Explore top 10 tips to secure your open-source projects now. Read More
×
Security Vulnerabilities 
security advisory authentication
security advisory authentication We often view OpenSSH security updates through the lens of standard patch management. When a new CVE hits, we scramble to update, check our versions, and return to business as usual. But recent vulnerabilities tied to distribution-added OpenSSH GSSAPI patches are a reminder that the danger doesn't always lie in the core code; it often resides in the "convenience" features we layer on top. . These recent issues shouldn't just trigger an apt upgrade or dnf update; they should trigger a...
Jul 06, 2026
Security Trends privilege escalation Linux security
privilege escalation Linux security Linux security teams are drowning. Patches, kernel updates, new CVEs every week. SSH exposed here, an old web service there, and a forgotten cron job running as root. On top of that, SIEM dashboards blink all day with alerts that all claim to be “high priority.” . It’s no surprise that people stop paying attention. The real problem isn’t a lack of data. It’s the opposite. Too much noise, not enough signal. Security teams see huge lists of vulnerabilities and thousands of alerts, but very...
Jul 06, 2026
Security Vulnerabilities security advisory critical
security advisory critical Before you close out the week, check what still needs to be patched. . The list is not small. Ubuntu and Red Hat pushed kernel updates. OpenVPN and OpenShift both received security fixes. Several everyday Linux components were patched too, including Vim, nginx, cifs-utils, LibVNCServer, nghttp2, and Perl. That is the kind of week administrators can easily write off as routine. It should not be. These are the updates that keep small openings from turning into real access. Why This Week Looks...
Jul 03, 2026
Security Trends malware security research
malware security research GitHub has become the latest delivery mechanism for malware aimed at security researchers. . YesWeHack and Sekoia identified a campaign that hid a Python-based remote access trojan (RAT) called ChocoPoC inside repositories presented as proof-of-concept exploits for recently disclosed vulnerabilities. Someone looking for a working exploit could clone the project, execute the code, and unknowingly launch a second payload that established remote access. Nothing about the campaign specifically...
Jul 02, 2026
Cloud Security incident response Linux administration
incident response Linux administration Over the span of just 14 days, threat actors unleashed more than 81 million login attempts against Microsoft’s Azure command-line interface (CLI). The campaign , which security researchers at Huntress identified as an ongoing, automated password-spraying effort, successfully compromised at least 78 Microsoft accounts across 64 organizations between June 12 and June 26, 2026. . While the scale is massive, the underlying strategy is surprisingly surgical. Attackers aren't exploiting a flaw in...
Jul 01, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Loading...
Explore Latest Linux Security news
We found 35 articles for you...
79
security assessmentsecurity testingLinux applicationBoost Linux Security Using These 10 Vital Testing Tools Now
Linux admins rarely deal with one fixed system anymore. A single environment may include public-facing web apps, internal services, containers, cloud workloads, code repositories, and third-party packages pulled into production. That mix creates more places for weak points to hide. . Security testing tools help admins find those weak points before they turn into outages, data leaks, or full system compromise. Some tools scan networks. Others check code, container images, web apps, or exposed credentials. Used together, they give teams a more complete view of risk across the stack. This list covers ten security testing tools Linux admins should know for network checks, web testing, vulnerability scanning, code review, and secrets detection. Mindgard AI features are starting to show up in Linux-hosted applications. Internal automation tools, customer portals, support bots. Traditional vulnerability scanners were never designed to test how machine learning systems behave when someone intentionally feeds them hostile input. That leaves a blind spot in many security testing workflows. What It Helps Test Mindgard focuses on applications that include AI components like large language models or machine learning pipelines. A standard scanner might flag outdated packages or configuration problems, but it won’t tell you what happens when a model receives a manipulated prompt or unexpected data. This becomes important when applications pass information between models, APIs, and internal services. Weak logic anywhere in that chain can introduce security issues even when the infrastructure itself is properly hardened. Where It Fits in Modern Security Workflows Mindgard works best as a specialized layer within a broader testing process. Network scanners, web testing tools, and static analyzers still cover most traditional attack surfaces. Teams evaluating different offensive security tools often notice that many focus heavily on infrastructure and application flaws. AI behaviortesting is a newer territory. Mindgard focuses on how AI-driven features interact with software systems and user input. AI features are moving into production systems