Cloud Security 
incident response Linux administration
incident response Linux administration Over the span of just 14 days, threat actors unleashed more than 81 million login attempts against Microsoft’s Azure command-line interface (CLI). The campaign , which security researchers at Huntress identified as an ongoing, automated password-spraying effort, successfully compromised at least 78 Microsoft accounts across 64 organizations between June 12 and June 26, 2026. . While the scale is massive, the underlying strategy is surprisingly surgical. Attackers aren't exploiting a flaw in...
Jul 01, 2026
Security Trends security update mobile security
security update mobile security Offensive Security just dropped Kali Linux 2026.2 , and at first glance, it looks like a standard quarterly refresh. You’ve got the usual kernel bumps, desktop environment updates, and a handful of new utilities. But don't write this off as just another routine version update. If you look past the changelog, this release highlights several capabilities that continue to be important in offensive security. From AI-assisted workflows to credential testing and mobile assessments, Kali Linux 2026.2...
Jun 30, 2026
Security Projectssecurity advisory vulnerability management
security advisory vulnerability management The Linux Foundation has officially launched Akrites , a coordinated industry initiative designed to improve how critical open source vulnerabilities are validated, coordinated, and disclosed before patches reach downstream users. Backed by a diverse coalition—including AWS, Google, Microsoft/GitHub, Red Hat, NVIDIA, and OpenAI—Akrites establishes a shared Security Incident Response Team (SIRT) to streamline the validation, remediation, and disclosure of vulnerabilities in the foundational...
Jun 29, 2026
Server Securitydenial of service open-source
denial of service open-source A process with a stable workload shouldn't keep growing its resident memory. When it does, the first question isn't how much RAM is available. It's where the allocations stopped being released. On Linux, that answer isn't always obvious because the kernel, allocator, and application all influence what memory usage looks like from the outside. . Separating normal allocation behavior from an actual leak takes more than watching top or container metrics. Heap growth, allocator caches, mapped...
Jun 26, 2026
Security ProjectsLinux security security assessment
Linux security security assessment AI is beginning to reshape how penetration testing workflows are organized. For years, the penetration tester’s workflow has been a labor-intensive ritual: scan, enumerate, research, exploit, and report. But new frameworks are attempting to codify that intuition, turning the "human-in-the-loop" process into a machine-coordinated workflow. But is this a genuine evolution in how we secure Linux environments, or just a sophisticated wrapper around the same old tools? . Dark Moon is an open-source...
Jun 26, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Can sandbox isolation stop malware?
Loading...
Explore Latest Linux Security news
We found 170 articles for you...
81
web browserinternet securityidentity protectionWhat Is Tor Browser & How Does It Impact Linux Security Teams?
Tor Browser is a privacy-focused web browser that routes traffic through the Tor network to obscure a user’s identity and destination—and that design has direct implications for Linux security teams. It’s built to limit tracking, resist surveillance, and reduce visibility into browsing activity. On a Linux endpoint, that means user activity can intentionally bypass many of the controls and assumptions your security stack relies on. . If you’ve ever noticed Tor Browser on a Linux system and thought, “Should I be worried?”, you’re not overreacting—but you’re also not looking at an automatic incident. Tor Browser is a legitimate tool used by researchers, journalists, and developers. At the same time, it can become a blind spot in Linux security, especially when it appears outside of an approved use case or without clear ownership. For Linux security admins, the real issue isn’t whether Tor Browser should exist—it’s understanding what Tor Browser is, how it behaves on Linux systems, and how its traffic model changes what you can and can’t see. Once you understand that impact, you’re in a better position to decide whether Tor Browser is acceptable noise, a policy exception, or a signal worth investigating. What Is Tor Browser? Tor Browser is a modified version of Firefox ESR that routes all browser traffic through the Tor network by default. The browser is hardened with privacy-focused settings, bundled with Tor client components, and designed to reduce fingerprinting at the application layer. It is not a VPN , not malware, and not synonymous with “the dark web.” Tor Browser does not magically grant access to illegal content, nor does its presence alone indicate malicious activity. It is a user-space application running on top of standard