Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 31 articles for you...
210
security advisorysystem hardeningOpenSSHTerrapin Attack Advisory: OpenSSH Risk and Mitigation Strategies
Researchers recently uncovered a sophisticated attack dubbed Terrapin that takes advantage of a weakness in the SSH protocol to gain access to servers. The attack targets a specific implementation issue in OpenSSH 7.2 through 8.8 that allows remote code execution. By sending carefully crafted data, attackers can overflow the stack buffer and execute commands, leading to complete server compromise. . This is especially concerning for Linux system administrators , as SSH is widely used to manage Linux servers and infrastructure remotely. The vulnerability allows attackers to bypass authentication and gain elevated privileges on the target system. While patches have been released, Terrapin serves as an urgent reminder that determined adversaries are probing for weaknesses in core internet infrastructure. Proactive vigilance and defense-in-depth strategies remain essential to secure critical systems and data. How Does the Terrapin Attack Work? The Terrapin attack showcases the ingenuity of threat actors and illustrates why continued vigilance is necessary even with tried and true protocols like SSH. The malware , named Terrapin by security researchers, abuses the SSH protocol in a novel way to infect Linux systems and maintain persistence. Specifically, it modifies the SSH server daemon's host keys which are used to authenticate SSH sessions. When an SSH client first connects to a server, the server provides its host key fingerprint. The client caches this key to validate future connections. Terrapin secretly replaces the server's legitimate host keys with ones it controls. The next time a user logs in, their SSH client sees the fake host key and warns about a possible man-in-the-middle attack. However, many admins train themselves to accept key changes reflexively. Terrapin relies on this conditioned response to sneak its malicious host key onto the client's system. Now any future SSH connections get silently redirected through a proxy controlled by the attackers. This not only allowsthe threat actors to intercept sensitive data but also gives them remote access to pivot further into the breached network. All while avoiding detection by blending in with expected SSH communication. The researchers note that Terrapin shows intelligence gathering and patience on the attacker's part. Instead of immediately exploiting a breach, they stealthily set the trap and then wait for the catch. This highlights the need for admins to stay alert to subtle signs of compromise even after an initial infection. What Are the Implications for Linux Admins? The Terrapin attack concerns Linux admins and system administrators for several reasons. While this vulnerability affects OpenSSH, one of the most widely used tools for remote administration, the implications extend beyond just SSH. This attack shows how a single vulnerability in a core protocol can lead to full system compromise. Once the attackers have an initial foothold from the SSH exploit, they can potentially access any other service or data on the server. Servers are often bastions of an organization's entire infrastructure, so a compromise of one server can spread network-wide. As a privilege escalation attack, Terrapin bypasses authentication and gives the attacker immediate root access. This allows attackers to control and hide within compromised servers fully. Even with audit logging and monitoring, malicious actions are harder to detect if initiated by root. The targeting of IoT and embedded Linux devices is also troubling. As more critical infrastructure relies on connected Linux devices, attacks against them become higher risk. Malicious control of power grids, manufacturing systems, medical devices, and more through Terrapin could lead to safety, privacy, and reliability issues. For Linux admins, Terrapin means a renewed focus on patching , and upgrades are essential. However, it also shows the importance of reducing attack surface area through tight system hardening, network segmentation, the principle of least privilege,and other defensive best practices. Proactive logging, monitoring, and auditing are also key to help detect anomalous behaviors indicative of intrusion. How Can I Prevent the Terrapin Attack? The Terrapin attack targets vulnerabilities in SSH client software on Linux systems. While patches are still pending for some distros, there are several ways Linux admins can defend against this threat: Upgrade SSH Client - Ensure you are running the latest SSH client version without known vulnerabilities. Fully patch or upgrade vulnerable systems. Limit SSH Access - Only allow SSH connections from specific IP addresses or networks that need it. Restrict access to SSH internally when possible. Disable Password Auth - Require public key authentication for SSH instead of passwords. This prevents brute force attacks. Install Intrusion Detection - Monitor SSH logs closely for signs of compromise. Deploy host and network monitoring to detect brute-force attacks in real-time. Segment Networks - Use internal firewall rules and VLANs to isolate critical systems. Don't allow lateral movement between subnets and environments. Enforce MFA - Require multi-factor authentication for all SSH access. This will stop stolen credentials from being easily