quickly. Testing how they react to hostile input is becoming part of a normal security review. Nmap Understanding what is exposed on a network is the first step in securing it. Nmap remains one of the most widely used tools for mapping systems, services, and open ports across Linux environments. Network Discovery and Attack Surface Mapping Nmap scans networks to identify live hosts, open ports, and service versions. Those results often reveal risks that configuration files alone might not show. An SSH service exposed to the internet, an outdated web server, or an unexpected management port can all signal potential trouble. In long-running environments, forgotten systems and temporary services tend to accumulate. Test machines, staging containers, or misconfigured applications may remain accessible long after their intended purpose ends. Network discovery scans make those exposures visible. How It Supports Security Assessments Nmap frequently appears at the beginning of security reviews and penetration tests. It verifies what systems are actually exposed to the network instead of relying solely on documentation or firewall rules. Once reachable systems are identified, deeper vulnerability scans or manual testing can begin. That reconnaissance step usually shapes where the rest of the assessment goes. OWASP ZAP Most web application problems don’t show up in the infrastructure. They show up in the application logic. Login forms, session cookies, API parameters, and request handling. That’s where OWASP ZAP spends its time. Instead of scanning packages or configuration files, the tool sits in the traffic path and interacts with the application directly. Detecting Weak Points in Web Applications ZAP performs dynamic application security testing. It runs against a live application and observeshow requests and responses behave. During a scan, it crawls the site, maps available endpoints, and starts sending modified requests back to the server. Parameters in forms, headers, cookies, and query strings. Anything the backend might process. Problems tend to surface there: injection flaws , broken authentication logic, missing headers, and weak session handling. Those issues rarely appear in static analysis. Flexible for Manual and Automated Testing Some teams use ZAP interactively. A tester proxies traffic through it, inspects requests, and tweaks them during the session. Other environments treat it more like a pipeline step. The scanner runs during a build or staging deployment, produces a report, and the findings land alongside the rest of the testing results before the application goes live. Nikto Nikto focuses on a narrow but useful job. Quickly identifying known issues in web server configurations. Fast Checks for Web Infrastructure The scanner looks for dangerous files, outdated server components, misconfigurations, and publicly exposed paths that should not be accessible. These checks are straightforward but often reveal problems introduced during server setup or deployment. Default files left behind after installation and unpatched components are common findings. Practical Early Warning Nikto works well as an early-stage diagnostic tool. It does not replace deeper vulnerability testing, but it frequently highlights areas that deserve closer inspection. Run it after deploying a server or moving an application. Misconfigurations tend to show up quickly. OpenVAS When environments grow beyond a handful of machines, manual vulnerability reviews become difficult to maintain. OpenVAS provides a way to scan large groups of systems for known security issues. Broad Vulnerability Coverage The scanner analyzes servers, services, applications, and network devices. Results are compared against vulnerability databases to identify knownweaknesses. Automated assessments allow teams to monitor many systems at once instead of inspecting each one individually. Supporting Vulnerability Prioritization Security teams rarely have the resources to fix every issue immediately. OpenVAS organizes scan results by severity, helping teams identify which weaknesses pose the greatest risk. Internet-facing systems, outdated services, and critical vulnerabilities usually rise to the top. That short list is where patching usually starts. Trivy Modern infrastructure rarely runs as a single server anymore. Containers, dependency chains, and infrastructure templates all sit in the stack now, and each layer brings its own security problems. Trivy focuses on scanning those layers. It checks container images, operating system packages, language dependencies, and configuration files for known vulnerabilities. An image can look clean on the surface while still carrying outdated libraries or vulnerable packages pulled in through dependencies. That tends to happen quietly during builds. A base image updates, a dependency shifts version, and suddenly a container ships with software nobody reviewed closely. Trivy catches those cases before images move into production. Metasploit Framework Finding a vulnerability in a scan report does not always mean it matters. Plenty of issues look serious on paper, but go nowhere once someone actually tries to use them. Metasploit helps answer that question. Security teams use it to simulate real attack techniques against a known weakness. If an exposed service or outdated component appears during scanning, a matching module can test whether the flaw leads