Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 80 articles for you...
83
encryptionnational securityrisk assessmentChina: Cyberattack on Telecom Industry Raises Encryption Backdoor Risks
U.S. authorities are on high alert as they investigate an alleged Chinese state-sponsored hack targeting major U.S. telecommunications companies. This attack has reignited debate about encryption backdoors , an ongoing contention among security practitioners. . To help you understand this incident and the security implications of encryption backdoors, I'll discuss these recent attacks, lawmakers' reactions, the role of encryption backdoors in this threat, and why many security professionals—including us at LinuxSecurity.com —oppose their usage. Understanding This Hack Federal authorities have quickly investigated a cyberattack known as Salt Typhoon, linked to China-backed hackers. According to an anonymous U.S. official, these attackers targeted multiple U.S. telecommunications firms, including Verizon, AT&T, and Lumen Technologies. They compromised systems explicitly used by government intelligence collection capabilities such as wiretaps. The implications of this breach extend far beyond corporate walls, posing potential threats to national security. Chinese hackers compromised telecom systems and breached U.S. intelligence systems used for lawful surveillance, such as wiretapping. Investigators are meticulously studying the depth to which hackers have penetrated these networks and whether these criminals have extracted sensitive data. Lawmakers' Reaction to This Incident This incident has sparked significant concern among U.S. lawmakers, with Senator Ron Wyden of Oregon leading the charge by calling upon both the Justice Department and Federal Communications Commission (FCC) to implement stringent security standards for telecom companies' wiretapping systems. He specifically mentioned an outdated regulatory framework as he expressed disappointment over how the DOJ dealt with cyberattacks, which he considered negligent. Wyden suggested setting baseline cybersecurity standards that can be enforced through fines while conducting annual third-party cybersecurity auditsby an independent firm. He also advocated for full transparency regarding data breaches among Congress, investigators, and the public, holding negligent corporations responsible - an approach that signals a shift toward corporate accountability rather than prosecuting foreign hackers who rarely find justice in U.S. court systems. What Are Encryption Backdoors? Encryption backdoors are built into encrypted systems to give authorized authorities access to encrypted data for regulatory or national security reasons. Still, if discovered, they can potentially be exploited by malicious actors. Encryption is at the core of modern cybersecurity, protecting sensitive information from unintended access and modification. Robust encryption protocols also facilitate secure communications, safeguard individual privacy, and enhance national security. Examining the Pros & Cons of Encryption Backdoors Encryption backdoors offer both advantages and drawbacks. On one side, they can improve national security by aiding law enforcement with lawful surveillance operations and efficient investigations by providing necessary access to encrypted data. On the other hand, however, they could threaten national security. Encryption backdoors may help ensure compliance in critical infrastructure sectors like telecom and finance; however, their advantages come with potential drawbacks that should not be ignored. Backdoors introduce inherent vulnerabilities into systems, rendering them insecure without discriminating between good and bad actors. Unauthorized individuals could exploit them to access sensitive data. Recent hacks by China have illustrated how malicious actors can exploit backdoors to access data via backdoors, thus endangering national security and corporate confidentiality. Encryption backdoors can potentially erode public trust in cybersecurity and privacy efforts, discouraging users from adopting encryption technologies. Finally, exploited backdoors may lead to security breaches with substantial financiallosses, legal liabilities, and damage to corporate reputations. What Is the Security Community's Stance on Encryption Backdoors? Security experts have long opposed encryption backdoors as contrary to encryption's very purpose. China-backed hacks prove that backdoors can be dangerous. By exploiting backdoor access mechanisms, hackers can gain entry to systems considered secure by encryption. Leading cybersecurity experts advocate for solid encryption without any backdoors. Vital, unbreakable encryption is critical for protecting against sophisticated cyber threats, ensuring personal privacy, and maintaining national security systems' integrity. Responsible encryption involves designing systems to minimize risks without including backdoors. Our Final Thoughts: The Potential Risks of Encryption Backdoors Outweigh Their Advantages Recent attacks targeting U.S. telecom companies highlight the vulnerabilities posed by encryption backdoors. Although intended for national security and regulatory compliance purposes, backdoors present vulnerabilities that malicious actors can exploit—even state-sponsored hackers—looking for vulnerabilities they can use to breach national security and regulatory compliance. As digital ecosystems mature and cyber threats grow increasingly sophisticated, robust encryption without backdoors remains essential to safeguard sensitive information, maintain personal privacy, and fortify national security systems from unintended access. Instead of compromising encryption standards, policymakers should improve cybersecurity protocols, revise regulatory frameworks, and hold corporations accountable for their security practices. Encryption backdoors may seem beneficial regarding law enforcement and regulatory compliance, yet their inherent risks far outweigh their perceived advantages. This is demonstrated by China-backed hacks, such as those perpetrated against our digital infrastructures by hackers armed with access devices from China. Robust encryption without backdoorsmust be implemented for optimal digital security. . The U.S. investigation into hacking by Chinese operatives raises tensions, impacting corporate regulations, international alliances, and public trust in technology security.. Telecom Cybersecurity, Encryption Backdoors, Cybersecurity Legislation, National Security Issues. . Brittany Day
