Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
212
security advisoryexploit riskdata compromiseExploit Risks of Misconfigured Azure Services in EmojiDeploy Attack Chain
Multiple misconfigurations in a service that underpins many Azure features could have allowed an attacker to remotely compromise a cloud user's system. . An attack chain exploiting misconfigurations and weak security controls in a common Azure service is highlighting how lack of visibility impacts the security of cloud platforms. The "EmojiDeploy" attack chain could allow a threat actor to run arbitrary code with the permission of the Web server, steal or delete sensitive data, and compromise a targeted application, Ermetic stated in its Jan. 19 advisory . An attacker could use a trio of security issues affecting the common Source Code Management (SCM) service — a cloud service used by many Azure applications without an explicit indication to the user, according to Ermetic. The issues demonstrate that the security of cloud platforms are undermined by the lack of visibility into what those platforms do under the hood, says Igal Gofman, head of research for Ermetic. The link for this article located at DarkReading is no longer available. . A vulnerability pathway leveraging insufficient configurations and lax defenses in a widely used Azure platform could present significant threats.. AzureService, CloudSecurity, MisconfigurationRisk, AttackChain. . Brittany Day
Jan 26, 2023
•
Cloud Security
83
security issuecyber threatexploit riskWebcam Security Risks: Minor Bugs Create Major Cyber Threats
More insecure webcams! Inattention to IoT security! Who would have thought?. Unfortunately, cybersecurity still seems to sit way down in Nth place for many vendors when they start programming their latest and greatest Internet of Things (IoT) devices. In this case, the bugs are in a family of webcams – and not just any old webcams, but security webcams. The link for this article located at Naked Security/Sophos is no longer available. . The security of IoT gadgets frequently gets neglected, resulting in substantial risks stemming from trivial flaws in smart speakers and beyond.. IoT Devices, Webcam Security, Cyber Threats, Exploit Risks. . LinuxSecurity.com Team
Jun 13, 2018
•
Hacks/Cracks
83
security advisorycode executionheap overflowInternet Explorer Heap Overflow Advisory: Serious Code Execution Threat
US-CERT on Wednesday warned of a fresh hole in Internet Explorer that could allow attackers to take control of a PC via an HTML e-mail message or a malicious Web page. The flaw is all the more serious because exploit code has been published on public mailing lists, according to security researchers. . . .. US-CERT on Wednesday warned of a fresh hole in Internet Explorer that could allow attackers to take control of a PC via an HTML e-mail message or a malicious Web page. The flaw is all the more serious because exploit code has been published on public mailing lists, according to security researchers. The flaw, a heap buffer overflow, is in the way IE handles two attributes of the "frame" and "iframe" HTML elements. An exploit currently circulating uses overly long SRC and NAME attributes to cause IE to execute an attacker's shell code, according to US-CERT. Users could be attacked via a malicious Web page viewed in an affected version of IE or possibly through an HTML e-mail viewed in an application such as Outlook, Outlook Express, AOL or Lotus Notes that relies on the WebBrowser ActiveX control, according to researchers. The bug has been confirmed in IE 6.0 on Windows XP with SP1 and all patches installed, as well as the same browser on a fully patched Windows 2000, according to an advisory from security firm Secunia. Microsoft Corp. has not yet released a patch. The link for this article located at eweek.com is no longer available. . US-CERT on Wednesday warned of a fresh hole in Internet Explorer that could allow attackers to take . us-cert, wednesday, warned, fresh, internet, explorer, allow, attackers. . LinuxSecurity.com Team
Nov 05, 2004
•
Hacks/Cracks
77
security advisorydesktop softwaresecurity flawsRealNetworks: Media Players Security Flaws Affecting Exploit Risk
EEye Digital Security has uncovered new security holes affecting a wide range of RealNetworks' media players, the latest desktop-based bugs set to worry IT managers. The flaws could be exploited via a malicious webpage or a RealMedia file run from a local drive to take over a user's system or delete files, according to RealNetworks. . . .. EEye Digital Security has uncovered new security holes affecting a wide range of RealNetworks' media players, the latest desktop-based bugs set to worry IT managers. The flaws could be exploited via a malicious webpage or a RealMedia file run from a local drive to take over a user's system or delete files, according to RealNetworks. Researchers have turned up a myriad of serious security flaws in client software over the past few weeks, and such bugs can be difficult to patch because of the sheer number of desktops in use. Recently vulnerabilities have been revealed in WinAmp, WinZip, and Apple Computer's iChat messaging program. The link for this article located at Matthew Broersma is no longer available. The link for this article located at Matthew Broersma is no longer available. The link for this article located at Matthew Broersma is no longer available. The link for this article located at Matthew Broersma is no longer available. . EEye Digital Security has uncovered new security holes affecting a wide range of RealNetworks' media. security, digital, uncovered, holes, affecting, range, realnetworks', media. . LinuxSecurity.com Team
