Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 6 articles for you...
79
Linux securitysecurity assessmentautomationHow AI Is Changing Open Source Penetration Testing
AI is beginning to reshape how penetration testing workflows are organized. For years, the penetration tester’s workflow has been a labor-intensive ritual: scan, enumerate, research, exploit, and report. But new frameworks are attempting to codify that intuition, turning the "human-in-the-loop" process into a machine-coordinated workflow. But is this a genuine evolution in how we secure Linux environments, or just a sophisticated wrapper around the same old tools? . Dark Moon is an open-source autonomous penetration testing framework that combines large language models with established offensive security tools. It supports assessments against web applications, APIs, Active Directory, Kubernetes environments, content management systems, and other common enterprise targets while orchestrating scans through Docker-based tooling. The "Conductor" Philosophy For the uninitiated, Dark Moon doesn’t aim to replace the core toolkit—tools like Nmap, sqlmap, or Nuclei—that Linux security professionals have relied on for decades. Instead, it positions itself as an "AI-powered conductor." In a traditional manual assessment, a tester has to constantly context-switch, analyzing the output of one tool to decide which flag to pass to the next. One open source implementation attempts to solve this via agentic reasoning. It doesn’t just scan; it interprets the HTTP response, determines if a CMS fingerprint is present, and proposes and executes the next stage of testing based on its reasoning model. For instance, imagine exposing a new Ubuntu web server. Traditionally, you might begin with Nmap, move to ffuf after discovering an HTTP service, fingerprint the application, then manually decide whether sqlmap or nuclei makes the most sense to run next. The Darkmoon project attempts to automate those transitions by using the output from one stage to dynamically determine what happens next. It can also consolidate findings into a structured report, sparing the operator from parsing dozens ofdisconnected tool outputs. Linux as the Working Environment for AI Security Tools One of the best things about these new security agents is that they’re built on the tools we’ve been using for years. The project leverages Docker for isolation, which is a massive win for Linux admins and DevOps folks who are already living in containers. It solves that classic "dependency hell" we’ve all dealt with—you know, trying to get some niche Python-based scanner to play nice with your system’s existing libraries. Because the framework runs everything in its own container, it keeps your host OS clean and stable while the AI manages the heavy lifting. For those of us who spend most of our day in a terminal, it’s not really about learning a whole new system. It’s more like getting an extra pair of hands to handle the repetitive, manual "grunt work" of orchestration, leaving us to actually dig into the interesting findings/ The Reality Check: Where AI Fits It is crucial to set expectations here. The AI is not a magic bullet. As noted in industry discussions on autonomous pentesting platforms , the real value lies in the reasoning layer. The AI isn’t discovering new exploits on its own; it is managing the execution of existing ones. This brings a specific set of limitations: Contextual Blindness: An AI can easily misinterpret a non-standard login portal or a specific network quirk that a human would recognize instantly. The "Hallucination" Risk: Some frameworks attempt to reduce hallucination risk by routing actions through controlled tool execution, the risk remains that the AI might prioritize the wrong path. Human Validation: The consensus among security researchers is that AI currently functions best as a "force multiplier." It handles the reconnaissance and the monotonous chaining of tools, allowing the professional to focus on the high-stakes analysis. Why It Matters for the Linux Community For sysadmins, researchers, and home-lab enthusiasts, these frameworksrepresent a shift in the security paradigm. We are moving away from "point-in-time" assessments—where you scan a network once a year—toward continuous security validation. The useful part is repeatability. The same checks can run after changes, after deployments, or against lab systems where configuration drift tends to show up first. While many people will use Dark Moon as a research or lab platform, the same orchestration model could eventually fit into CI/CD pipelines or scheduled internal assessments. It effectively turns your security posture from a static checkbox into a living component of your