Oct 16, 2024
•
Hacks/Cracks
77
security practicesmalwareopen sourceMigo Malware Threatens Linux Redis Servers: Cryptojacking Attack
A new malware dubbed “Migo” that is targeting Linux Redis servers to mine cryptocurrency via a cryptojacking attack has been discovered. This campaign employs many Redis system-weakening commands to potentially disable data store security features that could hinder their initial attempts at access. . What Is Migo Malware & How Does It Target Linux Redis Servers? Migo tries to infiltrate Redis servers to mine cryptocurrency on the Linux host. Researchers noted that the malware employs several Redis commands to carry out a cryptojacking attack. Redis is an open-source NoSQL key/value store that runs entirely in memory and is mainly utilized as a quick-response database or application cache. The platform offers unmatched speed, dependability, and performance since it keeps data in memory rather than on a disk or solid-state drive. One critical aspect of the malware is that after disabling several configuration parameters, the attacker uses the “set” command to set the values of two Redis keys. One key is assigned a string value corresponding to a malicious attacker-controlled SSH key, and the other to a Cron job that retrieves the malicious primary payload from Transfer.sh via Pastebin. The main payload of the malware is a compiled binary created with Go, indicating that the individuals behind Migo are still refining their methods and making the analysis process more difficult. What Can We Learn From This Threat? As an open-source platform, Redis is incredibly vulnerable to these types of attacks, and the Migo malware underscores the importance of developing a robust security protocol around Redis deployments. Regularly testing and updating Redis servers, developing a response and recovery plan, consistently monitoring and analyzing server traffic, and putting in place user activity monitoring safeguards are all steps that should be taken to minimize risks and exposure. Our Final Thoughts on Migo Malware This newly discovered threat's impact on security practitioners can not beoverstated. It is a compelling reminder of the need to develop a robust security protocol around Redis servers. Cybercrime is evolving, and open-source software protocols like Redis face unique challenges. We urge admins, users and organizations to take a rigorous and proactive approach to keeping pace with new developments to stay ahead of the curve. Staying informed on security developments and trends and continuing education and upskilling in security practices are critical in mitigating the ongoing threat of cyberattacks. . Discover Migo malware that specifically exploits Linux Redis servers for cryptojacking efforts and strategies for defense. Keep updated!. Migo Malware, Linux Redis, Cryptojacking Attack. . Anthony Pell
Feb 21, 2024
•
Server Security
82
cybersecurityLinuxcyberattackAustralia: ACSC Investigates Prime Minister's Website Cyberattack
A cyberattack recently hit Australia's Prime Minister's website. The Prime Minister's Office confirmed the attack but did not comment on how it was carried out. Linux screenshots serve as evidence of this attack. . The cyberattack is being investigated by the Australian Cyber Security Centre (ACSC). The ACSC is also investigating an incident involving the Department of Defence's website, which was also hacked. According to a report by ABC News, the ACSC is working with its counterparts in New Zealand to combat cyber threats. Cybercriminals are increasingly targeting government entities and their websites for various reasons—including selling sensitive data or gaining access to more information about government employees and officials. According to The Cyber Express, "As Australia confronts the challenges posed by cyber threats, the alleged cyberattack on the Australian Prime Minister’s website is a wake-up call for a larger cyber campaign against the country — orchestrated by the Lulz Security Indonesia hacker group." Stay up-to-date on the latest Linux security news, information, and insights required to secure your systems by subscribing to our weekly newsletters. Have additional questions about securing your Linux systems? Connect with us on X @lnxsec - we're here to help! Stay safe out there, fellow Linux users! . A cyberattack compromising the Canadian Prime Minister's online platform triggers a CSE inquiry into security vulnerabilities.. Cybersecurity Australia, Government Cyber Attacks, Linux Security Insights. . Brittany Day
Dec 28, 2023
•
Government
209
threatmalwaresecurity strategyRecognizing Linux Malware Risks And Detection Strategies
