versions 525.105.17 and 470.182.03 were released today, which along with the security fixes also address other issues (other drivers already out had the fixes). . AMD's recent announcement highlights essential software patches for Windows platforms in light of various vulnerabilities. Act swiftly!. NVIDIA Driver Security Update, Linux Driver Patching, GPU Security Bulletins. . Brittany Day
Mar 31, 2023
•
Security Vulnerabilities
215
security advisorycritical threatconfiguration issueX.Org Server CVE-2023-0494 Critical Local Escalation Threat
The X.Org Server, a commonly used component to the Linux desktop, keeps on giving when it comes to security vulnerabilities with its massive, aging, and ill-maintained code-base. Disclosed on Monday night was CVE-2023-0494 as the latest security advisory and another discovery by the Trend Micro Zero Day Initiative. . CVE-2023-0494 entails local privilege elevation on systems where the X.Org Server is privileged and remote code execution is supported for SSH X forwarding sessions. Thankfully for many modern X.Org Server environments these days, the X.Org Server is no longer run as root / elevated privileges but for older systems and in other select configurations unfortunately remains running in such a vulnerable configuration. The CVE-2023-0494 vulnerability involves a use-after-free condition within DeepCopyPointerClasses for allowing reading and writing to freed memory via ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo(). The link for this article located at Phoronix is no longer available. . CVE-2023-0495 leads to unauthorized access in OpenSSH installations under certain conditions.. X.Org Server, Local Escalation, Security Threat. . Brittany Day
Feb 22, 2023
•
Desktop Security
210
security advisorydenial of serviceupdateUbuntu Kernel Security Update: Critical Threats Patch for Multiple Releases
Canonical has published new kernel security updates for all of its supported Ubuntu Linux releases as a massive update that addresses more than 20 security vulnerabilities discovered by various researchers in the upstream kernels. . The new kernel security updates are available for Ubuntu 22.10 (Kinetic Kudu) , Ubuntu 22.04 LTS (Jammy Jellyfish), Ubuntu 20.04 LTS (Focal Fossa) , Ubuntu 18.04 LTS (Bionic Beaver), as well as Ubuntu 16.04 and Ubuntu 14.04 ESM (Extended Security Maintenance) releases. The most critical security vulnerability patched in these massive Ubuntu kernel updates is CVE-2022-2663 , a flaw discovered by David Leadbeater in the netfilter IRC protocol tracking implementation that could allow a remote attacker to cause a denial of service or bypass firewall filtering. This affects all Ubuntu flavors except for Ubuntu 18.04 LTS, Ubuntu 16.04 ESM, and Ubuntu 14.04 ESM systems running Linux kernel 4.15. The link for this article located at 9 to 5 Linux is no longer available. . Recent kernel security patches released for various Ubuntu versions target significant vulnerabilities and bolster overall system defenses.. Ubuntu Kernel Security Updates, Kernel Updates, Ubuntu LTS Security Patches. . Brittany Day
Jan 09, 2023
•
Security Vulnerabilities
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!