Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Server Security
security advisory patch management
security advisory patch management There are several reasons why Linux has such a good reputation and has become such a good standard across the world. It is the power behind most internet servers and cloud infrastructures as well as billions of Android devices. It is stable, has consistently high-performance levels, and remains very flexible. You don’t have to deal with expensive licenses, can view and share code, and can customize any part of the interface to suit your demands. In an age of data breaches and continuous...
Jul 27, 2026
Server Securitysecurity practices application security
security practices application security Accepting file uploads is basically inviting strangers to throw random objects through your front window and hoping your living room furniture catches them. Whether it's profile pictures, PDF invoices, or archive files, handling raw uploads means you're trusting external input to behave. . The file sitting on your disk isn't actually the threat. A malicious JPEG doesn't execute code just by existing in a directory. The real danger is the parser—the image library, the unmanaged C-based PDF...
Jul 27, 2026
Security Vulnerabilities email security Linux server
email security Linux server You've probably trained your team to look for red flags. Odd sender names, urgent language, mismatched links. But a well-crafted spoofed email won't trip any of those wires. It looks legitimate, sounds legitimate, and often comes from a domain that passes every automated check you throw at it. . Attackers know exactly how humans scan an inbox. They design around it. This guide walks you through the techniques attackers use to slip a spoofed email past both your filters and your users and what...
Jul 25, 2026
Security Vulnerabilities cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Are host-based firewalls still worth using?
Trending News
Loading...
Explore Latest Linux Security news
We found 4 articles for you...
76
open source securitysecurity projectsoftware testingOpenSSF Alpha-Omega Project for Improved Open Source Software Security
OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS) through direct engagement of software security experts and automated security testing. Microsoft and Google are supporting the Alpha-Omega Project with an initial investment of $5 million. . Alan Shimel: Hey, everyone. Welcome to another segment for Techstrong TV. My guest today is Brian Behlendorf. Brian is with the Open Source Security Foundation – that’s the OSSF. The Open Source Security Foundation, of course, is part of the Linux Foundation and it was – it’s a relatively new organization. It was – was it announced at KubeCon – CNCFCon back in, I guess, September, was that, Brian? Brian Behlendorf: We announced kind of the second generation of the project in October. The project has been around for about a year longer than that – actually just over that as a collaboration between some things that Microsoft had started and Google had started. The Linux Foundation said, “Let’s put this in the same pod” and a tremendous community of volunteers stepped up to do all sorts of things and get plates spinning on top of poles. And then, around about October we realized, hey, there’s some places where spending some money would be helpful and here’s a whole bunch of companies willing to come in as sponsors and really fund some of that work. And so, that also freed me up to be able to focus full time on it as well. The link for this article located at Security Boulevard is no longer available. . The Open Source Security Foundation's Alpha-Omega Initiative is designed to bolster OSS protection through the involvement of specialists and thorough assessments.. OpenSSF, Open Source Security, Alpha-Omega Project, Software Security, Automated Testing. . Brittany Day
Sep 11, 2022
•
Organizations/Events
79
open source securitysecurity investmentsoftware testingOpenSSF: Alpha-Omega Project Aims to Enhance OSS Security and Testing
Following a meeting with government and industry leaders at the White House, OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS) through direct engagement of software security experts and automated security testing. . Microsoft and Google are supporting the Alpha-Omega Project with an initial investment of $5 million . This builds on previous industry-wide investments into OpenSSF aiming to improve open source software security. Widely deployed OSS projects that are critical to global infrastructure and innovation have become top targets for adversarial attacks. Following new vulnerability disclosures, adversary attacks can be seen within hours. For example, recently discovered vulnerabilities in the widely deployed Log4j library forced many organizations into crisis as they raced to update applications using the popular library before adversaries could attack. . The OpenSSF collaborates with Google and Microsoft, investing $5 million to bolster the Alpha-Omega initiative, aimed at improving open-source software.. OSS Security, Alpha-Omega Project, Software Supply Chain, Security Testing, OpenSSF. . LinuxSecurity.com Team
Feb 03, 2022
•
Security Projects
83
zero-dayvulnerabilitysecurity flawsDaily Zero-Day Exploits Found in Microsoft, Apple, Oracle, and Adobe
Subscribers to organizations that sell exploits for vulnerabilities not yet known to software developers gain daily access to scores of flaws in the world's most popular technology, a study shows. . NSS Labs, which is in the business of testing security products for corporate subscribers, found that over the last three years, subscribers of two major vulnerability programs had access on any given day to at least 58 exploitable flaws in Microsoft, Apple, Oracle or Adobe products. The link for this article located at CSO Online is no longer available. . Recent findings from NSS Labs showcase the vast range of zero-day vulnerabilities accessible to those enrolled in their security initiative.. Zero-Day Exploits, Flaw Access, Security Analysis, Vulnerability Testing. . LinuxSecurity.com Team
Dec 06, 2013
•
Hacks/Cracks
81
anti-phishingsecurity issuessoftware testingiPhone OS 3.1: Anti-Phishing Issues Found in Mobile Safari
The new Apple iPhone OS 3.1 software comes with a new anti-phishing feature for the Mobile Safari browser, but researchers say the filter doesn't work.. "I've not been able to get it to block anything," says Michael Sutton, vice president of research at Zscaler, who has been testing the mobile browser's security feature against several phishing sites identified on PhishTank. While Apple's Safari for the desktop blocks many of the sites, the iPhone's mobile version didn't block any that he tested. Sutton says it's either a bug in the OS 3.1 software, or the new iPhone software just runs a pared-down version of the Safari browser's security feature. "OS 3.1 has settings in the Safari browser for turning on and off phishing protection, but it's just not [working]," Sutton says. Apple had touted the new iPhone OS 3.0's anti-phishing feature, but Sutton says the feature was a no-show once the software was released in June, and he assumed the feature had just landed on the cutting floor. The link for this article located at Dark Reading is no longer available. . 'I've not been able to get it to block anything,' says Michael Sutton, vice president of research at. apple, iphone, software, comes, anti-phishing, feature, mobile, safari. . LinuxSecurity.com Team