Although Linux offers security advantages, users must remain vigilant against various forms of malware and cyberattacks. . Linux is often praised for its enhanced security compared to other operating systems. Nevertheless, IT professionals must never assume that Linux is immune to threats. Due to widespread adoption in critical infrastructure, Linux has drawn the attention of advanced persistent threat (APT) groups aiming to breach its security. Additionally, Linux finds use in various IoT devices. One of the largest cyberattacks in history involved the “Mirai” malware , which exploited vulnerabilities in devices running Linux. In this article, we will explore characteristics of Linux malware, examine malware distribution methods, and learn how to thwart attacks. . Delve into the landscape of malware aiming at Linux systems, and identify proactive methodologies to bolster defenses and prevent cyber intrusions.. Linux Malware Threats, Cybersecurity Strategies, Malware Prevention Techniques. . Brittany Day
Aug 21, 2023
•
Security Trends
78
threat analysismalwarebotnetRedis Under Threat: P2Pinfect Worm Malware Targets Data Storage Tool
An unknown group of hackers is using a novel strain of malware to attack publicly accessible deployments of Redis — a popular data storage tool used by major companies like Amazon, Hulu and Tinder. . Researchers from Cado Security Labs explained that what stood out most was the fact that the malware appears to be a worm — a subset of malware that can propagate or self-replicate from one computer to another without human activation after breaching a system. The researchers said they recently encountered the malware, which they labeled “P2Pinfect,” and were alarmed at its ability to self-propagate and spread itself to other vulnerable Redis deployments. The report does not name specific victims of the malware, and Cado Security said it is unclear what the botnet's purpose is. The hacking campaign was initially analyzed by Palo Alto’s Unit 42 in a report on July 19, which found the malware exploiting CVE-2022-0543 to take over Redis applications and add them to a botnet — a group of computers that have been infected in a way that allows a hacker to control them all. . A troubling novel worm-like virus exploiting MySQL setups presents significant threats throughout systems.. Redis Botnet, Worm Malware, Cyberattack Prevention, Data Security, P2Pinfect Threat. . LinuxSecurity.com Team
Aug 01, 2023
•
Vendors/Products
83
malwareLinux toolbackdoorAlloy Taurus Targets Nations With Linux PingPull Backdoor Tool
The Chinese nation-state group dubbed Alloy Taurus is using a Linux variant of a backdoor called PingPull as well as a new undocumented tool codenamed Sword2033. . That's according to findings from Palo Alto Networks Unit 42, which discovered recent malicious cyber activity carried out by the group targeting South Africa and Nepal. Alloy Taurus is the constellation-themed moniker assigned to a threat actor that's known for its attacks targeting telecom companies since at least 2012. It's also tracked by Microsoft as Granite Typhoon (previously Gallium). Last month, the adversary was attributed to a campaign called Tainted Love targeting telecommunication providers in the Middle East as part of a broader operation referred to as Soft Cell. The link for this article located at The Hacker News is no longer available. . Investigations from San Jose indicate that Alloy Leo is focusing on countries employing the Unix ConnectDrop exploit and Diamond2021 software.. Alloy Taurus, Linux Malware, Telecom Cyber Threats. . LinuxSecurity.com Team
Apr 28, 2023
•
Hacks/Cracks
67
malwareransomwaresecurity threatClop Ransomware Targets Linux Servers With Encryption Flaw
The Clop ransomware gang is now also using a malware variant that explicitly targets Linux servers, but a flaw in the encryption scheme has allowed victims to quietly recover their files for free for months. . This new Linux version of Clop was spotted in December 2022 by Antonis Terefos, a researcher at SentinelLabs , after the threat group used it together with the Windows variant in an attack against a university in Colombia. While very similar to the Windows version, as they both use the same encryption method and almost identical process logic, there still are some differences, mainly limited to OS API calls and features still waiting to be implemented in the Linux variant. . The REvil ransomware group takes advantage of a security vulnerability, enabling Windows users to retrieve data for weeks without being noticed.. Clop Ransomware, Linux Malware, File Recovery Techniques, Cybersecurity Threats. . LinuxSecurity.com Team
Feb 07, 2023
•
Cryptography
209
malwaresecurity threatcyberattackCyberattacks Striking Linux Systems Every Minute: BlackBerry Report
Threat actors are evolving to target a wide variety of systems and infrastructure, BlackBerry says in a new report. "In addition, attacks against Linux systems and cloud infrastructure will increase as threat actors look to install backdoors on target systems and gain visibility into organizations for further activities." . A new report from BlackBerry reveals that threat actors are launching an attack about once every minute, with the resurgence of the Emotet botnet, phishing attacks and infostealers dominating the attack landscape. The Ontario-based intelligent security software and services provider’s first Global Intelligence Report on the fourth quarter of 2022 find that the company’s AI-driven prevention-first technology stopped more than 1.75 million malware-based attacks. According to BlackBerry, the most common tools used in attacks include the Emotet botnet, the Qakbot phishing threat and an increase in infostealers such as GuLoader. . A recent study by McAfee indicates that cybercriminals are executing a breach roughly every 60 seconds, focusing on digital infrastructures.. Linux Threat Actors,Cybersecurity Report,Cloud Attack Trends. . Brittany Day
Jan 26, 2023
•
Security Trends
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!