Explore top 10 tips to secure your open-source projects now. Read More
×
Server Security
data privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Security Trends cybersecurity Linux documentation
cybersecurity Linux documentation Linux operating systems have gained prominence due to their stability, adaptability, and excellent security options. In the case of developing documentation, designing cybersecurity dashboards, or educational material, visuals are of vital importance when it comes to making things clear. The use of icons allows one to understand the message regarding alerts, authorization, encryption, authentication, or the state of the system just by looking at the visual cue without having to read long...
Jul 17, 2026
Security Vulnerabilities security advisory linux distribution
security advisory linux distribution ESET researchers identified 11 old and forgotten Linux UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 third-party certificate authority, regardless of the installed operating system (OS). Reported shims can be exploited to execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits even on systems with UEFI Secure Boot enabled.....
Jul 16, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security news
We found 25 articles for you...
72
sql injectioncybersecurity researchvulnerability managementWAF Bypass Method Discovered in Claroty Research on Cambium Security
Researchers at industrial and IoT cybersecurity firm Claroty have identified a generic method for bypassing the web application firewalls (WAFs) of several major vendors. . Claroty’s researchers discovered the method following an analysis of Cambium Networks’ wireless device management platform. They discovered a SQL injection vulnerability that could be used to obtain sensitive information, such as session cookies, tokens, SSH keys and password hashes. Exploitation of the flaw worked against the on-premises version, but an attempt to exploit it against the cloud version was blocked by the Amazon Web Services (AWS) WAF, which flagged the SQL injection payload as malicious. Further analysis revealed that the WAF could be bypassed by abusing the JSON data sharing format . JSON syntax is supported by all major SQL engines and it’s enabled by default. The link for this article located at Security Week is no longer available. . Experts at Claroty uncovered a technique that circumvents leading vendor WAF protections, highlighting weaknesses within Cambium's systems.. WAF Bypass, SQL Injection Vulnerability, Cybersecurity Research. . Brittany Day
Dec 14, 2022
•
Firewalls
83
sql injectionpen testingelection securityElection Security Threats Explored: DEF CON Reveals SQL Injection Exposure
Two 11-year-old budding hackers last week at DEF CON in Las Vegas used SQL injection attack code to break into a replica of the Florida Secretary of State's website within 15 minutes, altering vote count reports on the site.. Meanwhile, further down the hall in the adult Voting Machine Hacking Village at Caesars Palace, one unidentified hacker spent four hours trying to break into a replica database that housed the real, publicly available state of Ohio voter registration roll. He got as far as the secured server — penetrating two layers of firewalls with a Khali Linux pen testing tool — but in the end was unable to grab the data from the database, which included names and birthdates of registered voters.. Meanwhile, further down the hall in the adult Voting Machine Hacking Village at Caesars Palace, one . 11-year-old, budding, hackers, vegas, injection, attack. . LinuxSecurity.com Team
Aug 15, 2018
•
Hacks/Cracks
83
security advisoryexploitthreatDrupal SQL Injection Threat Analysis: Importance of Timely Patching
Nearly six months have passed since a major Drupal SQL injection vulnerability was disclosed, and yet attackers are continuing to try, sometimes successfully, to exploit websites that have failed to update their systems. . Trustwave analyzed one such exploitation in a Friday blog post that, more than anything, stresses the importance of keeping up with patching, said Ryan Barnett, senior lead security researcher at Trustwave, in an interview with SCMagazine.com. The link for this article located at SC Magazine is no longer available. . Trustwave analyzed one such exploitation in a Friday blog post that, more than anything, stresses th. nearly, months, passed, since, major, drupal, injection, vulnerability, disclosed. . LinuxSecurity.com Team
Mar 23, 2015
•
Hacks/Cracks
76
network securitysql injectionsecurity conferenceSQL Injection Risks in Linux Routers Explored at Black Hat and Defcon
Security researcher Zachary Cutlip (my pic left) took the stage at both Black Hat and Defcon conferences this weekend.. His talk was about doing SQL Injection on MIPS Powered SOHO routers - and in particular he aimed at the Linux powered Netgear WNDR3700. After sitting through an hour of this guy's presentation at Black Hat (I didn't bother to see it a second time at Defcon) the answer is: kinda/sorta. The link for this article located at Internet News is no longer available. . During the Black Hat and Defcon conferences, Alex Thompson addresses XSS attacks in network devices running on Linux firmware.. SQL Injection, Linux Routers, Network Security, Security Research, Threat Assessment. . Anthony Pell
Aug 01, 2012
•
Organizations/Events
83
sql injectioncyber threatdatabase securityMass SQL Injection Attack Hits Over 1 Million ASP.NET Pages
