Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 6 articles for you...
83
data protectionthreat analysisincident responseCombatting BlackLock Ransomware: Strategies for Linux Security Admins
Since its discovery in March 2024, BlackLock (also known as El Dorado or Eldorado) has quickly established itself as a serious threat within the ransomware-as-a-service ecosystem. Linux security admins face an adversary capable of targeting Linux environments alongside Windows and VMWare ESXi systems. Its custom malware poses an additional danger with its double extortion strategy involving data encryption and theft to coerce victims into paying ransom. . Linux administrators seeking to defend against BlackLock must keep systems updated, implement reliable backups, and increase endpoint security. Understanding BlackLock's infrastructure and tactics - such as sophisticated data leak sites or recruitment via cybercriminal forums - is also key. By being aware of their techniques and evolution, we can better safeguard environments against this rapidly growing threat. Let's take a closer look at BlackLock ransomware, its defining tactics and techniques, and practical measures you can take to secure your Linux environment against this advanced threat. The Rising Threat of BlackLock BlackLock’s ascent in the ransomware world has been nothing short of alarming. By Q4 of 2024, activity linked to BlackLock had surged by an astounding 1,425%, marking it as a threat that cannot be ignored. This exponential growth is due to its widespread campaigns and sophisticated ransomware attack approach. Unlike many ransomware groups that rely on off-the-shelf malware, BlackLock invests in developing custom malware tailored for maximum impact. This bespoke approach allows them to fine-tune their attacks to specific vulnerabilities, enhancing their success rate. Understanding BlackLock's Double Extortion Tactic BlackLock stands out for employing an advanced double extortion tactic. Traditional ransomware attacks primarily threaten victims with data encryption: attackers encrypt victim's data and demand payment in exchange for decryption keys. However, Blacklock takes this a step further by not onlyencrypting but also exfiltrating data. BlackLock victims risk their data being released publicly or sold if they fail to comply with ransom demands made by attackers. BlackLock uses this tactic to exert double pressure on victims. Data leaks can devastate businesses, as they threaten reputational harm, legal liability, and client trust issues - increasing the chance that victims pay the ransom and making this approach very lucrative for BlackLock. Practical Advice for Protecting Linux Environments Given BlackLock’s specific targeting of Linux systems, Linux security admins must adopt proactive and comprehensive defense strategies. Ensuring all systems are routinely updated with the latest security patches is a crucial first step. Outdated software often has unpatched vulnerabilities that attackers can exploit, so staying current is imperative. Beyond updates, admins should focus on implementing robust backup solutions . Having regular and isolated backups can mitigate the impact of ransomware by ensuring that critical data can be restored without succumbing to ransom demands. However, it is essential to test these backups regularly to ensure they function correctly when needed. Enhancing Endpoint Security Enhancing endpoint security is another essential aspect of combatting BlackLock. Implementing advanced endpoint protection solutions with real-time threat detection and response features can assist in quickly detecting and neutralizing ransomware before it causes irreparable harm to systems and data. As BlackLock often deploys customized malware, behavior-based detection mechanisms will prove particularly effective in mitigating risk. Reducing administrative privileges can limit the extent of an attack, providing users with only those permissions required for their roles. Using multi-factor authentication (MFA) on critical systems can further lower risk. This helps admins prevent ransomware from spreading across networks. Understanding BlackLock's Infrastructure Anessential aspect of combatting BlackLock involves understanding its infrastructure and evasion techniques. With secure communication mechanisms, BlackLock uses sophisticated data-leak websites that are well-protected against takedown attempts. Awareness of their operations and regularly checking known threat actor forums can provide valuable insights into upcoming threats or ongoing campaigns that BlackLock may undertake. BlackLock's recruitment on cybercrime forums indicates a well-planned and expanding operation. It also provides security professionals with early warning of new tools and techniques that collaborators might employ and provides critical intelligence gathering to anticipate attacks. The Importance of Incident Response Planning Even with the most stringent precautions in place, breaches may still occur. Therefore, having a comprehensive incident response plan in place is crucial - one that outlines specific steps for detecting, containing, and eliminating ransomware from your network, along with protocols for communicating with stakeholders and law enforcement officials in case an attack