Explore top 10 tips to secure your open-source projects now. Read More
×
Security Vulnerabilities 
security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Security Trends cybersecurity Linux documentation
cybersecurity Linux documentation Linux operating systems have gained prominence due to their stability, adaptability, and excellent security options. In the case of developing documentation, designing cybersecurity dashboards, or educational material, visuals are of vital importance when it comes to making things clear. The use of icons allows one to understand the message regarding alerts, authorization, encryption, authentication, or the state of the system just by looking at the visual cue without having to read long...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
74
security advisorynetworkinglinuxIPv4 vs. IPv6 Proxies in 2026: Which One Should You Run on Your Linux Stack?
For years, IPv4 was the only proxy type that really mattered for anyone running automation off a Linux box. IPv6 was the protocol everyone said they’d migrate to, but almost nobody actually did. In 2026, that’s finally starting to shift. . The problem is that most admins stick with IPv4 out of habit. They know it; it’s what their tooling defaults to, and they don’t see a reason to change. Some are overpaying for addresses they don’t need. Others would quietly break their scrapers, scripts, or account setups the moment they switched. On a server juggling dozens of outbound connections, picking the wrong protocol isn’t just a billing question; it changes how reliable your jobs are and how your traffic looks to the other end. This guide breaks down which one actually fits your setup. The Current State of IPv4 and IPv6 Adoption For most of the internet, IPv4 is still the default. It’s the foundation almost every website, API, and tool was built on. We officially ran out of new IPv4 addresses years ago, but that scarcity never pushed everyone onto IPv6 the way people expected. IPv6 was supposed to be the fix — a practically limitless address space that solves the supply problem for good. Google, Facebook, and Cloudflare all fully support it today, and pretty much every modern Linux distribution ships with dual-stack out of the box. But plenty of smaller sites, older tooling, and corporate networks still haven’t caught up. The result is a split internet. Right now, around 40-45% of traffic runs over IPv6, driven mainly by major mobile carriers and large tech platforms. The rest is still IPv4-only — so if you point an IPv6 proxy at a target that doesn’t support it, the connection simply won’t complete. Compatibility With Common Tools and Target Sites Most failed IPv6 rollouts come down to compatibility. The major sites — Google, YouTube, Facebook, and anything behind Cloudflare — are already IPv6-enabled. But a long tail of smaller sites, niche marketplaces,aging e-commerce platforms, and corporate domains is still IPv4-only. For those, an IPv4 proxy is the only thing that will actually connect. On the tooling side, support is uneven. Modern HTTP clients and scrapers handle IPv6 fine — a recent curl, Python’s requests, and most current browsers will use it without complaint. Older scrapers, hand-rolled scripts, and some SEO software won’t, and a few will hang or fall back unpredictably on a dual-stack lookup if you haven’t tuned how the resolver picks an address family. Anti-detect browsers and multi-accounting tools usually stay on IPv4 because account trust scores are still built on IPv4 history. APIs and third-party services are all over the map on IPv6 support, so the safe default when your work depends on an API is IPv4. The rule is simple: if every target and every tool in your stack fully supports IPv6, switching can save real money. If even one link in the chain doesn’t, stay on IPv4. Pricing Differences and Why They Exist IPv4 addresses are scarce. There are roughly 4.3 billion of them, and nearly all are already in use. New blocks change hands on a secondary market, and prices keep climbing because demand is high and supply is fixed. Proxy providers pay real money for those addresses, and that cost lands on your bill. IPv6 is the opposite. The address space is so large that supply is effectively unlimited, so providers can obtain ranges at almost no cost. That’s why IPv6 plans can run far cheaper — some providers price IPv6 proxies at as little as 10 to 20% of the equivalent IPv4 plan. Where IPv6 Makes Sense If the target already supports IPv6, the math is hard to ignore. Google, YouTube, and other major tech platforms These networks have supported IPv6 for years. If most of your traffic goes to Google properties, paying IPv4 prices often doesn't buy you anything. Large-scale scraping jobs When a target is fully IPv6-enabled, address availability stops being the limiting factor. The bigger thecrawl, the bigger the savings. Social media monitoring and automation X, Instagram, TikTok, and similar platforms generally handle IPv6 traffic without issue. Some operators still prefer a private residential proxy setup for reputation reasons, but that's a separate decision from the protocol itself. Ad verification Google Ads, Meta Ads, and other large advertising networks are already operating in IPv6 environments. Verification