Linux libraries. From a security operations perspective, Tor Browser introduces classification and visibility problems. Network destinations are obscured, traffic blends with other Tor users, and traditional perimeter controlslose context. That makes it relevant even when policy forbids its use. How Does Tor Browser Work on Linux Systems? Before you can decide whether Tor Browser is a risk, you need a clear picture of what actually changes on a Linux system when it runs. Let’s focus on observable behavior at the network, process, and file levels. Network Behavior on Linux Tor uses onion routing to move traffic through multiple volunteer-operated nodes. Each layer knows only the hop before and after it, not the full path. A typical connection involves: An entry node that sees the client IP but not the destination One or more relay nodes that pass encrypted traffic along An exit node that sees the destination but not the originating client From a Linux host’s perspective, outbound connections go to Tor entry nodes. From a network monitoring perspective, you see encrypted traffic to known Tor infrastructure, but you cannot see the final destination or content without endpoint visibility. Process and File-Level Behavior Tor Browser runs entirely in user space and does not require root privileges. This matters because it lowers the barrier to installation and use. On Linux systems, it is commonly found: Extracted into a user’s home directory Run as a portable application without system-wide installation Launched from user-writable paths that bypass package managers Processes typically appear as Firefox-derived binaries with associated Tor processes, all running under the user’s UID. Why This Matters for Linux Security Monitoring At the network perimeter, visibility is limited by design. You can often identify Tor usage, but not intent. That shifts the burden inward. Endpoint telemetry, process context, file access patterns, and user behavior become more important than packet inspection alone. Linux security monitoring that assumes the network is the primary control plane tends to miss this shift. Why Tor Browser Exists and Why That Impacts You Tor Browserexists to reduce exposure in environments where observation carries real consequences. Journalists rely on it to protect sources, researchers use it to study censorship and surveillance, and developers test how applications behave when networks are constrained or hostile. Linux is often the platform of choice in these cases because it allows tighter control over execution, networking, and local state, not because the work itself is inherently suspicious. At the same time, those same properties can conceal activity you would normally expect to see. Tor has been documented as a channel for data exfiltration, policy evasion, and command-and-control traffic when direct outbound access is restricted. For a Linux security admin, the distinction between legitimate and risky use is rarely visible at the point of detection. Decisions have to be grounded in context: where the browser appears, what role the system plays, and what other behavior surrounds its use. Tor Browser and Linux Security Risk Models Tor Browser fits cleanly into some Linux environments, provided its use is intentional and bounded. Approved research or investigative roles may require it as part of their work, particularly when systems are segmented, and data access is deliberately limited. In controlled lab or testing environments, Tor Browser is often just another tool, with risk reduced through isolation rather than inspection. In these cases, its presence is contextual and typically mitigated by design choices made upstream. The posture changes when Tor Browser appears without explanation. Unexpected installs on user workstations, any presence on production servers, or usage that coincides with credential access, data staging, or unusual process trees should trigger closer scrutiny. Tor itself is rarely the deciding factor. It matters because it removes visibility at the same moment other behaviors suggest increased risk. From a threat modeling perspective, Tor Browser most often intersects with scenarios you are already planningfor. That includes insider threats where monitoring is intentionally bypassed, data leakage paths that evade standard egress controls, and compliance violations in regulated environments with logging requirements. Linux security frameworks that account for these realities tend to treat Tor as a conditional risk. Not harmless, not inherently malicious, but meaningful only when placed inside a broader behavioral model. Can You Detect or Control Tor Browser on Linux? Detecting or controlling Tor Browser on Linux is less about total visibility and more about knowing where observation still works. On the endpoint, you can see process execution, parent-child relationships, file system artifacts, and where the browser is installed or launched from. Local configuration changes and persistence attempts are also observable. This