Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
email security Linux server
email security Linux server You've probably trained your team to look for red flags. Odd sender names, urgent language, mismatched links. But a well-crafted spoofed email won't trip any of those wires. It looks legitimate, sounds legitimate, and often comes from a domain that passes every automated check you throw at it. . Attackers know exactly how humans scan an inbox. They design around it. This guide walks you through the techniques attackers use to slip a spoofed email past both your filters and your users and what...
Jul 25, 2026
Security Vulnerabilities cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found -3 articles for you...
210
security advisoryauthenticationopensshThe Hidden Cost of Enterprise SSH Authentication
We often view OpenSSH security updates through the lens of standard patch management. When a new CVE hits, we scramble to update, check our versions, and return to business as usual. But recent vulnerabilities tied to distribution-added OpenSSH GSSAPI patches are a reminder that the danger doesn't always lie in the core code; it often resides in the "convenience" features we layer on top. . These recent issues shouldn't just trigger an apt upgrade or dnf update; they should trigger a configuration audit. As our infrastructure has grown more complex, we have enabled features like GSSAPI—designed to simplify enterprise management—that have quietly expanded our attack surface in ways that standard hardening guides rarely address. Why Enterprises Enable GSSAPI SSH keys work well until your environment starts growing. A handful of Linux servers is easy enough to manage, but hundreds or thousands are a different story. Keys need to be rotated, access needs to be revoked when employees leave, and every new system has to be brought into the process. That's where GSSAPI comes in. Organizations already using Kerberos can let users authenticate with their existing domain credentials instead of distributing and maintaining SSH keys on every server. For many enterprises, that's a practical decision rather than a security decision. The catch is that SSH is no longer handling a relatively simple login. It now has to work with Kerberos tickets and the software that supports them. Recent GSSAPI-related vulnerabilities are a reminder that every additional authentication feature adds more code that has to process data before a session is established. That doesn't mean GSSAPI is unsafe. It means features that make administration easier also deserve the same level of review as the rest of your SSH configuration. There's another detail that's easy to miss. Many Linux distributions ship OpenSSH with downstream patches to support enterprise environments. Those additions aren't part of the upstream OpenSSHcode maintained by the OpenBSD project, so administrators should pay attention to distribution-specific security advisories rather than assuming every OpenSSH issue affects every system the same way. Why "More Secure" Isn't "Less Risky" The core insight here is that complexity is the enemy of security. We implement GSSAPI to avoid the human-centric failure of weak passwords, but we trade that for the system-centric failure of a complex, high-privilege service boundary. If your environment doesn’t require SSO via Kerberos, you are paying a security tax for a convenience you aren't actually using. Even if you do require it, you need to treat the GSSAPI configuration with the same level of paranoia you apply to your authorized_keys files. The Audit: What Should You Be Looking For? If you are running an enterprise Linux fleet, the recent OpenSSH updates serve as a forcing function to look beyond the patch. Ask yourself the following: Is GSSAPI actually necessary? For most standalone servers or small, static clusters, the answer is usually no. If you aren't actively using Kerberos for SSH authentication, explicitly set GSSAPIAuthentication no in your sshd_config. Are your "Forwarding" features justified? Features like GSSAPIDelegateCredentials no, AllowAgentForwarding no, and AllowTcpForwarding no are often left enabled by default out of habit. These provide lateral movement pathways for attackers who compromise an initial jump host. Is your authentication boundary siloed? In a modern "Zero Trust" architecture, we aim to minimize the trust we place in the server itself. Are you relying on the server to validate complex Kerberos tokens, or are you moving toward ephemeral, centrally signed SSH certificates? The Takeaway The latest OpenSSH updates are not just another entry in your vulnerability management dashboard—they are a critique of our collective preference for "easy" enterprise configuration. When you see a GSSAPI-related vulnerability in a changelog,don't just patch. Re-evaluate. Every feature you enable in sshd_config is an intentional decision to expand the scope of what an attacker can target. Before you restart that service, ask yourself: Am I configuring this for security, or am I just configuring it for convenience? Want more Linux security news, vulnerability analysis, and software supply chain updates? Subscribe to the LinuxSecurity Newsletter and get the latest threats, advisories, and expert insights delivered directly to your inbox. Related Reading How to Harden SSH on Linux After Disabling Password Authentication How to Detect Unauthorized SSH Key Usage on Linux Systems . OpenSSH updates highlight the importance of thorough configuration audits over standard patching practices.. OpenSSH updates, enterprise SSH risk management, GSSAPI configuration issues. . MaK Ulac
Jul 06, 2026
•
Security Vulnerabilities
77
security advisoryremote accesslinuxLinux Strapi Medium Redis RCE Threats from Malicious npm Packages