traffic can usually move over without changing the workflow. Mobile-focused projects Many carriers adopted IPv6 long before fixed-line providers. If you're collecting mobile data or testing mobile applications, you'll often find yourself working in IPv6-heavy environments anyway. Internal testing and staging Easy savings. If you're controlling both ends of the connection, compatibility concerns largely disappear. Where IPv4 Still Has the Edge IPv6 availability isn't the issue anymore. Compatibility is. Older websites and smaller platforms Plenty of e-commerce stores, local businesses, forums, and government systems still run IPv4-only infrastructure. API-heavy workflows One endpoint supports IPv6. The next one doesn't. Documentation is often inconsistent, which makes IPv4 the safer option when reliability matters. SEO tooling and rank tracking Much of the SEO ecosystem was built around IPv4 assumptions. IPv6 support exists in some places, but not always consistently. Multi-account operations Reputation systems, trust scoring, and verification workflows still lean heavily on IPv4 history. The connection works. The account may not. Anti-detect browser environments Most anti-detect setups were designed around IPv4. Changing protocols can create inconsistencies that operators would rather avoid. Sneaker, ticketing, and limited-drop sites These are often the last places you'd want protocol-related surprises. Most operators stick with IPv4 and remove the variable entirely. Security and PrivacyConsiderations on Linux For anyone running this on a Linux host, the protocol choice has a couple of security angles worth keeping in mind — not just cost and compatibility. The first is leakage. On a dual-stack box, a misconfigured client can quietly fall back to your machine’s native IPv6 address and bypass the proxy entirely, exposing the real egress IP you were trying to hide. Before trusting any IPv6 deployment, verify what traffic is actually leaving the box. Start with ip -6 addr and confirm the interface has the addresses you expect. Then check an external service to see which address is being presented upstream. Misconfigurations are common, especially in environments where IPv4 and IPv6 are running side by side. If IPv4-only egress is the goal, disabling IPv6 at the operating-system level is usually more reliable than hoping individual applications behave correctly. On Linux, that typically means setting the net.ipv6.conf.all.Disable IPv6 sysctl and confirm the change took effect before testing again. The second is reputation. IPv6 ranges are usually handed out in large contiguous blocks, so a target that sees abuse from one address can flag an entire /64 in one move, which makes a cheap IPv6 pool easier to burn through if you’re not careful. IPv4 reputation is tracked per address and tends to be more established, which is part of why account-trust systems still favor it. Match the protocol to the sensitivity of the work, not just to the lowest price. Conclusion At the end of the day, most workflows still run on IPv4, simply because it’s the version of the internet around which most targets and tools were built. IPv6 is the cheaper option with far more room to scale — but only when the specific targets in your stack can actually handle it. The deciding factor is knowing your targets and your tooling before you commit. If you’re working against the big tech platforms with full IPv6 support, the savings are worth chasing. If you’re dealing with older, smaller, or mixedsystems — or you need tight control over what leaves your host — IPv4 is still the safer call. . Explore the differences between IPv4 and IPv6 proxies for Linux, understanding compatibility, costs, and security implications in 2026.. IPv4 Proxies, IPv6 Proxies, Linux Networking, Security Best Practices. . Anthony Pell
Jun 09, 2026
•
Network Security
83
security advisorymalwarebotnetSocksEscort Linux Router Malware Botnet Takedown Operation Lightning
Authorities have dismantled SocksEscort, a service that sold access to a large proxy network built from compromised residential routers. Investigators say much of the infrastructure sat on infected SOHO networking devices, many running embedded Linux firmware. . Instead of running its own servers, the operation pushed customer traffic through hijacked home and small-business routers. Over time, that created a distributed botnet where thousands of compromised systems acted as proxy nodes, letting fraud operations and credential attacks blend into normal residential traffic instead of standing out as activity from known malicious infrastructure. It’s a pattern that shows up again and again with router malware. A device gets compromised, nobody notices, and eventually that bandwidth is part of someone else’s proxy network. The SocksEscort case becomes more interesting once you look at how the network actually operated. Inside the SocksEscort Proxy Network SocksEscort presented itself as a residential proxy service, but the infrastructure behind it looked very different from the commercial proxy platforms people normally think about. Instead of volunteers or paid nodes, the traffic moved through compromised routers sitting in homes and small offices. That distinction changes the entire