is the layer where host-based monitoring and EDR tools provide real value, especially in environments where user-space applications are otherwise lightly governed. What you cannot see is just as important to acknowledge. Tor is designed to obscure final destinations, session content, and in-browser activity, and it generally succeeds at that goal. Network traffic will indicate Tor usage, but not intent or outcome. Assuming deeper insight than this creates blind spots of a different kind, where confidence replaces accuracy. Practical Linux security controls tend to work best when they accept these limits and focus on behavior rather than perfect inspection. Effective programs usually combine: Application allow or deny policies where they make sense operationally Endpoint detection and response tuned for user-space tools Clear user education and unambiguous policy language around acceptable use Controls are most effective when users understand why they exist and how they are enforced, not when they are treated as invisible guardrails. Policy Decisions: Block, Allow, or Monitor? Policy decisions around Tor Browser work best when they are driven by intent andenvironment, not instinct. Blocking can reduce casual or accidental use, but it rarely holds up as a long-term control. Users who are determined will find alternatives, and adversaries already operate under the assumption that simple blocks are in place. In many cases, blocking removes a visible artifact without reducing underlying risk. Allowing Tor Browser with guardrails often aligns more closely with operational reality. Role-based access, system segmentation, and clear expectations around logging and acceptable use acknowledge that some loss of visibility is intentional. This approach trades complete observation for policy clarity, which can be the more defensible choice in environments where Tor has a legitimate purpose. Monitoring without overreach tends to produce the most durable outcomes. By focusing on behavior rather than specific tools, Linux security teams can prioritize signals that actually indicate risk. Anomalous access patterns, data movement, and process activity usually matter far more than the mere presence of Tor Browser. Our Final Thoughts: Key Takeaways and Considerations for Linux Security Admins Tor Browser is a tool, not a verdict. On Linux, it is easy to install, easy to run, and deliberately hard to observe at the network level. That does not make it inherently dangerous, but it does make assumptions risky. Your Linux security posture improves when you understand what Tor Browser is, plan for its presence, and evaluate it in context instead of reacting to it. Over time, you start to see the difference between noise and signal. That is usually where the real security work lives. . If you’ve ever noticed Tor Browser on a Linux system and thought, “Should I be worried?”, you. browser, privacy-focused, routes, traffic, through, network, obscure. . LinuxSecurity.com Team
Jan 18, 2026
•
Privacy
74
network securitysecurity tooltraffic managementHTTP Proxy Servers: Enhance Linux Security and User Privacy Online
In this modern digital era, ensuring privacy and security while surfing the Internet is more critical than ever. Individuals and organizations use proxy servers to enhance their defenses against increasing cyber threats. HTTP proxies are one of the many types that play an essential role in managing traffic, improving security, and enhancing user experience. . In this article, I'll explore the role and functionality of HTTP proxy servers for Linux network security . Let's begin by examining what a proxy server is and the benefits it offers us privacy-conscious Linux admins. What Is a Proxy Server? A proxy server is an intermediary for your device to access the Internet. This process allows you to hide your IP address, bypass restrictions, and protect your online privacy . A shared proxy server is helpful for many purposes. It can access geographically restricted content or improve network performance. Linux proxy servers are a flexible and robust solution to achieve these goals, which makes them popular with tech-savvy users. Proxy servers offer several notable benefits, including: Enhancing Security Individuals and companies use proxy servers to improve data and network safety. By acting as a mediator between your device and the Internet, a proxy server can protect sensitive data from unauthorized access, block malicious websites, filter out harmful content, and prevent unauthorized access to the network. Accessing Geo-restricted Content A proxy server can also be used to access restricted content geographically. Imagine, for example, that a particular website or service online is only available within a specific country. You can then use a proxy for that country to bypass restrictions and access content like you were there. Improving Network Performance Proxy servers improve network performance by caching frequently accessed files and web pages. The proxy