environment. Final Thoughts These frameworks don't replace tools like Nmap, ffuf, sqlmap, or the rest of the Linux security toolkit. Those tools remain the engines doing the work. What's changing is the orchestration layer sitting above them. As AI becomes better at interpreting results and coordinating workflows, frameworks like Dark Moon offer a glimpse of how future penetration testing may evolve while still relying on the open-source tools the Linux community has trusted for years. Whether you use it in production or just as a sandbox tool to explore the future of AI-driven red teaming, it’s a project that builds on the open-source spirit rather than trying to hide it behind a black-box paywall. Want more Linux security news, vulnerability analysis, and software supply chain updates? Subscribe to the LinuxSecurity Newsletter and get the latest threats, advisories, and expert insights delivered directly to your inbox. Related Reading Understanding Linux Privilege Escalation Patterns and Security Measures How Secure Is Linux? Exploring Security Design and User Privilege Models Optimizing Linux Security: Strategies for Modern Threats . Explore the capabilities of Dark Moon, an AI-powered framework transforming penetration testing workflows on Linux systems.. AI Penetration Testing, Automation Framework, Open Source Security, Linux Tools, Dark Moon. . MaK Ulac
Jun 26, 2026
•
Security Projects
78
Ubuntuopen source frameworkASP.NETNative .NET Support Now Available In Ubuntu 22.04 By Canonical
Canonical is incorporating Microsoft's ASP.NET and .NET SDK into its latest Long Term Support version of Ubuntu. . Microsoft and Canonical, the company behind Ubuntu , have announced native .NET availability in Ubuntu 22.04 . While open-source .NET has long been available in Ubuntu and other Linux distributions, this collaboration by Microsoft and Canonical will better secure the .NET software supply chain with enterprise-grade support. Specifically, .NET 6 developers can install the .NET 6 packages on Ubuntu with a single, simple command: #sudo apt install dotnet6 That's all there is to it. . Red Hat and Google launch Python on Fedora 37, improving functionality and options for programmers.. Canonical .NET, Ubuntu 22.04, Microsoft ASP.NET, Open Source .NET. . LinuxSecurity.com Team
Aug 17, 2022
•
Vendors/Products
212
security practicesopen source frameworkdeveloper toolsExplore Four Essential Tools for AWS and GitHub Security
Find and eliminate vulnerabilities in the data you store in AWS and GitHub. Learn more in a great Opensource.com article: . If your day-to-day as a developer, system administrator, full-stack engineer, or site reliability engineer involves Git pushes, commits, and pulls to and from GitHub and deployments to Amazon Web Services (AWS), security is a persistent concern. Fortunately, open source tools are available to help your team avoid common mistakes that could cost your organization thousands of dollars. This article describes four open source tools that can help improve your security practices when you're developing on GitHub and AWS. Also, in the spirit of open source, I've joined forces with three security expertsâ" Travis McPeak , senior cloud security engineer at Netflix; Rich Monk , senior principal information security analyst at Red Hat; and Alison Naylor, principal information security analyst at Red Hatâ"to contribute to this article. The link for this article located at Opensource.com is no longer available. . Uncover a quartet of open source solutions to bolster the security protocols of GitHub and AWS for software developers and systems engineers.. Open Source Security Tools, Cloud Security Solutions, GitHub Security Practices, AWS Security Enhancement, Vulnerability Management. . Brittany Day
Sep 12, 2019
•
Cloud Security
78
threat analysisintrusion preventionsecurity toolsSourcefire Razorback Open Source Detection Tool for Enhanced Security
The makers of the popular open-source Snort intrusion detection platform today unveiled a new open-source platform -- a detection framework that unites existing security tools, including IDS/IPSes.. The new Razorback platform developed by Sourcefire is basically a tool for tying together the various layers of detection within an organization, including antivirus, IDS/IPS, Web and email gateways, and firewalls, to use in concert to catch and examine potential threats and create mitigations on the fly. Its creators say it's not the same thing as a security information management tool, however, because it does more than capture events: "SIM collects events in a vacuum: It takes an AV event and says this host is infected by a virus ... It doesn't know anything about that piece of malware on the box," says Matt Watchinski, senior