Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Organizations should combine the NVD and CISA KEV catalog to prioritize vulnerabilities effectively, focusing on managing real risks rather than being overwhelmed by theoretical scores and alert fatigue.. To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the NVD provides baseline technical metrics aligned with the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 19 articles for you...
82
security advisorydata protectionprivacyThe Pirate Bay Reviews CloudFlare SSL Issues And User Privacy Concerns
The Pirate Bay to remove CloudFlare CDN soon after it gets its act straight, says TPB crew The Pirate Bay went live on 31st Jan, a day earlier than schedule but with the launch came concerns from users and die hard TPB fans regarding the use of CloudFlare content delivery network including its SSL service and lack of moderators on TPB.. A thread on Reddit voiced concerns that The Pirate Bay website uses CloudFlare SSL certificate which means that when a user visits TPB, the CloudFlare employees/law enforcement agencies will know you accessed TPB. The redditor goes on to state that Cloudflare could also be coerced to inject malicious code into the responses. The link for this article located at TechWorm is no longer available. . A discussion on Twitter raised alarms about The Pirate Bay's reliance on CloudFlare SSL and the potential consequences.. CloudFlare Privacy Issues, User Data Protection, CDN Concerns, TPB Security. . Anthony Pell
Feb 06, 2015
•
Government
78
security advisoryupdatesslChrome 39 Security Update: Disabling SSLv3 Following POODLE Attack
Google has released Chrome 39, fixing 42 security vulnerabilities and removing support for the fallback to SSLv3, the component that was the target of the POODLE attack revealed last month.. When the POODLE attack was disclosed by several Google researchers in October, the company said that it had added a change to Chrome that would disable SSLv3 fallback. The technique involves an attacker to force a server to fall back from a modern version of SSL/TLS to the older SSLv3 and then decrypt the protected traffic by sending a high volume of requests to the server. The company plans to disable support for SSLv3 altogether at some point in the near future. The link for this article located at ThreatPost is no longer available. . Mozilla disables SSLv3 fallback in Firefox 34, addressing POODLE flaws and boosting encryption standards.. Chrome Security, POODLE Fix, SSLv3 Removal. . LinuxSecurity.com Team
Nov 25, 2014
•
Vendors/Products
76
vulnerabilitybrowser securitycertificate authorityExploring SSL Certificate Revocation Challenges and Expert Solutions
The way that browsers perform SSL certificate-revocation checking is so fundamentally flawed that some browser vendors have turned it off altogether, according to browser vendor representatives in a panel at RSA last week. . Moderated by a Certificate Authority (CA) representative, the panel involved key players from Mozilla, Google, and Opera, who all put forward potential solutions to the problem of how to check the valid status of SSL certificates issued by CAs. At the moment, sites depend on two methods for checking the valid status of SSL certificates online. One is through a certificate revocation list (CRL) published by the CAs, which post revoked certificates periodically on these lists. The other is through the Online Certificate Status Protocol (OCSP) responder systems CAs have in place to relay the up-to-date status of the certificate for a site to a user's browser when the user visits the site. The link for this article located at Dark Reading is no longer available. . Moderated by a Certificate Authority (CA) representative, the panel involved key players from Mozill. browsers, perform, certificate-revocation, checking, fundamentally, flawed. . Anthony Pell
Mar 05, 2012
•
Organizations/Events
78
security advisoryphpbug fixPHP 5.3.8 Security Advisory: Critical Bug Fixes For SSL And Cryptography
As expected, the PHP developers have issued version 5.3.8 of the PHP scripting language to address a serious bug found in the previous release. PHP 5.3.8 fixes a bug introduced by the 5.3.7 security update that caused the crypt() function to fail if an MD5 salt was given as an argument. The function is used to hash a string, typically a password, but instead of returning the hashed string, the function merely returned the salt itself.. The update also corrects a bug that caused mysqlnd SSL connections to hang. The developers note that the PHP 5.2.x series is no longer supported, adding that all users are strongly encouraged to upgrade to this latest stable release. The link for this article located at H Security is no longer available. . The Python 3.9.7 release fixes a critical security flaw and enhances TLS connection stability, improving overall safety.. PHP Update, Cryptographic Issues, SSL Fixes, Software Patches. . LinuxSecurity.com Team
Aug 24, 2011
•
Vendors/Products
79
encryptionsslpostgresqlSetting Up SSL for Secure PostgreSQL Connections via PgAdmin