model. Legitimate proxy networks rely on users knowingly sharing bandwidth. The SocksEscort network relied on devices that had been quietly taken over and turned into relay points. A lot of that control came from AVRecon malware, a Linux-targeting threat uncovered by researchers at Lumen Black Lotus Labs. The malware targeted a wide range of SOHO routers, including models from Cisco, D-Link, Hikvision, MikroTik, Netgear, TP-Link, and Zyxel, which tend to run continuously and often sit untouched for years once they’re installed. Once a device was infected, the router effectively became part of the proxy network. AVRecon malware capabilities Linux router malware targeting SOHO networkingdevices device reconnaissance and system information collection command-and-control communication remote command execution proxy relay configuration for routing external traffic The result was a residential proxy network built almost entirely from compromised infrastructure. From the outside, it looked like a typical proxy service, but in reality, the network relied on thousands of infected routers acting as relay points for customer traffic. Once researchers started mapping the SocksEscort infrastructure, it became clear that the network had been running for years. The Scale of the SocksEscort Botnet Once researchers started mapping the SocksEscort infrastructure, it became clear that the network had been running for years. The service itself dates back more than a decade, gradually growing into a proxy network built from compromised residential devices. Investigators eventually tied more than 369,000 compromised IP addresses across 163 countries to the service. Researchers were also seeing around 20,000 devices communicating with the infrastructure each week, suggesting the botnet was constantly shifting as systems dropped off and new ones appeared. At that point, it stops looking like a niche proxy service. It starts looking like a long-running cybercrime infrastructure. The operation generated roughly $5.8 million (€5 million) in criminal revenue before the infrastructure was disrupted. The question I keep coming back to is why routers, especially Linux-based ones, keep showing up in operations like this. Why Linux Routers Keep Becoming Botnet Infrastructure Cases like SocksEscort tend to circle back to the same kind of device. Not servers. Not desktops. Home and small-office routers. Most of those systems run some form of embedded Linux, which makes sense once you think about how networking hardware is built. The operating system itself isn’t the problem. What matters is how long these devices stay online and how rarely they’re updated after they’reinstalled. A router might sit in a closet or under a desk for years without anyone logging into it. When attackers find a way in, that device can quietly become part of a botnet or proxy network and continue operating as if nothing changed. Where attackers usually get in Outdated firmware Default administrative credentials Exposed remote administration interfaces Unsupported hardware that no longer receives updates None of these weaknesses is particularly exotic. They’re the same entry points that have shown up in router botnet campaigns for years. Why infections often go unnoticed Routers operate continuously with little user interaction Proxy network activity generates minimal visible disruption Router security monitoring is uncommon in most environments •AVRecon has been observed flashing custom firmware images through the router’s update mechanism, allowing the malware to persist even after a reboot. That combination makes routers an unusually durable infrastructure once they’re compromised. A device can sit inside a botnet-backed proxy network for months, sometimes years, before anyone realizes it’s participating in the traffic. Which brings us back to the SocksEscort case and how authorities eventually disrupted that infrastructure. Why the SocksEscort Takedown Doesn’t Solve the Router Problem After years of operating in the background, the infrastructure behind SocksEscort eventually drew the attention of authorities . The joint investigation, known as Operation Lightning, focused on dismantling the service itself rather than attempting to track down every compromised router spread across residential networks. The response focused on dismantling the service itself rather than trying to track down every compromised router spread across residential networks. Authorities seized 34 domains and 23 servers across seven countries, dismantling the infrastructure used to operate the proxy service, and cryptocurrency connected to theoperation was frozen. In practical terms, that removed the platform that had been selling access to the proxy network. But taking down the service doesn’t automatically clean the devices that were already compromised. Many of the routers that once formed part of the SocksEscort network may still be online today, running the same firmware and configurations that allowed the compromise in the first place. What This Means for Linux Users and Administrators For most administrators, the takeaway from the SocksEscort case isn’t the malware itself. It’s the device lifecycle behind it. Routers and edge devices often stay in service far longer than the systems