Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges
Security Vulnerabilities 
security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Security Trends cybersecurity Linux documentation
cybersecurity Linux documentation Linux operating systems have gained prominence due to their stability, adaptability, and excellent security options. In the case of developing documentation, designing cybersecurity dashboards, or educational material, visuals are of vital importance when it comes to making things clear. The use of icons allows one to understand the message regarding alerts, authorization, encryption, authentication, or the state of the system just by looking at the visual cue without having to read long...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 2 articles for you...
74
open-sourcepythonlinuxHow Supply Chain Attacks Continue to Threaten Open-Source Software
Researchers recently identified another wave of malicious packages on PyPI linked to the broader Mini Shai-Hulud campaign, a worm-like supply chain attack that spread through trusted software packages. On the surface, the packages looked no different from thousands of others published to the repository each week. . Instead of trying to break into a target network directly, the attackers hid malicious code inside software that developers were already using. A few downloads are all it takes. Once a package enters a development workflow, it can end up in places far beyond the original system. That's what makes supply chain attacks difficult to ignore. A compromised package can end up in dozens of environments without the attacker ever interacting with the victim directly . The repository handles distribution. Dependency chains handle the rest. By the time someone figures out a package has been tampered with, the code may already be sitting in build systems, test environments, containers, or production workloads. What Happened? Researchers recently uncovered a new wave of malicious packages on PyPI linked to the broader Mini Shai-Hulud campaign. According to Socket's investigation , the attackers weren't relying on phishing emails or fake downloads. They were using software developers already trusted. A malicious Python package may initially compromise a developer workstation, but the impact rarely stops there. If the package becomes part of an automated build process, it can be incorporated into Linux containers, deployed through Kubernetes, or distributed across production servers without anyone noticing. The Approach : Instead of convincing users to download suspicious files, attackers insert malicious code into software people already trust. The repository remains legitimate, the package name remains familiar, and installation happens through normal workflows. The Targets : Research into the related Miasma and Mini Shai-Hulud activity found attackers targeting packagesused by developers, researchers, and technical users. Several affected projects were tied to scientific computing and development workflows, granting access to environments where source code, credentials, and deployment infrastructure are often concentrated. Trusted repositories have become a preferred target because they offer attackers a scale that traditional intrusion methods rarely achieve. Why Are Supply Chain Attacks So Effective? Supply chain attacks succeed because they abuse the trust already existing inside development environments. Developers trust official repositories, and organizations trust approved package managers. Build systems routinely download and install dependencies without requiring anyone to inspect every line of code. That trust creates an opportunity. Modern software development relies heavily on automation. Modern development pipelines are built around automation. Packages get pulled automatically, builds run automatically, and updates move through environments faster than most teams can review them. That works well until something malicious gets mixed in. A compromised package does not need a special path into the environment. It follows the same route as every legitimate dependency. Most organizations could not tell you everything sitting inside their dependency tree. There is simply too much of it. One package depends on another, which depends on five more, and somewhere down that chain, a bad update can end up in places nobody expected. Nobody installs malware on purpose. They install software they believe is safe. Why Linux Users Should Pay Attention Although the recent campaign involved Python packages on PyPI, the risk extends well beyond Python development. Many Linux environments depend heavily on open-source software. Developers install packages from trusted repositories every day. Build systems pull dependencies automatically. Containers often include software from dozens of different projects maintained by people spread across theworld. That creates a lot of trust points. A compromised dependency can end up in build systems, containers, development environments, and production workloads long before anyone realizes something is wrong. That is part of what makes supply chain attacks so effective. The attacker never has to touch the target directly. The repository handles distribution. The dependency chain handles the rest. A Systemic Trend: Beyond a Single Incident The malicious PyPI packages linked to Mini Shai-Hulud are only the latest example of a much larger problem. Over the past several years, attackers have repeatedly targeted the software supply chain instead of attacking organizations directly. The compromise of Codecov's software distribution process exposed customer credentials. The 3CX incident showed how a trusted software update could be turned into a delivery mechanism for malware. More recently, the attempted backdoor in the widely used XZ Utils project demonstrated how deeply attackers are willing to embed themselves in open-source ecosystems before making a move. The techniques vary, but the objective rarely changes. Sometimes the target is a package repository. Sometimes it is a developer account, a source code repository, or a CI/CD environment. In every case, the goal is the same: gain access to software before it reaches users. That shift matters. Attackers are spending less time looking for individual victims and more time looking for distribution points. Compromise something trusted, and the reach comes with it. The Mechanics of Modern Supply Chain Attacks Most supply chain attacks begin with access. Attackers obtain