Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 7 articles for you...
210
security fixpatch managementsecurity risksLinux Kernel Security Fixes Spotted Pre-Release: Exploit Risks Identified
Security researchers have found that they can detect Linux kernel security fixes before they are released - information that could be used by malicious hackers to develop and deploy exploit code before patches are widely available. . Boffins affiliated with BMW, Siemens, and two German universities say they can pinpoint obfuscated Linux kernel security fixes, developed in secret, before they are officially released. This is insight miscreants could use to develop and deploy exploit code before patches are widely available. What's more, the team found that Linux kernel patches are regularly introduced in a way that bypasses public review and discussion, a practice that opens at least a theoretical risk of backdoored code. . Cybersecurity experts disclose techniques for identifying kernel patches before their official release, which may facilitate the creation of exploits.. Linux Kernel Fixes, Security Risks, Patch Management, Exploit Vulnerabilities. . Brittany Day
Sep 07, 2020
•
Security Vulnerabilities
77
local exploitOpenSSHsystem protectionExploring Local Exploit Risks in OpenSSH Security Alerts
When is a 0day in OpenSSH not a 0day? When it's local exploit code. Not the kind that exploits a vulnerability in the system you are logged into, to escalate privilege for example. The kind that takes advantage of potential vulnerabilities in the gray matter between your ears to make a mess of your local system. A reader wrote in to advise us of a potential 0day in the current version of OpenSSH 5.3/5.3p1 released Oct 1, 2009. . He provided a link to a blog post which has what appears to be exploit code. Unfortunately the first thing I did, before I looked at the code, was fire off an email to the OpenSSH list. They responded quite quickly that "It's pretty clear that the code just exploits your local machine...". Woops. A follow up email says "Looks like a rehash of the fake "exploit" from last July." So, the good news is, there does not appear to be a 0day on OpenSSh making the rounds. The bad news is, if you ran the code you are rebuilding your system. Worse still, if you emailed all your friends pointing to the 'exploit' code, well, now you look rather foolish. Lesson one to me, always check things out. Do the research and analysis before crying wolf. Fortunately no harm done. This has to be balanced against the requirement for timeliness of information flow along a contact tree. In this case I erred on the side of alerting quickly. The link for this article located at SANS is no longer available. . He provided a link to a blog post which has what appears to be exploit code. Unfortunately the first. openssh, local, exploit, exploits. . LinuxSecurity.com Team
Feb 08, 2010
•
Server Security
83
unauthorized accessmalware analysishacking toolInternet Explorer Attack Code: Major Cyber Threats to Users Revealed
The dangerous Internet Explorer attack code used in last month's attack on Google's corporate networks is now public. The code was submitted for analysis Thursday on the Wepawet malware analysis Web site, making it publicly available. By Friday, it had been included in at least one publicly available hacking tool and could be seen in online attacks, according to Dave Marcus, director of security research and communications at McAfee.. The attack is very reliable on Internet Explorer 6 running on Windows XP, and it could possibly be modified to work on more recent versions of the browser, Marcus said. "The game really changes now that it's hosted publicly," he said. A hacker could use the code to run unauthorized software on a victim's computer by tricking them into viewing a maliciously crafted Web page. The link for this article located at InfoWorld is no longer available. . The widespread distribution of vulnerabilities in an outdated web browser poses significant dangers and challenges to vulnerable networks.. Internet Explorer Attack,Cybersecurity Threat,Public Exploit,Malware Analysis. . LinuxSecurity.com Team
Jan 18, 2010
•
Hacks/Cracks
83
security researchexploit codeintel technologyIntel SMM Exploit Code Release: Major Threat to System Security
Could just be FUD but if it's not, get ready: This is the scariest, stealthiest, and most dangerous exploit I've seen come around since the legendary Blue Pill! No, I'm not just trying to sensationalize this or spread fear, uncertainty and doubt. This is serious and represents a massive new security threat for us all. Security Researchers Joanna Rutkowska and Loic Duflot are planning to release a research paper + exploit code for a new SMM (System Management Mode) exploit that installs via an Intel. The link for this article located at Network World is no longer available. . The link for this article located at Network World is no longer available.. ready, scariest, stealthiest, dangerous. . LinuxSecurity.com Team
Mar 19, 2009
•
Hacks/Cracks
83
security advisorybrowser attackevasion techniqueExploring New VoMM Exploit Methods That Threaten Browser Security