anywhere useful. Sometimes it works. Sometimes it fails immediately. Either outcome tells you more than the report alone. Semgrep A lot of security problems start during development. Long before anything runs in production. Semgrep looks directly at source code instead of live systems. It scans for patterns that tend tointroduce vulnerabilities. Weak input validation, unsafe functions, and credentials hardcoded into scripts. The kind of mistakes that slip through code review when teams are moving quickly. Teams usually start with default rules and then tune them for the languages and frameworks they actually use. The rule sets tend to evolve along with the codebase. SQLMap Databases sit behind a large percentage of web applications. When input handling breaks down, SQL injection is usually close behind. SQLMap automates the testing process. It probes how applications handle user input and database queries, looking for signs that injected commands can alter the query flow. If the weakness exists, the tool can push further to test whether data extraction or modification is possible. Older applications tend to expose these issues first. Legacy database logic is often where the cracks appear. Gitleaks Not every security incident begins with an exploit. Sometimes it begins with a password sitting in a repository. Gitleaks searches code repositories for secrets. API keys, tokens, certificates, and credentials are committed during development. Automation scripts and infrastructure configuration files are common sources. Once credentials land in version control, they spread quickly through forks, clones, and cached builds. The longer they sit there, the harder the cleanup becomes. Early detection keeps the damage contained. Conclusion Linux environments used to be simpler. A few servers, maybe a database, a web service in front. The stack is wider now. Networks, containers, APIs, dependency chains, CI pipelines, internal tooling. AI features are starting to appear in some platforms as well. Each layer introduces its own failure points. Security testing tools tend to focus on different slices of that surface. Nmap maps exposed services. ZAP and SQLMap focus on application behavior. OpenVAS scans the infrastructure for known vulnerabilities. Trivy checks container images anddependency layers. Gitleaks looks for credentials that leaked into repositories. Semgrep operates earlier in the pipeline, inside the code itself. Metasploit helps verify whether a vulnerability actually leads to compromise. Mindgard enters where older tools struggle. Testing how AI-enabled features behave when someone intentionally feeds them hostile input. No single tool sees everything. Most teams end up running several together just to keep visibility across the Linux security environment. . Explore top security testing tools for Linux admins to enhance security checks and identify potential risks. Stay protected!. Linux Admin Tools, Security Testing, Vulnerability Assessment, Network Security Tools, Application Security. . MaK Ulac
Mar 13, 2026
•
Security Projects
79
security testingLinux distributionopen source toolKali Linux 2023.1 Celebrates Ten Years of Security Testing
The developers of specialized security-testing distro Kali Linux have released the first version of 2023, which marks the project's tenth anniversary… but only in this incarnation. . The new version, release 2023.1 , appears exactly one decade after version 1.0 was released on March 13th 2013. Kali Linux is a rebuild of an earlier distro called BackTrack , first rolled out 17 years ago, which was based on WHAX, first out 18 years back, which is in turn based on Whoppix. Suffice to say, it goes back a long while. Kali rates highly on Distrowatch – it's currently at number 18, pop-pickers – which we ascribe mainly to its appearances on TV show Mr Robot and the consequent perception that this is a cool tool for élite hackers penetration testers and other security professionals. For the type of people it targets , it's a handy time-saver. It has a bewildering variety of tools , and when installing, you can choose whether you want them all built in, or just a core set. Frankly, the Reg FOSS desk is not an élite hacker and has never worked as a pen-tester – although he has warned some large companies about holes in their network security before now. . The latest iteration, 2023.1, commemorates ten years since the debut 1.0 launch of Kali Linux, a widely-used tool for cybersecurity assessment.. Kali Linux, Pentesting Tools, Security Testing, Linux Distribution, Open Source. . LinuxSecurity.com Team
Mar 16, 2023
•
Security Projects
78
security testingLinux distributionsecurity analysisKali Linux 2020.4 Review on Raspberry Pi 4 for Security Testing
The latest Kali Linux images for the Raspberry Pi 4 include both 32-bit and 64-bit versions. J.A. Watson gives them a try in this hands-on demonstration. . Over the past few weeks, I have tried out Ubuntu , Manjaro , openSUSE and the latest Raspberry Pi OS release on the Raspberry Pi 4. I am going to complete this series with a look at Kali Linux, one of my favorite specialist Linux distributions. Kali is specifically made for security analysis and penetration testing, and is preloaded and configured for that purpose. The combination of the inexpensive and portable Raspberry Pi hardware and the Kali Linux distribution has seemed extremely promising to me for several years now, but so far it hasn't really fulfilled my expectations. Hopefully the more powerful Raspberry Pi 4 and the more mature Kali Linux 2020.4 will remedy that. . Kali Linux's compatibility with the Raspberry Pi 4 enhances accessibility, offering both 32-bit and 64-bit versions for various user needs and hardware capabilities. Kali Linux Raspberry Pi, Penetration Testing Software, Security Analysis Tools. . LinuxSecurity.com Team