A mass-injection attack similar to the highly publicized LizaMoon attacks this past spring has infected more than 1 million ASP.NET Web pages, Armorize researchers said today. According to database security experts, the SQL injection technique used in this attack depends on the same sloppy misconfiguration of website servers and back-end databases that led to LizaMoon's infiltration.. "This is very similar to LizaMoon," says Wayne Huang, CEO of Armorize, who, with his team, first reported of an injected script dropped on ASP.NET websites that load an iFrame to initiate browser-based drive-by download exploits on visitor browsers to the site. The link for this article located at Dark Reading is no longer available. . 'This is very similar to LizaMoon,' says Wayne Huang, CEO of Armorize, who, with his team, first rep. mass-injection, attack, similar, highly, publicized, lizamoon, attacks, spring, infec. . LinuxSecurity.com Team
Oct 21, 2011
•
Hacks/Cracks
83
security advisorydata breachsql injectionBarracuda Networks Cyberattack Exposes Sensitive Data from Breach
Security company Barracuda Networks was itself hit by a security breach over the weekend that exposed certain information from its databases. An unknown hacker, who apparently took credit for the break-in, launched an attack that exposed a list of Barracuda databases along with the names, phone numbers, and e-mail address of various Barracuda partners.. The attack also uncovered the e-mail addresses of different Barracuda employees along with their passwords. Though the passwords were encrypted, they were done so using a hashing algorithm called MD5, which is considered by many to be a flawed and outdated encryption method. The attacker grabbed the information using an SQL injection script, which can exploit security holes in a database to retrieve or modify data. The link for this article located at CNET is no longer available. . A major cyber assault targets Barracuda Networks, compromising critical partner and staff information, comprising passwords and personal details.. Barracuda Networks, SQL Injection, Data Breach, Encryption Flaws. . LinuxSecurity.com Team
Apr 12, 2011
•
Hacks/Cracks
83
sql injectionsecurity breachmy sqlMySQL.com and Sun.com Hacked: SQL Injection Incident Details Unveiled
There are lots of red faces at Oracle this morning, as two of its sites, MySQL.com and Sun.com, were pwned over the weekend by veteran Romanian extremely-dark-gray-hat hacker TinKode and sidekick Ne0h. The sites were the victims of an as-yet-unidentified "blind" SQL injection technique -- the exact type of attack you'd think the devs and admins at MySQL would know how to protect against. Apparently, you'd be wrong.. Here's how it happened: Early on Sunday morning, Jackh4xor sent a message to the Full Disclosure mailing list explaining that MySQL.com was "vulnerable to blind SQL injection vulnerability." The message lists the target site as the MySQL.com customer view page. There's an impressive roster of databases, tables, and fields swiped from the MySQL.com site, as well as a short collection of usernames and passwords, both in their encrypted and unencrypted forms. Shortly after, a lengthy listing claiming to come from TinKode and Ne0h at Slacker.Ro in Romania appeared on Pastebin. TinKode (or more accurately, someone using the handle TinKode) has been, uh, credited with cracking into a U.S. Army site, Eset, NASA, the U.K. Ministry of Defense, Reuters, and others. TinKode also calls Jackh4x0r "our friend," and he claims that he and Ne0h found the offending vulnerability in January. The link for this article located at InfoWorld is no longer available. . Uncover the methods through which MySQL.com and Sun.com fell victim to cyber intrusions via SQL injection, leading to the leak of confidential information.. SQL Injection Attack, MySQL Exploit, Oracle Security Incident. . LinuxSecurity.com Team
Mar 31, 2011
•
Hacks/Cracks
83
sql injectionlinux securitysystem breachHBGary Breach: SQL Injection Leads To Credential Exposure And Linux Flaws
Ars Technica has documented the background of the break-in at the US security firm that tried to expose Anonymous but ended up being taken apart itself. The report explains that the attackers' point of entry was a proprietary CMS which was custom-designed for HBGary. . The CMS reportedly failed to sufficiently check certain input parameters and this enabled the attackers to send SQL commands to the database via specially crafted URLs. This apparently allowed them to retrieve the CMS users' password hashes, which turned out to be simple, unsalted MD5 hashes that presented an easy target for a rainbow table attack. The attackers subsequently found that at least HBGary Federal's CEO Aaron Barr and COO Ted Vera used their CMS passwords for various other services, including their email access and Twitter. Vera also had an account at the support.hbgary.com site, where Anonymous managed to log in via SSH using the same password. The site ran a Linux system that was still vulnerable to a security hole in the GNU C loader, disclosed last October. Ars Technica said that the vulnerability presented the uninvited guests with the opportunity to obtain root privileges on the system, which gave them access to several gigabytes of backup and research data they reportedly deleted. The link for this article located at H Security is no longer available. . The platform allegedly did not adequately validate specific user inputs, which facilitated the breach.. SQL Injection Risks, CMS Vulnerabilities, Security Breaches, Linux System Flaws. . LinuxSecurity.com Team
Feb 17, 2011
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!