does occur. Regular incident response drills can help ensure that teams are prepared to act swiftly and effectively should a ransomware attack occur. Such drills help identify any gaps or flaws in their response plans and allow them to fine-tune processes and procedures. Our Final Thoughts on Staying Vigilant in the Face of This RaaS Threat BlackLock's rapid ascension as a significant ransomware threat reinforces the necessity of vigilance and preparation to combat attacks like these. By understanding BlackLock's tactics, techniques, and infrastructure, we can better defend our environments against potential attacks. Staying up-to-date with ransomware developments, regularly updating and backing up systems , strengthening endpoint security, and having an incident response plan are essential components of an effective defense strategy. In the face of sophisticated adversaries like BlackLock,taking a proactive and informed approach is the only effective means of protecting sensitive data while upholding your Linux system's safety and integrity. . System administrators need to remain informed and bolster device safety measures to tackle BlackLock ransomware with efficiency.. Linux Ransomware Protection, BlackLock Threat, Endpoint Security Strategies. . Brittany Day
Feb 20, 2025
•
Hacks/Cracks
78
Linux securityendpoint securitycyber threat preventionEnhancing Linux Security: Microsoft Defender Device Isolation Feature
Organizations using Microsoft's Defender for Endpoint will now be able to isolate Linux devices from their networks to contain intrusions and whatnot. . The device isolation capability is in public preview and mirrors what the product already does for Windows systems. "Some attack scenarios may require you to isolate a device from the network," Microsoft wrote in a blog post . "This action can help prevent the attacker from controlling the compromised device and performing further activities such as data exfiltration and lateral movement. Just like in Windows devices, this device isolation feature." Intruders won't be able to connect to the device or run operations like assuming unauthorized control of the system or stealing sensitive data, Microsoft claims. The link for this article located at The Register is no longer available. . Fortify Linux systems utilizing Microsoft's Defender by isolating endpoints to combat cyber threats efficiently.. Microsoft Defender, Linux Device Isolation, Cyber Threat Prevention. . LinuxSecurity.com Team
Feb 11, 2023
•
Vendors/Products
77
server protectionthreat managementLinux serversMicrosoft Defender: New Server Protection Features for SMBs
Microsoft launched a preview of new server protection capabilities in its Defender for Business solution back in July. The company announced this week that this feature is now generally available to help small businesses protect Windows and Linux servers. . Microsoft Defender for Business is an endpoint security solution for small and medium-sized businesses (SMBs) with up to 300 users. The service offers attack surface reduction, threat management, antimalware protections, as well as automatic investigation and remediation features. With this release, Microsoft Defender for Business includes a threat and vulnerability management (TVM) feature that helps customers to quickly detect and address vulnerabilities. IT admins can view security recommendations for Windows and Linux servers in the Threat and Vulnerability Management dashboard. . Explore the enhancements in Microsoft Defender for Business designed for small and medium-sized enterprises, ensuring robust protection for Windows and Linux servers.. Server Protection, SMB Security Solutions, Endpoint Security. . LinuxSecurity.com Team
Dec 14, 2022
•
Server Security
78
corporate protectionendpoint securitysecurity applicationKaspersky Endpoint Security 8: Enhanced Protection For Linux Systems
Kaspersky Lab has announced the release of Kaspersky Endpoint Security 8 for Linux. The updated version of the application designed to protect Linux workstations is available as part of the following corporate products: Kaspersky Work Space Security, Kaspersky Open Space Security, Kaspersky Business Space Security and Kaspersky Enterprise Space Security. . The application provides maximum protection for Linux-based systems and can be integrated into the corporate IT environment for purposes of centralised administration, gathering statistics and enforcing global security policies. Kaspersky Endpoint Security 8 for Linux includes Kaspersky Anti-Virus Engine 8.0 The link for this article located at Gadget ZA is no longer available. . The application provides maximum protection for Linux-based systems and can be integrated into the c. kaspersky, announced, release, endpoint, security, linux, updated. . LinuxSecurity.com Team
Jun 09, 2011
•
Vendors/Products
67
network securitymalwareendpoint securityEmerging SSL Risks: Malicious Activity Through Network Traffic