director of Sourcefire's vulnerability research team. Razorback, however, uses the various tools to provide more context about a potential attack, he says. It handles detection in near real-time and can convert newly found intelligence on an attack into a detection mechanism for it. It's basically a framework that overlays the existing security infrastructure and lets the various tools work more in concert, according to Sourcefire. The link for this article located at Dark Reading is no longer available. . The new Razorback platform developed by Sourcefire is basically a tool for tying together the variou. makers, popular, open-source, snort, intrusion, detection, platform, today, unveiled, open-s. . LinuxSecurity.com Team
Jul 28, 2010
•
Vendors/Products
78
security managementAppArmoropen source frameworkAppArmor: Novell's User-Friendly Framework for Linux Security
With its latest entry into the Linux desktop market, Novell plans to make Linux more secure and make that security easier to manage, company officials said at the LinuxWorld conference. The software maker decided against adopting security modifications to the Linux kernel developed by the National Security Agency, known as SE Linux, because of the system is extremely difficult to configure. Instead, the Waltham, Mass. firm developed a framework for restricting applications known as AppArmor, which it released as an open-source project in January. . "We looked at SE Linux as a technology and we couldn't figure out how someone who didn't have a PhD could configure it," said Holger Dyroff, vice president of product management for Novell. "We are insisting that security be easy." The link for this article located at SecurityFocus.com is no longer available. . Red Hat's latest initiative, SELinux, seeks to enhance Linux security oversight with straightforward setup processes.. Linux Security, AppArmor, Novell Framework, Open Source Management, Desktop Security. . LinuxSecurity.com Team
Aug 18, 2006
•
Vendors/Products
79
intrusion detectionsecurity managementlog managementExploring Prelude Hybrid IDS Framework for Effective Security Management
Everyone both involved in information security and many that are not have heard of Snort NIDS (Network Intrusion Detection System). But not many have heard of a little jewel by the name of Prelude. Prelude is an open source framework for building distributed Hybrid Intrusion Detection Systems (HIDS). The reason it is called 'Hybrid' is that it utilizes sensors which are network based (NIDS). But also allows for hosts logs to be transmitted to a central 'Manager' for correlation and storage in a database (mySQL, Postgres, Oracle). . . .. Everyone both involved in information security and many that are not have heard of Snort NIDS (Network Intrusion Detection System). But not many have heard of a little jewel by the name of Prelude. Prelude is an open source framework for building distributed Hybrid Intrusion Detection Systems (HIDS). The reason it is called 'Hybrid' is that it utilizes sensors which are network based (NIDS). But also allows for hosts logs to be transmitted to a central 'Manager' for correlation and storage in a database (mySQL, Postgres, Oracle). Prelude has been around in one form or another since 1998, so it is mature in terms of development. As well as equally as old as the Snort Project. With its modular design and ability to allow other external applications/devices to report to it makes it an excellent and extensible solution to creating custom HIDS solutions. There is are a myriad of terms that have come about recently that apply to variations of an IDS. A newer term that has come about is a SIM (Security Information Management). Which can apply partly to the Prelude framework. Being that a SIM is a centralized repository for security event information. In fact by this definition Prelude is for the most part a SIM: The project leader Yoann Vandoorselaere has referred to Prelude as a 'Meta IDS' as well. But no matter what term you use to refer to it. Prelude is a great piece of Open Source security software that was written with the intent of being used in large heterogeneous networks. The link for this article located at localareasecurity.com is no longer available. . Explore the Prelude IDS Framework, a cutting-edge hybrid security platform that enhances network and host log management for improved visibility and response to threats.. Prelude Framework, Hybrid IDS, Security Management Solutions, Network Security. . LinuxSecurity.com Team
Apr 28, 2004
•
Security Projects
78
open source frameworkdata certificationnotarisationOpenEvidence Framework For Data Certification And Time Stamping
