Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 28 articles for you...
83
security strategiessecurity toolsservice disruptionApache2 Security: New Malware Threat Insights and Protection Strategies
Elastic researchers recently identified an advanced Linux malware campaign targeting Apache2 web servers, underscoring the need for sysadmins and cybersecurity specialists to be increasingly aware of the growing Linux malware threat. Constant vigilance in cybersecurity is necessary to guard systems from emerging attacks, especially as cyber threats continue to advance and become more challenging to detect. . In this article, we'll delve deeply into this recently identified malware, exploring its intricate inner workings and exploiting Apache2 web servers through infiltration and exploit. Furthermore, we'll examine its multidimensional impact, including degraded server performance, service disruption, and data loss. Knowing your vulnerability will enable more effective defense strategies against this campaign, and we'll explain who is at risk. Finally, we'll offer admins practical, actionable mitigation strategies to strengthen Apache2 web server security—from system updates and best practices to advanced security tools and user training. By adopting these strategies, you can more effectively protect your systems against current and future threats to ensure a resilient cybersecurity posture. Let's begin by closely examining this malware and how it works. Overview of This New Linux Malware & Its Operations This recently discovered Linux malware campaign involves attackers exploiting vulnerabilities in Apache2 web servers to leverage remote code execution (RCE) and path traversal flaws. This campaign has been classified as highly sophisticated due to its complex arsenal containing multiple types of malware, advanced persistence mechanisms, and various obfuscation techniques. The malware arsenal deployed by attackers includes various sophisticated components and techniques. KAIJI, explicitly used for Distributed Denial of Service attacks (DDoS), RUDEDEVIL as cryptocurrency miner malware, and custom malware tailored specifically for their operations have all been utilized by these criminals int heir attacks. Multiple mechanisms are employed to ensure persistence: GSocket masquerades as kernel processes for encrypted communications, Systemd services manage various services at boot time, while older SysVinit scripts initiate processes upon system boot-up. Bash profile modifications also modify user login processes to keep malware active over time. The attackers use several advanced techniques to maintain their presence, including manipulating SELinux policies to adjust security settings on Linux systems and using bind mounts as an obfuscation method to mask malicious files. They also exploit the CVE-2021-4034 (PwnKit) vulnerability for privilege escalation using tools like pspy64 for system reconnaissance and custom binaries named apache2 or apache2v86 with XOR encoded strings to avoid detection. Automated attacks use cron jobs, while attackers establish command and control (C2) channels using Telegram bots. How Does This Attack Work? At first, reconnaissance occurs when threat actors use tools like whatweb and sslscan to gather server information about potential targets. Once they identify an ideal victim, they exploit vulnerabilities to gain initial entry. If privilege escalation attempts fail, persistent users such as www-data are set up through encrypted connections using GSocket to maintain access and keep running undetected for extended periods. A cron job is then set up to download and execute a script named ifindyou every minute, using XMRIG, a popular cryptocurrency miner, to mine Bitcoin through the unmineable.com pool, using your hostname as identification in the mining process. Additionally, attackers use a Python script that interacts with online gambling APIs to simulate user activity and suggest potential money laundering schemes. What Is the Impact of This Threat & Who Is At Risk? Malware attacks can have far-reaching and catastrophic repercussions, with resource exploitation becoming an immediate risk to server performance and increased power usage, not tomention hardware components' potential wear and tear. Service disruption is another crucial issue where DDoS attacks can significantly impede availability. Data integrity and confidentiality are at risk, with malware potentially accessing sensitive data from compromised servers using communication channels like Telegram bots to exfiltrate it. Financial and reputational damage also pose substantial threats. Compromised servers could incur remediation costs, lost business revenue, and suffer service outages or data breaches that cause significant reputational harm to organizations. Since Apache2 web servers are so widely utilized, many entities are vulnerable. Enterprises of all sizes may be at risk due to outdated or unpatched Apache2 versions being used. Financial and e-commerce institutions that rely heavily on web services, web hosting providers with multiple client accounts hosted on shared infrastructure, and government and public sector organizations are also highly susceptible. Practical Mitigation Strategies for Securing Apache2 Web Servers Admins seeking to safeguard Apache2 web servers against sophisticated malware campaigns should employ several key mitigation strategies. Regularly updating and patching systems , including Apache2, is crucial. Implementing security best practices such as strong SELinux policies , disabling unnecessary modules and services to reduce the attack surface, and auditing server configurations and logs can all play an integral part in strengthening defenses. Enhancing authentication and access controls is another essential strategy. Administrators