developer credentials, compromise maintainer accounts, abuse publishing infrastructure, or gain a foothold inside environments responsible for software distribution. Once inside, the process is streamlined: Insertion : Malicious code is injected into legitimate package updates. Trusted Workflow : Attackers use existing development processes to movemalicious code toward end users. Automated Distribution : A compromised package is pulled into development environments, incorporated into automated builds, packaged into containers, and eventually pushed into production. Each step appears routine because the software originates from a source users already trust. The speed is what makes these incidents difficult to contain; by the time malicious activity is detected, affected packages may already exist across multiple environments and organizations. Key Takeaways for Linux Administrators and Developers The lessons from these incidents are not limited to Python developers. Anyone responsible for Linux systems, cloud workloads, or software delivery pipelines should view package repositories as part of their attack surface: Perform Regular Reviews : Dependency reviews should be routine. Unused packages should be removed rather than left sitting inside production environments. Secure Developer Accounts : Developer accounts deserve the same protection as administrative accounts. Multi-factor authentication (MFA) should be enabled, especially for maintainers responsible for publishing software. Increase Visibility : Organizations should monitor package publishing activity and software entering their environments. Software composition analysis (SCA) tools can help identify risky dependencies before deployment. Monitor for Anomalies : Tracking package updates can provide early warning when trusted projects suddenly introduce unexpected behavior. The larger lesson is simple: Trust should not be automatic simply because software comes from an official repository. Conclusion The malicious PyPI packages linked to Mini Shai-Hulud will eventually disappear. The bigger issue will not. Open-source software is woven into modern infrastructure. Most teams could not realistically operate without it. That is why these incidents matter. The code arrives through a source everyone trusts, gets pulled into a workflow that looksnormal, and often spreads before anyone has a reason to question it. But incidents like this start much earlier in the process. The code arrives through a source that looks legitimate, gets pulled into a workflow that looks normal, and spreads before anyone has a reason to question it. That is what makes supply chain attacks difficult to defend against. The trust is already there. Related Reading Why Linux Supply Chain Attacks Are Becoming a Nightmare for DevOps Teams Why Software Supply Chain Security Matters in Linux Systems Debian 14 Requires Reproducible Builds for Package Integrity Enforcement Targeted Attacks on Open Source Maintainers Highlight Security Risks If you like this kind of Linux security coverage, subscribe to our newsletter for more updates, analysis, and practical tips. . Exploring the rise of supply chain attacks in open-source software, focusing on recent malicious Python packages on PyPI.. Supply Chain Attack, Open Source Risk, Python Software Security, Dependency Management, Security Best Practices. . MaK Ulac
Jun 09, 2026
•
Network Security
83
security advisoryUbuntusoftware attackUbuntu 22.04 LTS Advisory: Command-Not-Found Rogue Package Risk
A potential security vulnerability exists in the command-not-found tool in Ubuntu, which threat actors could exploit to recommend and install malicious packages on systems running Ubuntu operating systems. The command-not-found tool is installed by default on Ubuntu systems and suggests packages to install when users attempt to run commands that are not available. . How Does This Exploit Work? The command-not-found tool relies on the Advanced Packaging Tool (APT) and snap packages for recommendations. However, cybersecurity researchers have discovered a potential loophole that allows attackers to manipulate the tool and recommend malicious packages through the snap repository. This vulnerability could lead to software supply chain attacks and pose a significant security risk for Ubuntu users. By exploiting the command-not-found tool, attackers can recommend and trick users into installing rogue packages, compromising the integrity and security of their systems. This vulnerability could be leveraged for software supply chain attacks, where malicious packages infiltrate the system through deceptive recommendations. The alias mechanism loophole allows threat actors to register corresponding snap names associated with aliases and deceive users into installing malicious packages. Additionally, attackers could claim the snap name related to an APT package and upload a malicious snap, which would be suggested instead of the legitimate APT package. This deceptive recommendation increases the risk of users falling victim to the fake snap package. The high percentage of APT package commands that are vulnerable to impersonation by malicious actors is a significant concern. As many as 26% of the APT package commands can be registered under an attacker's account, further emphasizing the severity of the security risk. This vulnerability puts many Ubuntu users at risk, potentially compromising their systems and sensitive data. What Are the Implications for Ubuntu Users? The implications of thisvulnerability are far-reaching and have long-term consequences. Ubuntu users, especially Linux admins, infosec professionals, internet security enthusiasts, and sysadmins, must be aware of this security flaw and take proactive measures to mitigate the risks. Verifying the source of packages before installation and checking the maintainers' credibility are crucial steps to prevent falling victim to this vulnerability. Additionally, developers of APT and snap packages are advised to register the associated snap name for their commands to prevent misuse. The impact on security practitioners is significant. They must remain vigilant and implement proactive defense strategies to safeguard their systems and networks. This vulnerability underscores the importance of continually monitoring and securing open-source and Linux environments, as even widely used and trusted tools can be exploited by adversaries. Our Final Thoughts on This Security Loophole This article sheds light on a critical security vulnerability in the command-not-found tool in Ubuntu. It highlights the potential consequences and provides essential recommendations for users and developers to mitigate the risks. Security practitioners must remain proactive, exercise caution, and establish robust defense strategies to safeguard against such vulnerabilities and protect their systems from malicious actors. Be sure to subscribe to our weekly newsletters to stay up-to-date on issues like this impacting the security of your Linux systems. Stay safe out there, Ubuntu users! . The command-not-found tool in Ubuntu helps users find installable commands, but a vulnerability may allow attackers to mislead users into installing harmful packages. Ubuntu Command-Not-Found Risk, Malicious Package Security, Software Integrity. . Brittany Day