Financed by the European community, OpenEvidence -part of European Project Group FP5- is an open source framework for data certification, time stamping and data archival that brings technology for evidence creation, validation and long term protection of documents.. . .. Financed by the European community, OpenEvidence -part of European Project Group FP5- is an open source framework for data certification, time stamping and data archival that brings technology for evidence creation, validation and long term protection of documents. Developers of France, Belgium, Estonia and Italy share in this project their technological know-how to build an architecture that can be applied to different business models like notarisation. Based on standards ISO 17799, British Standard 7799, IETF PKI RFC 3161 and IETF PKI RFC 3029, standardisations efforts has been made collaborating with the LTANS IETF Working group, ISO (concerning time stamping standard), PKIX certificate validation protocols, DVCS update (RFC 3029) and ISO 18509. A demonstration service of Time Stamping using RFC 3161 by C&A (Italian partners of OpenEvidence) can be used on its web site. The link for this article located at Hector Martinez is no longer available. . SecureDocs, supported by EU resources, is an open-source system designed to safeguard documents via verification and time-marking.. OpenEvidence, Data Certification, Notarisation, Time Stamping, Data Archival. . LinuxSecurity.com Team
Nov 25, 2003
•
Vendors/Products
79
network securityaccess controlsecurity modelRSBAC 1.2.0: Major Access Control Enhancements for Linux Systems
RSBAC is a flexible, powerful and fast open source access control framework for current Linux kernels, which has been in stable production use since January 2000 (version 1.0.9a). All development is independent of governments and big companies, and no existing access . . . . From: Amon Ott To: RSBAC List Subject: Announce: RSBAC v1.2.0 released Hi! Rule Set Based Access Control (RSBAC) version 1.2.0 has been released.Full information and downloads are available from https://www.rsbac.org/ RSBAC is a flexible, powerful and fast open source access control frameworkfor current Linux kernels, which has been in stable production use sinceJanuary 2000 (version 1.0.9a). All development is independent of governmentsand big companies, and no existing access control code has been reused. This version comes with many new features, e.g.: Network Device (NETDEV) targets (for configuration and raw access) Real template based network access control with Network Object (Socket) templates (NETTEMP) and targets (NETOBJ) and new request types BIND, CONNECT, etc. CAP module with min and max Linux Capabilities for users and programs Network and firewall config protection as new SCD targets Unlimited roles and types in Role Compatibility (RC) model Separate request type MAP_EXEC for library mapping (used to be EXECUTE, too) User ID and RC role based symlink redirection support Lifetime limits for many RC and ACL settings, like access rights and group memberships Amon Ott. Brief Description Name: rsbacVersion: 1.2.0Kernelver: 2.2.20, 2.4.18Status: 9 (UP), 8 (SMP)Author: Amon Ott Maintainer: Amon Ott Description: Rule Set Based Access Control (RSBAC)Date: 28-May-2002Descfile-URL: https://www.rsbac.org//rsbac.descDownload-URL: https://www.rsbac.org//download.htmHomepage-URL: https://www.rsbac.org//Manual-URL: https://www.rsbac.org/instadm.htm What is RSBAC? Name: rsbacVersion: 1.2.0Kernelver: 2.2.20, 2.4.18Status: 9 (UP), 8(SMP)Author: Amon Ott Maintainer: Amon Ott Description: Rule Set Based Access Control (RSBAC)Date: 28-May-2002Descfile-URL: https://www.rsbac.org//rsbac.descDownload-URL: https://www.rsbac.org//download.htmHomepage-URL: https://www.rsbac.org//Manual-URL: https://www.rsbac.org/instadm.htm Key features Open Source (GPL) Independent of governments and big companies Several well-known and new security models, e.g. MAC, ACL and RC Control over individual user and program network accesses Any combination of models possible Easily extensible: write your own model for runtime registration Support for current kernels Stable for production use RSBAC is a flexible, powerful and fast open source access control frameworkfor current Linux kernels, which has been in stable production use sinceJanuary 2000 (version 1.0.9a). All development is independent of governmentsand big companies, and no existing access control code has been reused. The standard package includes a range of access control models like MAC, RC,ACL (see below). Furthermore, the runtime registration facility (REG) makesit easy to implement your own access control model as a kernel module andget it registered at runtime. The RSBAC framework is based on the Generalized Framework for Access Control(GFAC) by Abrams