Hackers are developing new software that will help hide browser attack code from some types of security software. The software, called VoMM (eVade o. The software users server-side scripting technology to create new versions of the exploit code, which then get delivered to browser users when they visit the attacker's Web site. By making a number of cosmetic changes to the code that do not affect its functionality, VoMM creates a new version of the malicious software that cannot be detected by "signature-based" techniques. The link for this article located at ComputerWorld is no longer available. . Investigates innovative hacking tools leveraging server-side programming to avoid recognition and conceal exploitative scripts proficiently.. Browser Exploit Techniques, Security Evasion Tactics, Malware Evasion Methods. . LinuxSecurity.com Team
Oct 23, 2006
•
Hacks/Cracks
83
malwaresecurity researchonline threatsRussian Affiliate Model Spreads Malware Through Exploits
An online business based in Russia will pay Web sites 6 cents for each machine they infect with adware and spyware, security researchers said Tuesday, calling the practice "awful." . iframeDOLLARS.biz, which according to a WHOIS lookup, is registered to a Nick Fedorov in Nizhny Novgorod, a Russian city on the Volga about 240 miles east of Moscow, will pay Webmasters to place a one-line exploit on their sites. The code exploits a number of patched Windows and Internet Explorer vulnerabilities, including some that go back as far as 2002. Systems that haven't been updated, however, would still be vulnerable to the exploit. According to analysis done by the SANS Institute's Internet Storm Center, the exploit drops at least nine pieces of malicious code, including backdoors, other Trojans, spyware, and adware, on any PC whose user surfs to a site hosting the exploit code. iframeDOLLARS says it pays $61 per thousand unique installs, or 6.1 cents per compromised machine, to any site that signs up as an affiliate. The Russian firm boasts that its exploit works "without any ActiveX console or any pop-upsIt means that you will not lose your unique visitors." Nor, apparently, give away the fact that the code is dropping malware onto machines whenever a vulnerable user simply visits an affiliate site. According to the Internet Storm Center, organizations can prevent the downloading of adware and spyware from iframesDOLLARS' servers by blocking the IP address 81.222.131.59. The link for this article located at Security Pipeline is no longer available. . Russian cybercriminals exploit affiliate models to distribute spyware via compromised websites, incentivizing partners to install malware through deceptive ads and links. Spyware Distribution, Adware Tactics, Online Security Threats. . LinuxSecurity.com Team
May 25, 2005
•
Hacks/Cracks
83
security advisoryremote accesscross-site scriptingFirefox 1.0.3 Security Advisory: Critical Cross-Site Scripting Risks
Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them. The cross-site scripting and remote system access flaws were discovered in Firefox version 1.0.3, but other versions may also be affected, said security company Secunia, which issued the ratings Sunday. . The two vulnerabilities, when combined, can be exploited, but no known cases have yet emerged where an attacker took advantage of the public exploit code. One flaw involves "IFRAME" JavaScript URLs, which are not properly protected from being executed in the context of another URL in the history list. "If you visit a malicious Web site, it can steal cookie information from other Web sites you had previously visited," said Thomas Kristensen, Secunia's chief technology officer. The attacker could then use that information to engage in identity theft or gain access to other password-protected sites that the victim visited. A second vulnerability exists in the IconURL parameter in InstallTrigger.install(). Information passed to this parameter is not properly verified before it's used, allowing an attacker to gain user privileges. This flaw could allow an attacker to gain and escalate user privileges on a system.. The two vulnerabilities, when combined, can be exploited, but no known cases have yet emerged where . vulnerabilities, popular, firefox, browser, rated, 'extremely, critical', because. . LinuxSecurity.com Team
May 09, 2005
•
Hacks/Cracks
83
security advisorycriticalMozillaFirefox 1.0.3 Security Advisory: Critical Exploits Detected
Here's a wake-up call for those who ditched Internet Explorer for Firefox, believing it's more secure than Microsoft's much-attacked browser: Proof-of-concept code targeting security holes in Firefox and the Mozilla Suite have started appearing on public mailing lists. An attacker could exploit the flaws to launch malicious code. But users can protect themselves by updating to Firefox 1.0.3 and Mozilla Suite 1.7.7. . "These exploits allow the attacker to run arbitrary commands on Firefox before version 1.0.3 and Mozilla before version 1.7.7," Mikko Hypponen, director of AV research for Finish security firm F-Secure Corp., said in the lab's daily blog. "We advise all Mozilla and Firefox users to immediately patch their browsers. Otherwise you might get nasty stuff happen[ing] on your computer just by surfing to the wrong site." The Bethesda, Md.-based SANS Internet Storm Center Web site also reported that two proof-of-concept examples appeared over the weekend. The site echoed Hypponen's advice, saying, "The little green update button in Firefox is your friend." The link for this article located at SearchSecurity is no longer available. . Vulnerabilities affect Chrome; upgrade to versions 89.0.1 and 90.0.2 to protect yourself from potential threats.. Firefox Exploits,Browser Security Updates,Mozilla Vulnerabilities. . LinuxSecurity.com Team
Apr 19, 2005
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!