should use multi-factor authentication (MFA) and adhere to the least privilege (PoLP) principle when assigning user accounts and processes privileges. Deploying advanced security tools like intrusion detection systems (IDS) and intrusion prevention systems (IPS), endpoint detection response solutions, and web application firewalls can further boost security. Monitoring and analyzing network traffic is integralto detecting suspicious activities. Proper network segmentation must be implemented, with admins checking for suspicious connections outbound to unknown IPs. Maintaining regular copies of critical data backups and creating and testing an incident response plan is also essential and can ensure a swift recovery from incidents. Educating staff members on phishing and social engineering tactics, as well as developing and spreading security awareness through user training, can drastically decrease successful attacks on networks. Our Final Thoughts on Securing Your Web Servers Against This Malware This discovery of sophisticated Linux malware attacking Apache2 web servers illustrates the ever-evolving nature of cyber threats. Given its sophistication and capability, adopting an effective multi-layered security strategy is imperative to keeping your web servers safe from compromise and ensuring their resilience and security. Admins can significantly mitigate risk and strengthen server security by staying informed and following best practices. Due to the increasing frequency and sophistication of cyberattacks, continuous vigilance and proactive measures are essential in protecting vital digital infrastructure. . Investigate the emerging Linux malware risk aimed at Apache2 servers and implement proactive measures to bolster your cybersecurity defenses.. Linux Malware Threat, Apache2 Security, Cybersecurity Strategies, Malware Mitigation, Sysadmin Practices. . Brittany Day
Oct 03, 2024
•
Hacks/Cracks
210
security advisorycode executionservice disruptionX.Org: Security Advisory on Severe Memory Flaws and Code Execution Risks
After recent heap overflow, out-of-bounds write, and privilege escalation flaws brought X.Org into the spotlight, more severe memory safety, use-after-free, heap buffer overread, and code execution vulnerabilities have been identified in the popular X server. These issues affect the X.Org X11 server. . To help you secure your systems against exploits leading to service disruption, data compromise, and other damaging repercussions, we'll explore the vulnerabilities found, their impact, and how to mitigate them. What Vulnerabilities Have Been Found in the X.Org X11 Server? What Is the Impact of These Flaws? Vulnerabilities discovered in X.Org X11 include: The X.Org X Server incorrectly handled memory when processing the RRChangeOutputProperty and RRChangeProviderProperty APIs. An attacker could use this issue to cause the X Server to crash or obtain sensitive information. ( CVE-2023-6478 ) The X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An attacker could use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code. ( CVE-2023-6816 ) The X.Org X Server incorrectly handled reattaching to a different master device. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code. ( CVE-2024-0229 ) The X.Org X Server incorrectly labeled GLX PBuffers when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. ( CVE-2024-0408 ) The X.Org X Server incorrectly handled the curser code when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. ( CVE-2024-0409 ) The X.Org X Server incorrectly handled memory when processing the XISendDeviceHierarchyEvent API. An attacker could use this issue to cause the X Server to crash or execute arbitrary code. ( CVE-2024-21885 ) The X.Org X Serverincorrectly handled devices being disabled. An attacker could use this issue to cause the X Server to crash or execute arbitrary code. ( CVE-2024-21886 ) Heap buffer overread/data leakage in ProcXIGetSelectedEvents. ( CVE-2024-31080 ) Heap buffer overread/data leakage in ProcXIPassiveGrabDevice. ( CVE-2024-31081 ) User-after-free in ProcRenderAddGlyphs. ( CVE-2024-31083 ) These vulnerabilities could have severe repercussions on impacted systems, enabling attackers to disrupt services and steal sensitive information, potentially resulting in the complete compromise of your critical Linux systems. How Can I Secure My Systems Against These X.Org Bugs? An essential X.Org update that fixes these issues has been released. We urge all impacted users to update to the latest version of X.Org as soon as possible. Applying the patches released by your distro(s) will protect your systems against attacks leading to downtime and compromise. To stay informed of essential updates released by the open-source programs and applications you use, register as a LinuxSecurity user , subscribe to our Linux Advisory Watch newsletter , and customize your advisories for your distro(s). This will enable you to stay up-to-date on the latest, most significant issues impacting the security of your systems. Follow @LS_Advisories on X for real-time updates on advisories for your distro(s) . . With new vulnerabilities in X.Org, adopting a multi-layered security approach is crucial. Steps like patching, access controls, and user education are essential. X.Org security, Memory safety fixes, Linux code execution, Open source update. . Anthony Pell
Apr 15, 2024
•
Security Vulnerabilities
83
security advisoryinternet attackservice disruptionUltraDNS Major Attack Causes Service Disruption for .info Domains