As more applications turn to SSL to help keep users secure, they may also be inadvertently hampering the ability of enterprises to ensure malicious code and exploits are not slithering through network traffic from the endpoint.. According to The Application Usage and Risk Report conducted by Palo Alto Networks, applications using SSL represent 25 percent of the applications examined and 23 percent of the overall bandwidth used by applications in its study. To compile the report, the security vendor analyzed the traffic of 1,253 organizations and a viewed more than 28 exabytes of data between October 2010 and April 2011. The report predicts that applications that use SSL will continue to grow in size, as more applications follow the relatively recent lead of Twitter, Facebook and Gmail, which have all recently set SSL either as a standard setting or as a user-selectable option. The link for this article located at CSO Online is no longer available. . The rise of SSL usage heightens vulnerabilities, enabling malware to traverse networks undetected, affecting organizations significantly.. applicationRisk, SSLApplication, networkTraffic, maliciousExploits, endpointSecurity. . LinuxSecurity.com Team
May 12, 2011
•
Cryptography
83
security advisoryendpoint securityautorunLinux Ubuntu Exploit: IBM X-Force Investigates USB Autorun Attack
A security researcher has demonstrated how it might be possible to perform autorun-style attacks against weakly secured Linux PCs.. Windows worms including Conficker and Stuxnet have often spread onto networks after infected USB sticks were plugged into PCs. This has happened automatically in cases where autorun was enabled, as it did in default on older versions of Windows until a change pushed by Microsoft on Tuesday. With autorun-enabled executable files run with minimal user interaction. Research by Jon Larimer, of IBM's X-Force security division, shows that the issue of autorun causing possible mischief is not (as might have been previously thought) wholly irrelevant to Linux boxes. Larimer developed a demo to show how it might be possible to insert a USB stick with modified code into a Ubuntu PC to get rid of a screensaver without entering a password The link for this article located at The Register UK is no longer available. . Autorun exploits are evolving beyond Windows, now threatening Linux systems. Users must be aware of risks, disable auto-mounting, and enhance their security practices. USB Malware, Autorun Attack, Linux Exploit, IBM X-Force. . LinuxSecurity.com Team
Feb 10, 2011
•
Hacks/Cracks
67
data protectionkey managementsecurity acquisitionSymantec Acquisition of PGP and GuardianEdge Strengthens Data Protection
Symantec will acquire encryption specialist PGP and endpoint security vendor GuardianEdge Technologies for $300 million and $70 million respectively, the company said today.. Both are privately held companies. Symantec said the deals are subject to regulatory approval but are expected to close by June. Symantec said the companies' combined specialties in standards-based encryption for e-mail, file systems, removable media and smartphones will complement its security offerings, such as its gateway, endpoint security and data-loss prevention software. Encrypting information offers a higher level of security in case data is lost or stolen. Symantec said it will standardize its products on PGP's key management platform, which allows administrators to centrally manage encryption tasks. That platform will be integrated into the Symantec Protection Center, a management console for its products. The link for this article located at Computer World is no longer available. . The acquisition of PGP and GuardianEdge by Symantec bolsters their encryption capabilities and fortifies endpoint security, leading to enhanced safeguards for sensitive data.. Symantec Acquisition, Encryption Specialist, GuardianEdge Technologies, Data Security, Key Management. . LinuxSecurity.com Team
Apr 29, 2010
•
Cryptography
79
network securitynetwork protectioncybersecurity strategyUnderstanding Hacker Tactics for Network Security and Defense
This tutorial on hacker attack techniques and tactics will provide insight inside the mind of a hacker and help you to understand a malicious attacker's motives. You will receive advice on how hackers target specific information and what polices and procedures every organization should have in place to protect sensitive data. . You will receive information on an array of specific hacker techniques and tactics, such as system fingerprinting and probing, which allow hackers to obtain access to your network systems or files. You will learn how to thwart hacker tactics and techniques with a variety of procedures and defenses, including intrusion prevention and detection (IPS/IDS) technology. This guide also offers valuable advice on the importance of securing your network endpoints and will teach you how to mitigate the threat of hackers connecting to your computers via open network ports. You will also receive tips on how to know if you system has been compromised by a malicious hacking attempt, how to keep your wireless network secure and best practices for end-user education on current threats and preventative measures. The link for this article located at Search Security is no longer available. . Familiarize yourself with different cybercriminal methods and strategies to protect your system. Grasp the essentials of preventing intrusions.. hacker Techniques, Network Protection, Cybersecurity Strategies. . LinuxSecurity.com Team
Jul 02, 2009
•
Security Projects
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!