Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 2 articles for you...
210
security advisorycriticalremote code executionFFmpeg PixelSmash Vulnerability Exposes Linux Media Servers to Remote Code Execution Risk
A newly disclosed FFmpeg vulnerability, known as PixelSmash ( CVE-2026-8461 ), affects the MagicYUV decoder and can be triggered by specially crafted video files. . Researchers demonstrated remote code execution against Jellyfin under specific conditions and found multiple Linux applications that could be exposed through normal media processing workflows. Even where code execution is not practical, the vulnerability can still be used to crash affected applications. What Is FFmpeg? FFmpeg is one of the most widely deployed multimedia frameworks in the Linux ecosystem. It handles: Video decoding, encoding, and transcoding. Streaming and format conversion. Thumbnail generation and metadata extraction. Most users never interact with it directly. Applications call FFmpeg behind the scenes whenever media needs to be processed. That dependency chain becomes surprisingly large once administrators start looking for it: Media servers such as Jellyfin rely on FFmpeg for library scanning and transcoding. Photo management platforms use it to generate previews. Content management systems use it to inspect uploaded media. Desktop environments invoke it during thumbnail generation. Video production tools, streaming software, and automation workflows include FFmpeg in the processing path. The result is a shared component that exists across servers, workstations, containers, NAS appliances, and self-hosted platforms. A flaw inside FFmpeg often reaches much further than administrators initially expect. What Is PixelSmash? PixelSmash is the name given to CVE-2026-8461 , a heap out-of-bounds write vulnerability located in FFmpeg's MagicYUV decoder. MagicYUV is a lossless video codec designed for high-performance video processing. Researchers at JFrog discovered that specially crafted AVI, MKV, or MOV files can trigger memory corruption while the decoder processes video frame data. The vulnerability received a CVSS score of 8.8 and affects applications that relyon FFmpeg's vulnerable decoder implementation. The issue occurs because memory is allocated using one set of frame calculations while portions of the decoder later write data using different calculations. Under the right conditions, those writes extend beyond the intended heap boundary. Memory corruption follows. How the Vulnerability Works PixelSmash is a heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder. A specially crafted video can cause the decoder to write beyond allocated memory, leading to application crashes or, under specific conditions, arbitrary code execution. How to Check If You're Affected ffmpeg -version ffprobe -version Debian/Ubuntu: dpkg -l | grep ffmpeg RHEL/CentOS/Rocky/Alma: rpm -qa | grep ffmpeg Arch Linux: pacman -Qs ffmpeg Containerized deployments: docker exec ffmpeg -version Why PixelSmash Changes the Linux Threat Model Most malicious file attacks depend on user interaction. Someone downloads a file, opens it, and triggers the exploit. PixelSmash breaks that pattern in common Linux deployments. Media servers such as Jellyfin monitor directories and immediately process new files using ffprobe. Desktop environments like GNOME and KDE generate thumbnails as soon as a directory is opened. Platforms such as Nextcloud and PhotoPrism automatically extract metadata and create previews for uploaded content. None of these workflows requires a user to play the video. The vulnerable decoder runs as part of routine system behavior. That matters because Linux environments often centralize media processing. A single server may ingest files from torrents, shared network mounts, automated download pipelines, or user uploads. Each of those paths feeds directly into background processing jobs that trust FFmpeg to handle untrusted input safely. PixelSmash turns those trusted workflows into an attack surface. A crafted video file does not need to trick a user. It only needs to reach a location where Linuxservices expect media to exist. Media Library Scanning Creates an Attack Surface Self-hosted media servers represent a clear example. Jellyfin continuously scans media libraries for new content. When a new video arrives, FFmpeg utilities such as ffprobe are often invoked automatically to extract metadata and catalog the file. The user does not need to click anything. The service sees a new file, starts processing, and executes the vulnerable code path as part of routine library management. Researchers demonstrated this behavior against Jellyfin by placing a crafted MagicYUV video into a monitored media directory. During the normal scan process, the malformed file triggered the overflow condition. For administrators running large media libraries, NAS appliances, or automated content ingestion pipelines, this is the scenario that deserves attention. Thumbnail Generation May Trigger Processing Automatically Desktop Linux systems introduce another exposure path. GNOME, KDE, and XFCE commonly generate previews and thumbnails when users browse directories. The goal is convenience, but behind that convenience sits media processing logic. A file manager opening a directory may trigger FFmpeg operations without the user ever launching a media player. Administrators investigating workstation exposure should consider thumbnail generation workflows when evaluating affected systems. The vulnerable file may be processed simply because someone browsed a folder. Automated Download Workflows Increase Risk Media automation environments often combine multiple services: Torrent clients download content. Scripts move files into library directories. Media servers scan new arrivals. Metadata services perform indexing. Preview generators create thumbnails. Transcoding services prepare content for playback. Each step expands the opportunities for FFmpeg to encounter untrusted input. JFrog researchers highlighted a scenario involving malicious torrent content entering a Jellyfin libraryautomatically. Once the file appears in a monitored directory, normal media processing begins, and the vulnerable decoder executes without user involvement. Administrators