around them. They get installed, configured once, and then quietly run for years without firmware updates, configuration reviews, or security monitoring. That’s exactly the kind of environment operations like this depend on. If a router ends up inside a botnet or proxy network, the device may continue operating normally while routing traffic for someone else. In many cases, the first signal is an abuse notice from an ISP or unusual outbound traffic patterns that don’t match normal network activity. For administrators responsible for Linux-based networking devices, a few checks are worth making: Confirm routers are running the current firmware Replace hardware that no longer receives vendor updates Disable remote administration interfaces that are not required Change default or long-standing administrative credentials Review outbound traffic patterns from edge devices Isolate routers and IoT devices from internal networks where possible Administrators investigating suspicious router activity may also want to check for processes listening on port 48102 or the presence of a jid.pid file in /tmp, both indicators previously associated with AVRecon infections. None of these steps is complicated, but they’re often overlooked once a device is deployed, which is exactly the kind of gap operations like SocksEscorttend to rely on. That’s also why incidents like this keep resurfacing. The devices involved are rarely high-profile servers or hardened infrastructure. More often, they’re ordinary routers sitting at the edge of a network, quietly running the same firmware they had the day they were installed. . SocksEscort proxy network dismantled by authorities using compromised Linux routers shows ongoing threats from malware.. Linux Router Malicious Activity, SocksEscort Malware Disruption, Embedded Linux Security Issues, Cybercrime Infrastructure, SOHO Device Protection. . MaK Ulac
Mar 13, 2026
•
Hacks/Cracks
74
network securityopen-sourceconfigurationConfiguring Proxy Servers on Linux for Enhanced Security and Privacy
A proxy server is basically a middle step between your system and the internet. Instead of your machine reaching out directly, everything runs through the proxy first. That swap hides your IP and lets you control what comes in and what goes out. . So, how do you actually use a proxy server on Linux ? You can set it system-wide, drop it into tools like apt , wget , or curl , or just configure it per app. Once it’s in place, every request takes the proxy route — adding a layer of privacy and filtering traffic before it ever reaches you. Why Proxy Servers Matter for Linux Every connection leaves a trace. Businesses log activity, attackers scan for openings, and even normal browsing creates data you may not want exposed. On Linux, proxies help lock down that surface. They’re used to: Keep servers from being reached directly Spread traffic loads more evenly Mask user IPs for privacy Support scraping, testing, and automation at scale They don’t replace firewalls or intrusion detection, but they add another line of defense. For a closer look at how to use proxy servers for better online security , see this detailed guide. Setting Up a Proxy on Linux Pick a provider Free proxies are risky. Go with a service that’s stable and offers multiple proxy server IPs. System-wide config Add variables to /etc/environment: export http_proxy="http://username:password@proxy-server:port/" export https_proxy="http://username:password@proxy-server:port/" Reload the environment so apps respect the new settings. Package managers Debian/Ubuntu (apt) : edit /etc/apt/apt.conf: Acquire::http::Proxy "http://proxy-server:port/"; Acquire::https::Proxy "http://proxy-server:port/"; Red Hat/Fedora : add proxy details to dnf.conf or yum.conf Verify Run: curl -I https://ifconfig.me If it shows the proxy’s IP, you’re set. Per-app Firefox, wget, and curl can each be configured separately if you don’t want system-widerules. Types of Proxy Servers Residential – ISP IPs, harder to detect, used for scraping or ad checks Datacenter – fast, scalable, better for bulk requests Transparent – don’t hide identity, used for filtering Anonymous – hides IP but still flagged as a proxy Elite – masks both IP and proxy use, highest anonymity Common Mistakes Trusting free proxies that leak data Leaving open ports exposed Assuming one proxy setup will scale forever Ignoring monitoring — a broken proxy can kill performance Final Thoughts Knowing how to use a proxy server on Linux gives you more privacy and tighter control over traffic. It can reduce risk from phishing, balance heavy loads, and support research or automation without exposing your systems. It’s not a silver bullet — pair it with firewalls, encryption, and monitoring. But as part of a layered security setup, a proxy server is a simple, effective piece of the puzzle. . Learn the best practices for configuring and utilizing proxy services on Linux to boost your anonymity and manage network traffic effectively.. Proxy Server Configuration, Traffic Management Linux, Network Security Practices. . MaK Ulac
Sep 22, 2025
•
Network Security
74
internet securityprivacyproxyBoosting Your Online Privacy Using Tor Proxy Software Solutions