Dec 24, 2020
•
Vendors/Products
78
DebianUbuntuopen sourceDiscover 7 Linux Distributions Perfect for Comprehensive Security Testing
Linux is often talked about when it comes to security. With this OS, you can choose from a multitude of distributions (distros) to lock down your computer or device, but that’s just for starters. Many Linux distros come with tools to help youperform penetration tests and security audits. . The following article lists just a few Linux distros for security testing. Many are based on Debian or Ubuntu with some added built-in custom tools. The link for this article located at Security Boulevard is no longer available. . Explore multiple Linux distributions tailored for security assessments, featuring Debian-oriented varieties equipped with pre-installed utilities.. Linux Distros, Security Testing, Penetration Testing, Debian Tools. . LinuxSecurity.com Team
Mar 16, 2020
•
Vendors/Products
83
security testingLinuxcloud securityCloudPassage Server Security Test: Speed Of Attacks On Linux Systems
How long would it take to hack into an average Web-based server - the kind a company might rent from the likes of Amazon Web Services? . To find out, the security company CloudPassage set up six servers, two running Microsoft operating systems and four running Linux-based operating systems, loaded them with various combinations of widely used programs, and invited hackers to take their best shot. Top prize: $5,000. The link for this article located at SF Gate is no longer available. . To find out, the security company CloudPassage set up six servers, two running Microsoft operating s. would, average, web-based, server, company, might. . LinuxSecurity.com Team
Dec 23, 2013
•
Hacks/Cracks
79
Mozillaopen sourcesecurity toolsMozilla Minion: New Open Source Framework for App Security Testing
The Mozilla Foundation is developing an open source security framework called Minion and plans to release a beta version in the first quarter of 2013. Minion will allow developers to subject their web applications to a security check. . The framework will target applications with well-established pen testing tools such as OWASP's Zed Attack Proxy (ZAP), Skipfish and NMAP. Further testing tools are planned to be incorporated into the framework as plugins. The link for this article located at H Security is no longer available. . Dive into the capabilities of Mozilla's fresh Minion framework, an open source solution designed to strengthen application security testing through the use of customizable plugins.. Mozilla Minion, Application Security, Penetration Testing, Security Framework. . LinuxSecurity.com Team
Jan 18, 2013
•
Security Projects
78
security testingbrowser securityFirefoxAccuvant Report Points to Google Undermining Firefox Security Claims
A security testing firm today said a recent report that named Google's Chrome as the most secured browser was flawed -- and part of a campaign by Google to undermine Mozilla's Firefox.. The work done by Denver-based security consultancy Accuvant, which released a report last week naming Chrome as more secured than either Firefox or Microsoft's Internet Explorer (IE), was paid for by Google. That raised the hackles of NSS Labs, a California company that tests browser security and antivirus software. The link for this article located at Network World is no longer available. . The latest study from SecureNet on web browser vulnerabilities has ignited claims suggesting that Microsoft is attempting to weaken Chrome's standing.. Browser Security, Firefox Tension, Google Accusations, Chrome Security, Security Testing. . LinuxSecurity.com Team
Dec 15, 2011
•
Vendors/Products
67
security toolopen sourcesecurity testingBoosting Smartcard Security Testing Utilizing the Degate Tool
At this year's Black Hat Conference, crypto expert Karsten Nohl of SRLabs demonstrated the degate tool that can be used to take a closer look at applications stored on smartcards, such as credit cards and SIM cards.. A smartcard chip is a tiny computer with ROM, in which its operating system and application are located; it also has flash memory for dynamic data, an execution unit and RAM. The ROM, RAM and flash memory are connect to the execution unit via buses. The chips often contain important data such as keys for pay-TV programmes and programs for generating TANs, which is why there have been regular and repeated attempts to read them out. "Timing attacks" were a popular approach up until a few years ago, but this has been succeeded by intrusive attacks on the chip's buses. The link for this article located at H Security is no longer available. . A smartcard chip is a tiny computer with ROM, in which its operating system and application are loca. year's, black, conference, crypto, expert, karsten, srlabs, demonstrated, degate. . LinuxSecurity.com Team
Sep 16, 2011
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is application sandboxing truly safe?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!