frequently focus on exposed web services, but media pipelines deserve similar scrutiny. Remote Code Execution Against Jellyfin The most significant finding from the research involved successful remote code execution against Jellyfin. Researchers demonstrated a chain in which a crafted MagicYUV AVI file entered a Jellyfin media library and triggered FFmpeg processing during metadata extraction. The overflow corrupted memory structures and ultimately redirected execution flow, allowing arbitrary commands to execute under the Jellyfin service account. That detail matters. The result was not root access, but the process executed with the privileges assigned to the Jellyfin service. Even so, service account access provides a foothold into the broader environment. Stored credentials, network shares, API tokens, configuration files, and weak sudo rules can all become relevant after initial compromise. Attackers rarely stop at the first process they reach. Why ASLR Still Matters The research does not suggest that PixelSmash reliably bypasses modern Linux memory protections on its own. Address Space Layout Randomization (ASLR) remains an important defensive barrier. The demonstrated remote code execution scenario required ASLR to be disabled. Researchers noted that CVE-2026-8461 by itself does not defeat that protection. This distinction is important because vulnerability headlines often compress technical limitations into a single phrase such as "RCE vulnerability." The overflow exists and the memory corruption is real, but exploitation becomes substantially more difficult when modern memory protections remain active and properly configured. Which Linux Applications May Be Affected? Jellyfin received much of the attention because researchers successfully demonstrated code execution against it, but the concern extends further.Applications that rely on FFmpeg and expose the MagicYUV decoder may be affected if they process attacker-controlled media files: Jellyfin Nextcloud configurations that generate video previews PhotoPrism Kodi OBS Studio Desktop thumbnail generation frameworks The exact level of exposure depends on implementation details. Decoder configuration, build options, security hardening, and application behavior all influence risk. Plex provides an interesting contrast: researchers found that Plex uses a more restrictive FFmpeg configuration with decoder limitations that reduce exposure to this specific attack path. Same dependency, different attack surface. What Defenders Should Do The immediate priority is identifying systems that process untrusted video content. Media servers deserve attention first, followed by content management platforms, photo management systems, preview generators, and automated upload workflows. Administrators should: Verify installed FFmpeg versions and apply available patches. Confirm containerized applications are not using outdated bundled FFmpeg builds. Review media libraries that automatically ingest content from torrents, uploads, shared folders, or external sources. Ensure services such as Jellyfin run with minimal privileges and do not have unnecessary access to sensitive files or network shares. Monitor vendor advisories for FFmpeg and dependent applications. PixelSmash is a reminder that some of the most important Linux attack surfaces are not internet-facing services but the background processes that automatically handle untrusted content. A media library scan or thumbnail generation task may seem routine, yet both can expose systems to vulnerabilities hidden deep within widely used dependencies. Want more Linux security news, vulnerability analysis, and software supply chain updates? Subscribe to the LinuxSecurity Newsletter and get the latest threats, advisories, and expert insights delivered directly to your inbox. Related Reading Debian FFmpeg Advisory (CVE-2026-8461/PixelSmash) Linux Server Hardening Guide (SSH & Backup Strategies) Linux Server Practical Hardening Guide . Researchers demonstrated remote code execution against Jellyfin under specific conditions and found . newly, disclosed, ffmpeg, vulnerability, known, pixelsmash, (cve-2026-8461), affects, magicyuv. . MaK Ulac
Jun 23, 2026
•
Security Vulnerabilities
83
linux applicationsenterprise softwarecyber threatAnalyzing DreamBus Botnet Threats Against Linux Enterprise Systems
The recently discovered DreamBus botnet uses exploits and brute-force attacks to target PostgreSQL, Redis, SaltStack, Hadoop, Spark, and others enterprise-level apps that run on Linux systems. "The idea is to give the DreamBus gang a foothold on a Linux server where they could later download and install an open-source app that mines the Monero (XMR) cryptocurrency to generate profits for the attackers." . Chances are that if you deploy a Linux server online these days and you leave even the tiniest weakness exposed, a cybercrime group will ensnare it as part of its botnet. The latest of these threats is named DreamBus. Analyzed in a report published last week by security firm Zscaler, the company said this new threat is a variant of an older botnet named SystemdMiner, first seen in early 2019 . . Should you launch a Linux server in the cloud today and overlook any minor weakness, hackers will take advantage of it.. DreamBus Botnet, Linux Applications, Security Threat, Cryptocurrency Mining, Open Source Security. . LinuxSecurity.com Team
Jan 25, 2021
•
Hacks/Cracks
67
linux applicationsopen source toolskey managementKey Cryptographic Principles Every Linux User Should Know About
Kurt Seifried has written an article on the basics of cryptography, as well as some tips on how to use the various crypto applications for Linux. . . . . Kurt Seifried has written an article on the basics of cryptography, as well as some tips on how to use the various crypto applications for Linux. The link for this article located at SecurityPortal is no longer available. . Kurt Seifried explores cryptography essentials, focusing on key concepts for Linux users, including encryption, hashing, key management, and open-source tools. Cryptography Essentials, Linux Encryption, Open-Source Applications. . LinuxSecurity.com Team
Jan 01, 2020
•
Cryptography
72
linux applicationsnetworkinginstallation guideInstalling RouterOS 2.9 on Compaq Proliant 400: Key Features and Setup