Feb 14, 2024
•
Hacks/Cracks
83
malicious packageremote access toolnpm threatMalicious Packages Found in NPM and PyPI: Crypto-Miners and RATs
Security researchers have discovered yet another sizable haul of malicious packages on the open source registries npm and PyPI. These packages, which could cause problems if developers downloaded them without realizing it, can be found here. . It comes with a number of different packages, all of which contain the same malicious package. go file is a Trojan horse programme that was developed to mine cryptocurrency on Linux computers. According to Sonatype, sixteen of these were able to be traced back to the same actor known as trendava, who has since been removed from the npm registry. The total number of packages that have been identified as malicious, suspicious, or proof-of-concept since 2019 has nearly reached 107,000 thanks to the discoveries made by the company’s AI tooling. A new piece of Python malware with capabilities combining those of a remote access tool (RAT) and information stealer was also found by the security vendor. . Explore perilous npm and PyPI modules harboring crypto-miners and RATS that jeopardize developers' safety.. Malicious Packages, Npm Threats, Python Malware, Open Source Security. . LinuxSecurity.com Team
Feb 22, 2023
•
Hacks/Cracks
83
open sourcelinuxmalicious package241 Malicious Npm And Pypi Packages Downloading Cryptominers Threat
More than 200 malicious packages have been discovered infiltrating the PyPI and npm open source registries this week. . These packages are largely typosquats of widely used libraries and each one of them downloads a Bash script on Linux systems that run cryptominers. Researchers have caught at least 241 malicious npm and PyPI packages that drop cryptominers after infecting Linux machines. These packages are typosquats of popular open source libraries and commands like React , argparse , and AIOHTTP , but instead, download and install cryptomining Bash scripts from the threat actor's server. On Wednesday, software developer and researcher Hauke Lübbers shared coming across " at least 33 projects " on PyPI that all launched XMRig , an open source Monero cryptominer, after infecting a system. . Over 250 nefarious npm and PyPI packages identified that install cryptominers via typosquatting on Unix-like operating systems.. Malicious Packages, Cryptominer Threat, Open Source Vulnerabilities. . LinuxSecurity.com Team
Aug 23, 2022
•
Hacks/Cracks
83
linux securitysoftware attackmalicious packageMalicious PyPI Package Installs Monero Cryptominer on Linux Systems
A malicious PyPI package was used to install a Monero cryptominer on Linux systems. . The package in question, secretslib, was pushed to the official third-party software repo for Python on 6th August 2022. The package was described as “secrets matching and verification made easy”. Sonatype’s automated malware detection system flagged secretslib as potentially malicious. Further analysis proved its suspicions to be correct. The link for this article located at Developer is no longer available. . An exploitative package on PyPI dubbed pycryptominer was discovered deploying a Zcash mining tool across Linux platforms.. Linux Cryptominer Threat, PyPI Malware, Malicious Package Installation. . LinuxSecurity.com Team
Aug 15, 2022
•
Hacks/Cracks
210
credential theftmalicious packagedependency confusionDependency Confusion Attack Targets Amazon and Slack Apps
Malicious actors are exploiting a new 'Dependency Confusion' vulnerability to target Amazon, Zillow, Lyft, and Slack NodeJS apps and steal Linux/Unix password files and open reverse shells back to the attackers. . Last month, BleepingComputer reported that security researcher Alex Birsan earned bug bounties from 35 companies by utilizing a new flaw in open-source development tools. This flaw works by attackers creating packages utilizing the same names as a company's internal repositories or components. When hosted on public repositories, including npm, PyPI, and RubyGems, dependency managers would use the packages on the public repo rather than the company's internal packages when building the application. . Cybercriminals take advantage of a recently discovered dependency confusion flaw to infiltrate large corporations and extract sensitive login information.. Dependency Confusion, NPM Security, Attack Vector, Credential Theft. . Brittany Day
Mar 02, 2021
•
Security Vulnerabilities
210
security advisoryroot accessLinuxTeamViewer RPM Repository Vulnerability: Malicious Package Risk Exploit
A vulnerability discovered in TeamViewer RPM auto-updates on Linux allowed attackers to easily install and execute arbitrary software with root permissions. Luckily, TeamViewer has fixed this flaw in version 15.11.6. . Three months ago, I discovered a security vulnerability in TeamViewer RPM auto-updates on Linux. The vulnerability allowed an attacker-in-the-middle (AITM) to subvert the TeamViewer RPM package repository to install and execute arbitrary software with root permissions. First thing first: TeamViewer followed best practices and used cryptographic signing (GPG) on the repository metadata and its software packages. These measures should have prevented anyone from tampering with either the repository or any of its packages. However, it assumes that the system has a copy of TeamViewer’s public GPG key. . An exploit in TeamViewer RPM updates allows unauthorized root permissions for software installations. Version 15.11.6 addresses this issue.. TeamViewer Vulnerability, Linux Auto-Update Security, Malicious Package Risk. . Brittany Day
Nov 06, 2020
•
Security Vulnerabilities
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!