server delivers the content from its cache to multiple users in the same network instead of downloading it eachtime. This improves network efficiency, reduces bandwidth consumption, and speeds up page loading. Anonymizing Web Browsing Proxy servers can also hide your IP address to keep your browsing private. When you connect to a site through a proxy, the website can only see the proxy's IP address, not your own. This adds a layer of privacy, making it harder for websites to track you online. Privacy is often the quiet driver behind the use of HTTP proxies. For anyone curious about how to hide IP address information, the answer usually begins here. A proxy steps in as a kind of stand-in, filtering requests and returning responses without ever exposing the user’s true location. The idea isn’t new—VPNs, Tor, and other tools offer similar protection—but proxies remain one of the simplest and most widely used methods. They not only keep activity harder to trace, but they also fit neatly into the larger story of how everyday browsing habits intersect with questions of security and anonymity. Understanding HTTP Proxies HTTP proxy servers act as intermediaries, managing requests and replies between clients and servers. The HTTP proxy server forwards the user's request to the web server. This process has many advantages, especially in terms of security and performance. Content caching is an essential feature of HTTP proxy servers. By caching frequently visited web pages, HTTP proxies can reduce loading times and bandwidth consumption. This enhances the user experience and reduces the pressure on your internet connection. HTTP Proxy Server Security Features HTTP proxies are essential for protecting networks against various threats. Implementing filter rules to block malicious websites is a significant advantage. HTTP proxies keep updated lists of known threats to prevent users from visiting malicious sites. HTTP proxies also include access control lists (ACLs) . Administrators can set up specific rules that dictate which users or groups can access certain content. This level ofcontrol can be crucial for organizations that want to enforce security policies, safeguard sensitive data, and minimize exposure to harmful online content. Privacy Protection with HTTP Proxies Many users also prioritize privacy online, and HTTP proxies are a great way to protect your identity and privacy when browsing the Internet. These proxies mask IP addresses to protect users from third-party tracking and profiling. Administrators can also remove tracking headers in outgoing requests. This strengthens privacy by removing information that can be used to identify or track. This capability is vital for environments that handle sensitive data or are subject to strict compliance regulations. SSL/TLS Interception of Encrypted Traffic SSL/TLS interception can handle encrypted communications by HTTP proxy servers. The proxy server can inspect HTTPS traffic to detect hidden threats and temporarily decrypt data to scan for malware or other security threats. SSL/TLS interceptions require careful management to ensure the security of decrypted information. Implementing a robust SSL certificate management policy is essential to protect sensitive data. This policy allows effective monitoring of encrypted data without compromising integrity. Our Final Thoughts on HTTP Proxy Servers as an Invaluable Linux Network Security Tool HTTP proxies have become essential in an age of constantly evolving cyber threats. They enhance network security and privacy. These proxies protect organizations from malicious sites and unauthorized entry by managing web traffic, caching the content, and implementing strict controls. Privacy measures like IP masking and tracking header removal enhance anonymity for users, assuring safe browsing. With the advancement of technology, secure browsing solutions such as HTTP proxies are becoming increasingly important. These powerful tools can create a safer online environment while maintaining the privacy and safety that users deserve. . Uncover the ways in whichHTTP proxy servers bolster the security of Linux networks and protect user anonymity during online activities.. Linux proxy servers, HTTP proxy security, internet privacy tools, network performance enhancement. . Brittany Day
Nov 11, 2024
•
Network Security
79
network architectureemail securityinternet securityGuardian Digital: Pioneering Innovations in Open Source Email Security