abused. Raise Awareness - Educate users on social engineering and securely sharing credentials. Limit access to only those needing it. Staying vigilant and proactively securing SSH access will make it much harder for threats like Terrapin to exploit environments. However, continued patching, upgrades, and monitoring are critical for identifying and stopping new vulnerabilities. Monitoring for Compromise While patching and upgrading software is critical, it's also important to monitor systems for signs of compromise. Here are some tips: Review logs regularly - Look for unusual failed login attempts or activities during off hours. Unauthorized access attempts could indicatebrute-force hacking attempts. Inspect running processes - Use commands like ps and top to look for unknown or suspicious processes. Attackers often try to hide malware by naming it after legitimate system processes. Check network connections - Tools like netstat this can show open ports and connections. Backdoors and malicious software often communicate over the network. Monitor user accounts - Look for unauthorized new users or changes to existing users like added sudo rights. Attackers try to create backdoor accounts. Scan for malware - Run rootkit scanners like rkhunter and chkrootkit. They check for signs of known malware. Also, scan things like PHP files for hidden code injections. Verify file integrity - Use a file integrity checker like Tripwire or AIDE to alert on unauthorized file changes. Attackers often modify system binaries or add malicious files. Monitor security patches - Check that all security updates are applied promptly to ensure known vulnerabilities can't be exploited. Staying vigilant is key. Even if patches are applied, assume systems can still be compromised. Actively hunting for the signs of intrusion is critical, especially on internet-facing systems. Patching Vulnerabilities Keeping SSH software up-to-date is one of the most important things Linux admins can do to prevent Terrapin and other attacks. The Terrapin attack exploits a vulnerability in OpenSSH that was patched in version 8.8 in April 2022. However, many organizations are slow to patch and upgrade services like SSH once they are running smoothly in production environments. The tendency to continue running outdated software is understandable but very risky from a security perspective. New vulnerabilities in protocols like SSH are discovered frequently, and threat actors quickly weaponize them in attacks. Unpatched systems running old SSH versions are sitting ducks. Upgrading to the latest OpenSSH release should be a toppriority for any organization exposed to the internet and relying on SSH for remote access. Dedicate the resources to testing patches and upgrades in dev environments before promoting them to production. Establish policies and procedures to ensure SSH daemons and clients stay current going forward. The effort required for ongoing patching and upgrades is far less than that needed to detect, contain, and recover from a breach. Take software updates and patches seriously, especially for security-critical network services like SSH. Multi-Factor Authentication Multi-factor authentication (MFA) is an important security control to implement for SSH access. Instead of relying solely on a username and password for authentication, MFA requires users to provide an additional factor, such as a one-time code sent to their mobile device. Enabling MFA provides significant security benefits for SSH: Provides an additional layer of protection beyond just a password. If credentials are compromised in a breach, an attacker still cannot access SSH without the additional factor. Defends against brute force attacks. Even if an attacker determines a user's password through guessing, MFA will block access without the secondary authentication factor. Protects against password reuse risks. An exposed password on one system does not enable access to SSH if MFA is required. Adds user-friendly options like push notifications and biometrics for the second factor. Can detect suspicious login attempts and block illegitimate access. For Linux administrators already using SSH keys for authentication, MFA further strengthens security. Overall, implementing MFA is one of the most meaningful controls an organization can adopt to secure SSH access and defend against advanced attacks like Terrapin. The minimal extra effort for users to authenticate with a second factor provides major security dividends and peace of mind. Network Segmentation Minimizing lateral movement is critical for mitigating attacks likeTerrapin. Segmenting networks into zones using firewalls, VLANs, and access controls can limit the blast radius if an attacker breaches part of the infrastructure. Admins should segment based on trust levels, using strict rules to filter traffic between zones. Critical servers like domain controllers should be isolated from general-purpose systems. Test/dev environments should also be segregated from production to prevent test instances from being used to pivot into production systems. Zero-trust network architectures take segmentation further by denying traffic by default and restricting communication to only what is explicitly allowed on a policy basis. While complex to implement correctly, zero trust significantly raises the bar for attackers attempting lateral movement. With the highly connected nature of modern networks, no