Oct 04, 2004
•
Server Security
78
security advisoryMicrosoftexploit riskMicrosoft: Internet Explorer 5 Exploit Risk From Source Code Leak
We have not covered much about the Microsoft source code leak that has been inundating the computer security news-sites recently, mostly because its not very relevant to open-source security. However, an exploit has been found due to the leak already. This brings up one of the major bonuses of open-source code: it does not at all depend on obscurity. Defense-by-obscurity leads to sloppy coding habits and opens the door to massive security vulnerabilities should the code be leaked, especially if its no longer supported, but still widely used, like Windows 9x. Bear in mind that, according to the Microsoft EULA, no one else is technically allowed to patch the code, and Microsoft likely won't . They might even claim that the ruling against them on the Java VM issue with Sun means that they cannot, since that was the reason given for dropping support for legacy products in the first place. . . .. A security company on Monday alerted clients of a new vulnerability to Internet Explorer 5, one attributed to the recent leak of Microsoft Corp. Windows source code. Microsoft confirmed the problem late in the day. A security company on Monday alerted clients of a new vulnerability to Internet Explorer 5, one attributed to the recent leak of Microsoft Corp. Windows source code. The quick attack appears to contradict some optimistic expectations that the recent leak of Windows 2000 and NT code would not pose a significant opportunity for hackers. In a statement released late on Monday, the company said it was investigating the reported exploit, but added that "This exploit is a known issue that Microsoft had discovered internally and addressed with the latest release of Internet Explorer--Internet Explorer 6.0 Service Pack 1." According to a message posted by SecurityGlobal.net LLC's Security Tracker Web site, a vulnerability was reported in Microsoft Internet Explorer Version 5 that lets a "remote user execute arbitrary code on the target system." A hacked bitmap file can trigger an integer overflow and executearbitrary code, the security bulletin said. The author of the warning said that this flaw was uncovered by reviewing the recently leaked Windows source code. The link for this article located at eweek.com is no longer available. . An issue found in Explorer 5 discloses risks stemming from exposed Microsoft code, underscoring lingering security gaps.. Internet Explorer Exploit, Microsoft Source Code Leak, Legacy Software Security. . LinuxSecurity.com Team
Feb 17, 2004
•
Vendors/Products
83
security advisorysendmailexploit riskSendmail And Snort Exploit Risks Reported: IT Threats Identified
Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system IT departments suffered two serious vulnerabilities in enterprise-grade open source software systems last week. Top of the list was a newly reported vulnerability in Sendmail, which is a widely used mail transport agent (MTA). The second vulnerability was found in Snort, a popular open-source intrusion detection system (IDS). . . .. Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system IT departments suffered two serious vulnerabilities in enterprise-grade open source software systems last week. Top of the list was a newly reported vulnerability in Sendmail, which is a widely used mail transport agent (MTA). The second vulnerability was found in Snort, a popular open-source intrusion detection system (IDS). Last week showed how quickly news of vulnerabilities can be exploited to produce software that wreaks havoc on the Net. Within 24 hours of the problems being made public, an easy-to-use exploit program for the Sendmail vulnerability was posted on the Bugtraq mailing list. According to Bugtraq, default installations of Sendmail and Red Hat Linux are not vulnerable to this particular exploit, but firms that have compiled Sendmail for use with Red Hat 7.1, 72 or 7.3 are vulnerable. The link for this article located at vnunet is no longer available. . Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system. vulnerabilities, uncovered, sendmail, snort, source, intrusion, detection, system. . LinuxSecurity.com Team
Mar 11, 2003
•
Hacks/Cracks
77
web securitycertificate authorityexploit riskExploring Site Seal Misleading Facts And Real-World Security Threats