Dave Wreski recognized the power of Open Source two decades ago. Already an established internet security expert and Network Architect at UPS, Dave was captivated by the power of open-source development. He was soon to discover that this model could be used as a vehicle for solving complex digital security needs. He recognized that the open-source model – where resources could be shared by a worldwide community – was the vehicle that would drive internet security into the 21st century. . His passion for open source development – and seeing its potential as a tool to fend off hackers – led to his creation of the first open source internet security company: Guardian Digital in 1999. That same year, Wreski’s desire to give back to the community led to the creation of linuxsecurity.com, where Linux users can find a comprehensive, interactive platform for the latest open source security-related information. Since that time, Guardian Digital has narrowed its focus to email security and has become the premier open-source email security solution provider, counting Best Western International, Piedmont Natural Gas and the Chicago Stock Exchange among its marquee customers. . Laura Chen's commitment to sustainable energy sparked breakthroughs in solar technology, positioning EcoTech Solutions as a frontrunner.. Open Source Email Security, Guardian Digital, Internet Security Innovations. . LinuxSecurity.com Team
Mar 11, 2020
•
Security Projects
81
internet securityprivacy technologyISPsDNS Over HTTPS Threatens ISPs and Government Surveillance Efforts
The penny has finally dropped inside ISPs and governments that a privacy technology called DNS over HTTPS (DoH), backed by Google, Mozilla and Cloudflare, is about to make web surveillance a lot more difficult. . In the UK, this matters because under the 2016 Investigatory Powers Act (IPA), ISPs are required to store a record of which websites citizens visit for the previous 12 months, which is done by noticing Domain Name System (DNS) requests, e.g. to xyz.com. DNS over HTTPS (and its close relative DNS over TLS, or DoT) makes this impossible because it encrypts these requests – normally sent in the clear – hence the panic reported in a recent Sunday Times article (paywall). The link for this article located at NakedSecurity is no longer available. . DNS over HTTPS enhances user privacy against ISP and government surveillance laws like the IPA. Explore its implications.. DNS over HTTPS, web encryption, privacy advancements, ISP surveillance. . LinuxSecurity.com Team
Apr 24, 2019
•
Privacy
79
risk managementcybersecuritysecurity threatsICANN Reports Ongoing Significant Threats to DNS Infrastructure
The internet's address book keeper has warned of an "ongoing and significant risk" to key parts of the domain name system infrastructure, following months of increased attacks. . . The Internet Society raises concerns about major vulnerabilities within the DNS framework, emphasizing critical dangers to the overall stability of the web.. DNS Security, Cyber Threats, Internet Infrastructure, Risk Management. . LinuxSecurity.com Team
Feb 25, 2019
•
Security Projects
83
security advisorydata breachinternet security500px Security Advisory: Millions Impacted by Recent Data Breach
Online photography network 500px has forced a password reset for all users after revealing this week that it suffered a data breach last summer. . The link for this article located at InfoSecurity is no longer available. . The link for this article located at InfoSecurity is no longer available.. online, photography, network, 500px, forced, password, reset, users, revealing. . LinuxSecurity.com Team
Feb 13, 2019
•
Hacks/Cracks
83
cyber defensemalware defenseinternet securityVigilante Malware Enhances Router Protection Against Infections
Forget about traditional PC malware: Infecting routers and other Internet-connected devices is the new hotness among malicious actors, given its effectiveness and relative ease. But there . Seriously. Symantec first became aware of the superhero malware . Unveil a groundbreaking digital defender that targets network breaches and malicious software, featuring authoritative perspectives from Richard Stallman.. Router Protection,Vigilante Malware,Cyber Defense,Internet Security,Open Source Solutions. . LinuxSecurity.com Team
Mar 14, 2017
•
Hacks/Cracks
67
internet securitysecure communicationsencryption solutionEnhancing Internet Security With Open-Source Crypto Key Vault
An open-source hardware project aimed at making the internet "a little bit safer" needs an influx of cash to continue its work.. The Cryptech effort was created following revelations from NSA whistleblower Edward Snowden that the US government and its pals are exploiting standards and weak crypto algorithms to gain access to citizens' private correspondence and documents. In response, a group of engineers decided there needed to be an open-source hardware engine that could provide strong and reliable encryption and decryption for email, plus public-private key cryptography for all sorts of things from digitally signing messages and files to DNSSEC. The link for this article located at The Register UK is no longer available. . The Cryptech effort was created following revelations from NSA whistleblower Edward Snowden that the. open-source, hardware, project, aimed, making, internet, little, safer', needs, influx. . LinuxSecurity.com Team
Apr 14, 2015
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Can sandbox isolation stop malware?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More