This describes how to set up ssl certificates to enable encrypted connections from PgAdmin on some client machine to postgresql on a server machine. The assumption is that postgresql (compiled with ssl support) and openssl are already installed and functional on the server (Linux). PgAdmin is already installed on the client (either Windows or Linux).. On the server, three certificates are required in the data directory. CentOS default is /var/lib/pgsql/data/: root.crt (trusted root certificate) server.crt (server certificate) server.key (private key) The link for this article located at HowtoForge is no longer available. . On the server, three certificates are required in the data directory. CentOS default is /var/lib/pgs. describes, certificates, enable, encrypted, connections, pgadmin. . LinuxSecurity.com Team
Jan 03, 2011
•
Security Projects
67
network securitysecurity issuese-commerceExploring SSL Risks to E-Commerce Security at Black Hat Conference
Lots of code excitement will spring from the Black Hat hacker conference this week, but already a huge controversy is erupting: Black Hat's founder thinks SSL--the security code making much of online commerce safe--is broken.. SSL, Secure Sockets Layer (and its successor Transport Layer Security) is a Net-based security protocol that ensures communications between computers is safe and unhackable--essentially so that no one can "listen in." It works like this: A server and computer connect together and say hello, digitally. This bit is unsecured. The two machines exchange a "key" which unlocks a private line that only they can communicate on. These private exchanges are the basis of safe e-shopping, including credit card transactions. On the server side the site's owners can be certain they're speaking to a genuine customer, who's data can be trusted (to an extent).. SSL, Secure Sockets Layer (and its successor Transport Layer Security) is a Net-based security proto. excitement, spring, black, hacker, conference, already. . LinuxSecurity.com Team
Jul 29, 2010
•
Cryptography
81
privacythreatssurveillanceEavesdropping Risks In SSL Connections: EFF Warns of Surveillance Threats
The Electronic Frontier Foundation (EFF) is warning that state agencies are probably able to routinely eavesdrop on SSL-encrypted internet connections. They refer to a draft research paper in which researchers Christopher Soghoian and Sid Stamm summarise the evidence for this supposition and describe a possible defensive strategy.. The two researchers are not able to provide any hard facts. They start by stating that many governments routinely compel companies to cooperate with surveillance measures. In the USA, the statute which allows companies to be compelled to assist with such measures is "remarkably broad". According to the researchers, these statutes have been used to, for example, compel a SatNav manufacturer to activate the built-in microphone in one of its devices in order to record conversations in a vehicle. VeriSign, the largest provider of SSL certificates, is, according to the paper, also involved in outsourcing telecommunications surveillance. They conclude that government agencies must therefore also be able to compel certification service providers such as VeriSign to issue arbitrary SSL certificates. In many countries, there are government certification authorities (CA) which are stored as trusted root instances in all of the common browsers. Internet Explorer, Firefox, Safari and Chrome blindly trust more than 100 root certificates, including certificates from VeriSign, Deutsche Telekom and network administration agency CNNIC, which is controlled by the Chinese government. If a web server presents a certificate signed by one of these bodies, the user is informed that the connection is trusted by means of a padlock symbol or a green address bar. But the SSL concept is based on the trustworthiness of CAs. Anyone with a copy of the secret key for a root certificate or a major CA's intermediate certificate can spoof SSL on the fly and eavesdrop on encrypted connections. The link for this article located at H Security is no longer available. . The two researchers are not able toprovide any hard facts. They start by stating that many governme. electronic, frontier, foundation, (eff), warning, state, agencies, probably, routine. . LinuxSecurity.com Team
Mar 30, 2010
•
Privacy
77
encryptionapacheweb serverSetting Up SSL Using Self-Signed Certificates on Apache Server
The self-signed certificate is a certificate that you can create yourself that will provide SSL encryption but without the verification of your website from an outside source. The outside verification does cost money. In other words, you can get the protection you need, encryption by doing it yourself. One thing to note, if you are taking people's credit card information then you will need to get a signed certificate as a warning appears when you are using self-signed certificates. Have you every wanted to make your website more secure by using SSL? This article will show you everything you need to setup your own SSL Apache server.. The link for this article located at beginlinux is no longer available. . Discover the process of configuring SSL on your Nginx server using self-created certificates to boost your site's security.. Apache SSL, Self-Signed Certificate, Web Security. . LinuxSecurity.com Team
Oct 14, 2008
•
Server Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!