Nowadays, within the growing web 2.0 environment you may want to have some anonymity, and use other IP addresses than your own IP. Or, for some special purposes - a few IPs or more, frequently changed. So no one will be able to track you. A solution exists, and it is called Tor Project, or simply tor. There are a lot of articles and howtos giving you the idea of how it works, I'm not going to describe here onion routing and its principles, I'll rather tell you how practically pull out the maximum out of it. Did you ever wanted to increase your security and privacy on the Internet? This article will teach you how to use the proxy software called Tor. Have you every used it before?. The link for this article located at HowToForge is no longer available. . Discover ways to boost your digital safety and anonymity by utilizing VPN technology for secure internet surfing.. Tor, Proxy, Anonymity, Internet Security, Open Source. . Bill Locke
Oct 27, 2008
•
Network Security
74
proxycontent-filteringinternet-accessManage Internet Access Efficiently With SafeSquid Content Filtering
Content-filtering proxies restrict Internet access privileges for users or groups across an entire network. They must be able to block unwanted content through keyword, URL, DNS, MIME, and image filtering. They need to authenticate and log a user's Internet activity by monitoring and generating detailed reports of URLs accessed, and they must integrate antivirus or malware protection by accessing a reliable antivirus server. Fulfilling all these functions may be a lot to ask, but SafeSquid delivers on all counts. Do you want to use an open source content-filtering proxy that has the capabilities of Squid with content filtering and content security? Check out its features in this informative article. . The link for this article located at linux.com is no longer available. . Explore the ways in which SecureWave controls web connectivity, upholds content regulations, and enhances cybersecurity efficiently.. SafeSquid, Content Filtering Proxy, Internet Control, Open Source Security, Network Management. . Brittany Day
Sep 09, 2008
•
Network Security
72
network securityfirewallDMZUnderstanding Firewall Implementation for Network Security
A firewall is an organizationally and technical concept for the separation of networks, its correct implementation and constant maintenance. One piece that's often used is a piece of hardware that connects to networks the way as it's allowed in the concept. This piece of hardware is often called firewall-system/computer or in short firewall. . How does a typical technical implementation of a firewall look like? First you put a packetfilter between the directly connected networks (network 1 -- packetfilter -- perimeter network -- packetfilter -- network 2). The packetfilters only allow traffic from the directly attached networks. A connection from one network to the not directly attached packetfilter or the other network is strictly forbidden. The perimeter network is also known as DMZ (Demilitarized Zone). In it there are switching computers for all protocols/services who should work from one net to the other net. Such a switching computer is also known as Proxy, because it works pro procurationem/by proxy (like a secretary). Proxies work on application level, means they understand the communi The link for this article located at Lutz Donnerhacke is no longer available. . How does a typical technical implementation of a firewall look like? First you put a packetfilter be. firewall, organizationally, technical, concept, separation, networks, correct. . Benjamin D. Thomas
Feb 10, 2005
•
Firewalls
74
networkingconfigurationFreeBSDComprehending the Configuration of a Proxy Server in FreeBSD
If you've ever accessed the Internet from an office environment, chances are your communications passed through a proxy. In the next few articles, I'll discuss the advantages of using a proxy and demonstrate the configuration of several proxies available from FreeBSD's . . . . If you've ever accessed the Internet from an office environment, chances are your communications passed through a proxy. In the next few articles, I'll discuss the advantages of using a proxy and demonstrate the configuration of several proxies available from FreeBSD's ports collection. . Explore the implementation of proxies, along with their setup methods, in FreeBSD systems to ensure safe browsing and data integrity.. FreeBSD Networking, Proxy Setup, Internet Security, Access Control. . Anthony Pell
Jun 20, 2003
•
Network Security
77
apachefirewallconfigurationAccessing Web Servers Behind Firewalls Using Apache ProxyPass
This article shows how a web-server behind a firewall can be accessed without compromising security. It discusses configuring the Apache ProxyPass option to allow external hosts to an internal network. . . .. This article shows how a web-server behind a firewall can be accessed without compromising security. It discusses configuring the Apache ProxyPass option to allow external hosts to an internal network.. This article shows how a web-server behind a firewall can be accessed without compromising security.. article, shows, web-server, behind, firewall, accessed, without, compromising, security. . LinuxSecurity.com Team
Mar 05, 2000
•
Server Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!