Would you like to have a Linux-based router capable of doing tasks such as stateful firewall inspection, virtual private networking, and traffic shaping, in addition to packet routing? Tired of having to do administration from the command line but want to be able to administer your box from a Windows-based client PC? MikroTik's RouterOS may what you need. You can boot RouterOS via diskette, CD, or over the network via PXE or Etherboot-enabled network interface card. You can find a full list of RouterOS technical specifications at the homepage. . I installed the 13MB ISO CD image RouterOS v2.9.23 on a old Compaq Proliant 400 (450MHz, 128MB RAM, 20GB hard disk). The software's minimum configuration is a 100MHz Pentium, 64MB RAM, and 64MB storage. When I booted the PC, I found a list of available packages for RouterOS, including the packages to use DHCP and PPTP servers, Web proxy, and much more. You can select individual packages, all available packages, or the minimum required packages. To see the full range of what RouterOS was capable of, I selected all. After a last warning about the data on the disk being erased, the software is installed. The link for this article located at Linux.com is no longer available. . I revived an old Compaq Proliant 400 by installing RouterOS v2.9.23, a rewarding journey of setup that deepened my networking knowledge and skills. RouterOS Installation, MikroTik Router Features, Linux Firewall Applications. . Brittany Day
May 23, 2006
•
Firewalls
78
linux applicationscost reductionapplication integrationSolaris 10 Project Janus: Linux App Compatibility Technology
Sun Microsystems has previewed a new feature of the Solaris 10 operating system, code-named Project Janus. This new technology will allow users to run Linux binary applications unchanged on the Solaris OS, reducing the development and administration costs of operating in a heterogeneous environment without sacrificing performance, scalability or manageability. . . .. Sun Microsystems has previewed a new feature of the Solaris 10 operating system, code-named Project Janus. This new technology will allow users to run Linux binary applications unchanged on the Solaris OS, reducing the development and administration costs of operating in a heterogeneous environment without sacrificing performance, scalability or manageability. According to Dumisani Mtoba, senior systems engineer at Sun Microsystems SA, Project Janus will provide businesses that are using mixed Solaris OS and Linux environments with broader access to applications written for both operating systems. The link for this article located at CITIGATE PR is no longer available. . Sun Microsystems has previewed a new feature of the Solaris 10 operating system, code-named Project . microsystems, previewed, feature, solaris, operating, system, code-named, project. . LinuxSecurity.com Team
Sep 17, 2004
•
Vendors/Products
74
security managementunix securitylinux applicationsMaximize Security Efficiency Using Unix/Linux Across Various Roles
It is a rare organization that has the money to deploy best of breed or integrated commercial software for every security role. Whether your job is perimeter protection, incident response or email server administration, there may be an opportunity to use your favorite Unix system with some additional tools to get the job done faster and cheaper than what you do now. . . .. After the reception my last column regarding the security criticism I heaped on Unix and Linux vendors who are pursuing end-user desktops, I thought I would outline some of the areas where I think Linux and Unix already have strong wins. While I am a dedicated Unix and Linux junkie and use it everywhere I can, I may be somewhat biased. However, there are some areas where Unix and Linux systems fit in better than anything else out there. In some cases, these roles can be performed on commercial Unix systems if your organization feels better about paying for commercial-grade software. The upcoming version of Solaris, for example seems to have some new security tricks that are worth a look if you need to run secure enterprise services. CD based OS - security in an insecure world Working in the security industry makes a person slightly paranoid. In my case, my paranoia goes far enough that I don't trust my own mother, or at least I don't trust her computer. The link for this article located at securityfocus is no longer available. . After the reception my last column regarding the security criticism I heaped on Unix and Linux vendo. organization, money, deploy, breed, integrated, commercial, softwa. . Anthony Pell
Jun 04, 2004
•
Network Security
79
linux applicationssecurity flawopen sourceUrgent Call for Community Auditing of Open Source Security Flaws
In the past three months, the open-source community has been given a wake-up call. While Microsoft has concentrated on reviewing its flagship Windows source code as part of a new focus on security, Internet watchdogs have released the details of . . . . In the past three months, the open-source community has been given a wake-up call. While Microsoft has concentrated on reviewing its flagship Windows source code as part of a new focus on security, Internet watchdogs have released the details of three widespread flaws in open-source applications usually shipped with the Linux operating system. The flaws could compromise the security of computers on which the applications are installed, prompting some developers to urge the open-source community to take another look at popular code. But most fear the majority of members won't bother. No one is doing auditing," said Crispin Cowan, chief scientist at Linux maker WireX Communications, one of several companies selling a version of the OS with additional security options. Cowan is the founder of Sardonix, a Web site aimed at organizing groups of people who want to review major open-source software. The link for this article located at cnet is no longer available. . In the past three months, the open-source community has been given a wake-up call. While Microsoft h. three, months, open-source, community, given, wake-up, while, microsoft. . LinuxSecurity.com Team
Mar 21, 2002
•
Security Projects
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!