and LaPadula. All security relevant system calls areextended by security enforcement code. This code calls the central decisioncomponent, which in turn calls all active decision modules and generates acombined decision. This decision is then enforced by the system callextensions. Decisions are based on the type of access (request type), the access targetand on the values of attributes attached to the subject calling and to thetarget to be accessed. Additional independent attributes can be used byindividual modules, e.g. the privacy module (PM). All attributes are storedin fully protected directories, one on each mounted device. Thus changes toattributes require special system calls provided. From version1.2.0, all types of network accesses can be controlledindividually for all users and programs. This gives you full control overtheir network behaviour and makes unintended network accesses easier toprevent and detect. As all types of access decisions are based on general decision requests,many different security policies can be implemented as a decision module.Apart from the builtin models shown below, the optional Module Registration(REG) allows for registration of additional, individual decision modules atruntime. In the RSBAC version 1.2.0, the following modules are included. Please notethat all modules are optional. They are described in detail in an extratext. MAC: Bell-LaPadula Mandatory Access Control (compartments limited to a number of 64) FC: Functional Control. A simple role based model, restricting access to security information to security officers and access to system information to administrators. SIM: Security Information Modification. Only security administrators are allowed to modify data labeled as security information PM: Privacy Model. Simone Fischer-Hübner's Privacy Model in its first implementation. See our paper on PM implementation (43K) for the National Information Systems Security Conference (NISSC 98) MS: Malware Scan. Scan all files for malware on execution (optionally on all file read accesses or on all TCP/UDP read accesses), deny access if infected. Currently the Linux viruses Bliss.A and Bliss.B and a handfull of others are detected. See our paper on Approaches to Integrated Malware Detection and Avoidance (34K) for The Third Nordic Workshop on Secure IT Systems (Nordsec'98) FF: File Flags. Provide and use flags for dirs and files, currently execute_only (files), read_only (files and dirs), search_only (dirs), secure_delete (files), no_execute (files), add_inherited (files and dirs), no_rename_or_delete(files and dirs, no inheritance) and append_only (files). Only FF security officers maymodify these flags. RC: Role Compatibility. Defines roles and types for each target type (file, dir, dev, ipc, scd, process etc.). For each role, compatibility to all types and to other roles can be set individually and with request granularity. For administration there is a fine grained separation-of-duty. Granted rights can also have a time limit. AUTH: Authorization enforcement. Controls all CHANGE_OWNER requests for process targets, only programs/processes with general setuid allowance and those with a capability for the target user ID may setuid. Capabilities can be controlled by other programs/processes, e.g. authentication daemons. ACL: Access Control Lists. For every object there is an Access Control List, defining which subjects may access this object with which request types. Subjects can be of type user, RC role and ACL group. Objects are grouped by their target type, but have individual ACLs. If there is no ACL entry for a subject at an object, rights are inherited from parent objects, restricted by an inheritance mask. Direct (user) and indirect (role, group) rights are accumulated. For each object type there is a default ACL on top of the normal hierarchy. Group management has been added in version 1.0.9a. Granted rights and group memberships can have a time limit. CAP: Linux Capabilities (new in 1.2.0). For all users and programs you can define a minimum and a maximum Linux capability set ("set of root special rights"). This lets you e.g. run server programs as normal user, or restrict rights of root programs in the standard Linux way. A general goal of RSBAC design has been to some day reach (obsolete) OrangeBook (TCSEC) B1 level. Now it is mostly targeting to be useful as secure andmulti-purposed networked system, with special interest in firewalls. Amon Ott . From: Amon Ott To: RSBAC List Subject: Announce: RSBAC v1.2.0 releasedHi!Rule Set BasedAccess Contr. rsbac, flexible, powerful, source, control, framework, current, linux, kernel. . LinuxSecurity.com Team
Jun 04, 2002
•
Security Projects
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!