The first week of April 2026 marked a significant escalation in supply chain tactics. A coordinated campaign involving 36 malicious npm packages, disguised as Strapi CMS plugins, was uncovered by security researchers. This was not a broad, opportunistic "grab" for credentials. Forensic evidence, including hardcoded credentials and internal hostname checks, reveals a surgical strike against the cryptocurrency platform Guardarian. By weaponizing a trusted development workflow, attackers achieved a total compromise. Moving from initial execution to database theft and long-term persistence in minutes. . Attack Delivery: npm Postinstall Execution The campaign bypassed traditional runtime security by embedding malicious code in the of the package.json file. According to official npm documentation , these lifecycle scripts execute automatically upon installation. In a modern CI/CD pipeline or a developer’s local environment, this creates a zero-click infection vector. Because many build servers run with elevated or container-root privileges, the malware immediately inherits the ability to probe the underlying Linux host without further user interaction. Initial Exploitation: Redis RCE and Shell Access Once the postinstall hook fires, the malware doesn't just sit there—it immediately goes to work on the underlying Linux infrastructure. The most aggressive tactic identified by researchers was the weaponization of locally accessible Redis instances. The Redis Persistence Trick: Using the CONFIG SET command, the script reconfigures the Redis working directory to point directly to /var/spool/cron/crontabs/. By forcing a database "save" to this directory, the attacker effectively injects a malicious cron job into the system scheduler. This ensures that even if the npm process is killed, the attacker’s shell script re-downloads and executes every 60 seconds. Breaking Out with Reverse Shells: To bridge the gap between the application and the attacker, the payloads spawn multiplereverse shells—primarily on port 4444—to establish a persistent command link. In a particularly bold move, the script utilizes mknod and dd to create raw device nodes. This technique allows the malware to read directly from the disk blocks, potentially bypassing standard filesystem permissions to scrape sensitive data like SSH private keys or raw database files. Expansion: Moving Laterally Through the Stack With a foothold established, the malware shifts from exploitation to a full-scale reconnaissance mission. It doesn't just look for local files; it looks for the keys to the entire cloud kingdom. The payloads perform a comprehensive sweep of the environment, systematically harvesting secrets from CI/CD logs and configuration files. This includes a total "environment dump" where the malware captures every active variable in process.env—snagging everything from AWS session tokens to internal JWT secrets. Beyond the host, the script maps out the local network, probing for Docker sockets and Kubernetes API endpoints, searching for a way to pivot from a single compromised container to the broader production cluster. Expansion: Credential Harvesting and Infrastructure Access As the attack progressed, it shifted from exploitation to reconnaissance. The malware collected environment variables, configuration data, and credentials from the host system. It accessed .env files and application configs, extracted API keys and JWT secrets, and searched for cloud and container credentials, including Kubernetes service account tokens . The payload also gathered basic network information and checked for access to Docker sockets and internal services, which could be used to move further inside the environment. Targeting Indicators: Guardarian References The smoking gun for this being a targeted operation lies in the hostname check. One payload variant remained dormant unless the host identified itself as prod-strapi. Furthermore, the malware included hardcoded PostgreSQL credentials totarget databases named guardarian, guardarian_payments, exchange, and custody. This level of specificity strongly indicates that the attackers had prior knowledge of the target's internal infrastructure and used this npm campaign as a persistent "backdoor" into the company's financial core. Persistence and Evasion Techniques To ensure long-term access, the attackers utilized sophisticated persistence mechanisms that avoid standard filesystem detection: Hidden Processes: Payloads ran a background /proc scanner for 10 minutes after the main script exited. Fileless Execution: Later variants avoided the disk entirely, running a detached process via node -e that stayed in system memory long after the npm install process was terminated. SSH Backdoors: The script attempted to append rogue public keys to ~/.ssh/authorized_keys, providing a permanent "front door" for the attackers. Supply Chain Risk in CI/CD Pipelines This incident is part of a 2026 surge in "high-velocity" supply chain hits, arriving just days after the Axios maintainer account was hijacked to push malicious Remote Access Trojans. Industry reports confirm that the npm ecosystem is now a primary vector for targeting CI/CD pipelines. When pipelines blindly execute unverified code during the build phase, the "trusted" dependency graph becomes a Trojan horse for the entire production environment. Sonatype’s latest research suggests these attacks have increased by over 200% year-over-year. Mitigation and Response Organizations using Strapi or Node-based workflows should follow these recovery protocols immediately: Audit for Shadow Plugins: Legitimate Strapi plugins are strictly scoped under @strapi/. Any unscoped plugin versioned at 3.6.8 is a red flag. Rotate All Credentials: Assume any.env file or database password on an infected host is now compromised. Inspect Persistence: Check /etc/crontab and /tmp/ for hidden Node.js processes or scripts. Block C2 Egress: Block alloutbound traffic to known C2 infrastructure and restrict outbound connections from production servers. . A coordinated attack using malicious npm packages escalates supply chain threats impacting Strapi on Linux systems.. npm malware, Strapi security, CI/CD risks, Linux attacks, supply chain. . MaK Ulac
Apr 06, 2026
•
Server Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!