Sep 14, 2009
•
Privacy
82
security standardstask forceNISTCybersecurity Task Force Recommendations for Standards Improvement
A cybersecurity task force recommended improvements today to a variety of technical standards and practices. Organized by the National Cyber Security Partnership, the task force issued a 104-page report with recommendations for the federal government and industry. The report is the last of five documents prepared by industry and academic experts on the President's National Strategy to Secure Cyberspace, a general blueprint for improving the nation's cybersecurity readiness. . . .. A cybersecurity task force recommended improvements today to a variety of technical standards and practices. Organized by the National Cyber Security Partnership, the task force issued a 104-page report with recommendations for the federal government and industry. The report is the last of five documents prepared by industry and academic experts on the President's National Strategy to Secure Cyberspace, a general blueprint for improving the nation's cybersecurity readiness. The task force members called for what they said were needed improvements to the consumer- and vendor-oriented software security testing program operated by the National Institute of Standards and Technology and the National Security Agency. The report recommends that NIST receive an initial $12 million in new appropriations and $6 million in following years for developing security requirements for specific classes of products such as intrusion-detection systems and virtual private networks. The link for this article located at fcw.com is no longer available. . A cybersecurity task force recommended improvements today to a variety of technical standards and pr. cybersecurity, force, recommended, improvements, today, variety, technical, standards. . Anthony Pell
Apr 20, 2004
•
Government
82
security solutionsauthenticationDefense DepartmentDefense Department Engages KPMG for Biometrics Testing of Smart Cards
The Defense Department's Biometrics Fusion Center soon will begin testing software on four types of biometric devices for use on its Common Access smart cards. DOD's Biometrics Management Office last week awarded a $915,000 contract to KPMG Consulting Inc. of . . . . The Defense Department's Biometrics Fusion Center soon will begin testing software on four types of biometric devices for use on its Common Access smart cards. DOD's Biometrics Management Office last week awarded a $915,000 contract to KPMG Consulting Inc. of McLean, Va., to conduct a 90-day test of biometric identifiers that could authenticate smart-card holders for building and network access. "We want to spend three weeks for a product assessment," said Paul Howe, director of the Biometrics Fusion Center in Bridgeport, W.Va. "We try to stay ahead of the marketing curve." Howe said the center's mission is to help DOD agencies become better buyers of biometrics. A separate facility in Bridgeport will host the tests for the Common Access program. KPMG's four subcontractors, known as the Smart Card Solution Team, will visit the fusion center to train workers in the vendors' enrollment and authentication applications with fingerprint readers as well as iris, voice and facial recognition devices. The subcontractors will demonstrate how a biometric identifier is stored and matched on a server, stored and matched on PCs, stored on a smart card and matched on a server, or stored and matched on smart cards. The link for this article located at GCN is no longer available. . The Defense Department's Biometrics Fusion Center soon will begin testing software on four types of . defense, department's, biometrics, fusion, center, begin, testing, software, types. . Anthony Pell
Jun 25, 2002
•
Government
79
security testingsecurity auditssoftware testingNew Open Source Testing Standard Enhances Security Methodologies
A group of open source developers dedicated to introducing an industry standard on security testing will be releasing the fruits of their labours later this month. Ideahamster.org started working on the Open Source Security Testing Methodology Manual (OSSTMM ) last year after becoming "sick of reading bland testing methodology descriptions".. . .. A group of open source developers dedicated to introducing an industry standard on security testing will be releasing the fruits of their labours later this month. Ideahamster.org started working on the Open Source Security Testing Methodology Manual (OSSTMM ) last year after becoming "sick of reading bland testing methodology descriptions". The group, which includes security experts and developers, claimed that the introduction of an industry standard on security testing would make it easier for users to judge security products. Security firms currently use a number of different methodologies for testing, often producing a variety of results. Be sure to read our interview with Pete Herzog, the creator of the project. The link for this article located at vnunet is no longer available. . A group of open source developers dedicated to introducing an industry standard on security testing . group, source, developers, dedicated, introducing, industry, standard, security, testing. . LinuxSecurity.com Team
Feb 18, 2002
•
Security Projects
83
network securitysecurity assessmentcyber riskBruce Schneier Explores Network Security Testing Complexity
Bruce Schneier's comments on a security Underwriters Laboratory. As always, a well-thought-out commentary well worth reading. " Second, network security is much too hard to test. Again, safes are easy. Breaking into them requires skill but is reasonably straightforward. Modern software . . . . Bruce Schneier's comments on a security Underwriters Laboratory. As always, a well-thought-out commentary well worth reading. " Second, network security is much too hard to test. Again, safes are easy. Breaking into them requires skill but is reasonably straightforward. Modern software is obscenely complex: There's an enormous number of features, configurations, implementations. And then there are interactions between different products, different vendors, and different networks. In the past, I've written extensively about complexity and the impossibility of testing security. For now, suffice it to say that testing any reasonably sized software product would cost millions of dollars and wouldn't guarantee anything at the end. And worse, if you updated the product you'd have to test it all over again." The link for this article located at ZDNet is no longer available. . Delving into Bruce Schneier's perspectives on the obstacles faced in evaluating network defense mechanisms and the intricacies of software systems.. Cybersecurity Risks, Network Security Testing, Software Assessment. . LinuxSecurity.com Team
Jan 03, 2001
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Are host-based firewalls still worth using?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!