Stay Ahead With Linux Security News

ESET researchers identified 11 old and forgotten Linux UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 third-party certificate authority, regardless of the installed operating system (OS). Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits even on systems with UEFI Secure Boot enabled.....

Proxies are a standard component of a Linux administrator's toolbox. You can use them to see how services respond in various locations, to run route monitoring checks, and to retrieve public data for internal tooling. However, a proxy is an outbound tunnel with credentials attached, and on a multi-user server, it is a security risk that should be treated with the same caution as SSH or sudo. This post explains the practical measures that prevent a proxy setup from becoming a weak point in an...

Before the week gets away from you, take a look at what's landed across the Linux ecosystem. The volume of security advisories hasn't slowed, and while not every update demands an emergency maintenance window, several deserve to move to the top of your patch queue. This week's updates span the kernel, remote desktop infrastructure, VPNs, containers, browsers, and the utilities Linux systems quietly depend on every day. Individually, these look routine. Together they show how quickly attackers...

When researchers announced GhostLock, many people focused on the exploit. What stood out to me wasn't just what the vulnerability could do, but how long it had remained hidden. The flaw had lived in the Linux kernel for roughly 15 years before it was publicly identified by researchers. That means the flaw survived hundreds of kernel releases and years of upstream development before it was publicly documented. It raises an uncomfortable question about one of open source's oldest assumptions....

Spin up a fresh Linux VPS with default settings and check /var/log/auth.log ninety seconds later. There will already be failed login attempts — not dozens, hundreds, sometimes before the deployment script has even finished running. . Automated bots scan the entire IPv4 address space non-stop, and port 22 with password authentication open is exactly what they're looking for. Most cloud providers have seen enough of this that a new instance gets its first probe within a minute of going live....