Secure site seals handed out to sites by certificate authorities and lock icons shown by browsers can often mislead consumers into believing that a site is more secure than it actually is, according to the latest Netcraft Web Server Survey.. . .. Secure site seals handed out to sites by certificate authorities and lock icons shown by browsers can often mislead consumers into believing that a site is more secure than it actually is, according to the latest Netcraft Web Server Survey. The survey said a recent dialogue between the two leading certificate authorities - Verisign and Geotrust has highlighted the fact that though the site seal and browser lock may look reassuring, there was no assurance at all that the site is not vulnerable to some well known exploit, and typically many are. It said the discovery of remote vulnerabilities in Microsoft Commerce Server and Microsoft-IIS published last month, had left many commerce and financial sites open to attack, and there was often no clear cut way in which a site's prospective customers can legally determine whether their transactions and data were likely to be safe or not. Due to these factors, Netcraft said it was likely that payment mechanisms on the Internet would increasingly become centralised. The survey also showed that IIS has made a gain of three percent in number of sites hosted on the Net due to the fact that register.com putting a Windows-based front end back in place on their domain parking system. It said register.com had alternated recently between a Windows and Linux front end, and this caused a fluctuation when it changed. All of article. . Secure site seals handed out to sites by certificate authorities and lock icons shown by browsers ca. secure, seals, handed, sites, certificate, authorities, icons, shown, browsers. . LinuxSecurity.com Team
Jul 29, 2002
•
Server Security
77
security advisoryapacheexploit riskApache Web Server: Insufficient Patch Update with Exploit Threat
Update: For millions of websites that were vulnerable care of ISS, Apache is not too happy. ISS (Internet Security Systems) released an insufficient patch along with their advisory to the Apache Web . . . . Update: For millions of websites that were vulnerable care of ISS, Apache is not too happy. ISS (Internet Security Systems) released an insufficient patch along with their advisory to the Apache Web Server. ISS believe that because Apache is open source, that the vulnerability need not be reported to the maintainers, only to the public. Apache's official advisory states specifically that the ISS patch does not correct this vulnerability. The CERT advisory gives a description of which platforms this vulnerability affects. ISS insists that this vulnerability is unexploitable. Apache.org's Mark Cox insists that if ISS had contacted Apache prior to making this vulnerability public, they would been able to gain a better understanding of the problem and realize that their fix was insufficient. The bug, which deals with invalid requests encoded using chunked encoding, can cause a child process to terminate and then restart. This uses a trivial amount of resources. A Slashdot.org posting asserts that ISS is using this Apache vulnerability as a press release. ISS's rebuttal is available here. There is no doubt that this assertion can be substantiated, but The Register believes that there may be something more to it than that. Has ISS ever tried something of this nature with Microsoft? The fix is now available httpd . Here is the message from Bugtraq telling you how to test if you need the patch or not. Threat becomes vulnerability: Now that the patch has been released and apache has been updated for all OS's affected, the exploits have been released. Ensure your version has been patched and give the exploits a try. The exploits are available here and here. Media References: Washington Post Problem is, they didn't tell the maker of the software. Then they issued the wrongprescription for fixing the problem... The Register On Monday, Internet Security Systems (ISS) posted their discovery to the BugTraq mailing list, without knowing the full extent of the flaw, and without giving Apache.org time to investigate and develop a patch or even propose a workaround. To sugar the pill... News.com The warning's release reopened a long-simmering debate over how much time a security researcher should give a software maker to verify and fix vulnerabilities that could affect large numbers of computer users... ZD Net Tech News The warning's release reopened a long-simmering debate over how much time a security researcher should give a software maker to verify and fix vulnerabilities that could affect large numbers of computer users... InfoWorld More than 63 percent of all Web sites run on an Apache Web server, according to Netcraft Ltd. of Bath, England, which compiles such information. The flaw is similar to... Version Specific References: Debian: /advisories/debian EnGarde: /advisories IBM AIX: https://www.ibm.com/solutions/servers Red Hat: /advisories/red-hat SuSe: /advisories/suse Slackware: /advisories/slackware Trustix: /advisories Conectiva: /advisories . Update: For millions of websites that were vulnerable care of ISS, Apache is not too happy. ISS (Int. update, millions, websites, vulnerable, apache, happy. . LinuxSecurity.com Team
Jun 21, 2002
•
Server Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!