An Internet attack flooded domain name manager UltraDNS with a deluge of data late last week, causing administrators to scramble to keep up and running the servers that host .info and other domains. The assault sent nearly 2 million requests per second to each device connecting the network to the Internet--many times greater than normal--during the four hours of peak activity that hit the company early Thursday morning, said Ben Petro, CEO of UltraDNS.. . . . An Internet attack flooded domain name manager UltraDNS with a deluge of data late last week, causing administrators to scramble to keep up and running the servers that host .info and other domains. The assault sent nearly 2 million requests per second to each device connecting the network to the Internet--many times greater than normal--during the four hours of peak activity that hit the company early Thursday morning, said Ben Petro, CEO of UltraDNS. "This is the largest attack that we've seen," Petro said. He stressed that it didn't affect the company's core domain name system (DNS) services, but administrators had to work fast to get the attack blocked by the backbone Internet companies from which UltraDNS gets its connectivity. "From a network management perspective, it certainly kept us on our toes," he said. The attack came almost exactly a month after a similar attack targeted the DNS root servers, the databases that hold the critical information computers need to maintain top-level domains. Such domains act as the white pages of the Internet, matching domain names--such as www.cnet.com numerical Internet addresses. The link for this article located at ZDNet is no longer available. . A cyber assault inundated the domain management service UltraDNS with an overwhelming surge of traffic, resulting in significant operational chaos.. UltraDNS Attack, Network Disruption, Domain Name System, Internet Service Outage. . LinuxSecurity.com Team
Oct 16, 2023
•
Hacks/Cracks
83
malwaresecurity incidentservice disruptionRecipe Unlimited: Network Outage Due to Malware Impacting Restaurants
Recipe Unlimited, a publicly traded company that operates nearly 1,400 restaurants under 19 different brands in Canada, has experienced what appears to be a significant security incident impacting several of its brands. . The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partial network outage at nine of its franchises. Among those impacted were Swiss Chalet, Harvey's, East Side Mario's, and Kelseys. A "small number" of restaurants have been closed for a "temporary period of time" because of service issues related to the malware, the company said in a statement. The link for this article located at DarkReading is no longer available. . The company — formerly Cara Operations — on Monday noted that a malware outbreak caused a partia. recipe, unlimited, publicly, traded, company, operates, nearly, restaurants, under, differen. . LinuxSecurity.com Team
Oct 05, 2018
•
Hacks/Cracks
77
incident reportservice disruptionsocial networkFacebook Service Disruption Due To Technical Issues, Not Attack
Contrary to suggestions hacker group Lizard Squad took out Facebook, there was almost certainly no attack on the social network and its photo sharing property Instagram, which both went down late last night. According to a source with knowledge of the matter, the downtime was the result of a technical foul up. Facebook is now confirming this in statements to media.. Some had suspected that Lizard Squad, which was responsible for the Christmas strikes on Microsoft The link for this article located at Forbes is no longer available. . Twitter reassures users that recent disruptions stemmed from server glitches, dismissing rumors of cyber assaults by hacktivist groups.. Facebook Outage, Incident Report, Technical Issues. . LinuxSecurity.com Team
Jan 27, 2015
•
Server Security
83
service disruptiononline gamingcyber incidentSony PlayStation Network Attack: Service Disruption Acknowledged
Many gamers couldn. Sony Computer Entertainment America acknowledged the service disruption, saying via its official PlayStation account on Twitter that The link for this article located at Network World is no longer available. . In a significant disruption, Sony Interactive Entertainment North America announced a widespread PlayStation Network failure, leaving players unable to access services for an extended period.. PlayStation Network, Sony Gaming, Online Service Issues. . LinuxSecurity.com Team
Dec 09, 2014
•
Hacks/Cracks
74
security breachservice disruptioncyber incidentEvernote, Deezer, And Feedly Suffer DDoS Attacks Affecting Services
EVERNOTE, DEEZER AND FEEDLY have revealed that they have been struck by hackers, with the firms admitting on Tuesday to having suffered distributed denial of service (DDoS) attacks.. Evernote confessed to a DDoS attack on Twitter on Tuesday evening, advising its 100 million plus users, "Evernote service is currently unavailable. We are working to resolve the issue. Updates to follow. Thanks for your patience." The link for this article located at The Inquirer UK is no longer available. . Evernote confessed to a DDoS attack on Twitter on Tuesday evening, advising its 100 million plus use. evernote, deezer, feedly, revealed, struck, hackers, firms. . Alex
Jun 12, 2014
•
Network Security
83
cybersecurityservice disruptionbankingIzz ad-Din al-Qassam Cyber Fighters Target Major U.S. Banks
A shadowy but well-organized hacker group in the Middle East has disrupted the electronic banking operations of America. A group identifying itself as Izz ad-Din al-Qassam Cyber Fighters attacked the websites of Wells Fargo, U.S. Bancorp and Bank of America. The strikes left customers temporarily unable to access their checking accounts, mortgages and other services. The link for this article located at Spokesman Review is no longer available. . A group identifying itself as Izz ad-Din al-Qassam Cyber Fighters attacked the websites of Wells Far. shadowy, well-organized, hacker, group, middle, disrupted, electronic, banking. . LinuxSecurity.com Team
Sep 27, 2012
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!