segmentation is foolproof. But intelligent network segregation remains an important defense-in-depth measure against attacks like Terrapin that rely on pivoting through systems after gaining an initial foothold. Insider Threats The Terrapin attack highlights the risks that come from malicious insiders who have privileged access to systems. Even with strong perimeter defenses, a rogue admin on the inside can carry out damaging attacks. Some ways to mitigate insider threats: Implement separation of duties and least privilege access. Don't give any single person too much power. Use monitoring and auditing to detect anomalous behavior from privileged accounts. Look for unusual login times, commands run, and files accessed. Enforce multi-factor authentication for admin logins. This raises the bar for stealing credentials. Log and alert on suspicious admin activities like disabling security tools, excessive data exfiltration, or tampering with logs. Conduct background checks during the hiring process for sensitive roles. Screen for potential red flags. Implement behavioral analytics to spot risky user behavior patterns.Model normal vs abnormal activities. Provide anonymous reporting channels for employees to flag concerning insider actions. Foster an ethical workplace culture with clear policies, expectations, and accountability. Insider threats are hard to eliminate entirely, but taking proactive steps can help reduce the risk and damage they can inflict. Ongoing vigilance is required, along with being alert to warning signs. The Importance of Ongoing Cyber Vigilance The Terrapin attack demonstrates the ever-evolving nature of cyber threats and the need for continuous security monitoring and vigilance. Even if all known vulnerabilities are patched, new attack methods can emerge anytime. Organizations should have robust security awareness training to alert employees to potential risks. Monitoring systems and access logs can help detect anomalies that may indicate compromise. But technology alone is not enough. A vigilant security culture requires engagement from every employee, not just IT staff. With distributed workforces connecting remotely, risks multiply. Everyone has a role to play in spotting and reporting possible intrusions. Cyber hygiene, like strong, unique passwords and multi-factor authentication, is a daily habit. As defenders, we must be proactive, not reactive. The threats won't wait for us to catch up. Only persistent preparation and vigilance give us a fighting chance against sophisticated adversaries. Complacency is the enemy. We must continually adapt and improve defenses in anticipation of what comes next. Be sure to subscribe to our weekly newsletters to stay up-to-date on the latest advisories, information, and insights impacting the security of your Linux systems. Stay safe out there! . Linux system admins should stay vigilant against the Terrapin attack targeting SSH protocol flaws to infiltrate systems.. OpenSSH Vulnerability, SSH Exploit, Linux Threats, Cybersecurity Defense. . Brittany Day
Jan 02, 2024
•
Security Vulnerabilities
78
security advisorysoftware updatesystem performanceLinux Mint Advocates Software Updates to Enhance User Security and Safety
Linux Mint maintainers are emphasizing the importance of keeping software up-to-date - a critical security best practice that many users are neglecting. . The maintainers of the Mint Linux distribution are calling on users to update their software after conducting research that found many of them are not keeping their software up-to-date. Linux Mint is a popular distribution of Linux based on Ubuntu and Debian. Linux Mint's research found that less than a third of its users update their browser within a week of a new version's release, and that 30% of users are running Linux Mint 17.x. The latter statistic is bad because that branch went out of support in April 2019, meaning these systems haven't received security updates for almost two years. . The developers of Ubuntu emphasize the importance of keeping applications up to date to improve overall stability and user experience.. Linux Mint Updates, Software Maintenance, User Security. . LinuxSecurity.com Team
Feb 24, 2021
•
Vendors/Products
81
privacy issueinformation securityuser awarenessTackling Key Privacy Concerns Related to Online Activities and Behaviors
Information mishandling, snooping and location tracking are often the ways in which users find their privacy violated online. Learn about these issues and how to avoid them in a great Security Today article: . Internet is the fastest way of connecting with the world but, unfortunately, it is not the safest one. The internet is full of scams and gambles, and you are on the verge of security risks when you choose to be online. Most internet users are least bothered about their online privacy and are unaware of the plausible risks associated with it. Not only your privacy but your safety is also endangered, especially when you are using the internet to carry out important and secretive tasks like online banking and sharing crucial business files. The link for this article located at Security Today is no longer available. . Delve into significant online privacy concerns and discover effective strategies to protect your personal data in the digital realm.. Internet Safety, Privacy Protection, Secure Browsing, Online Risks. . LinuxSecurity.com Team
Sep 03, 2019
•
Privacy
76
data protectioncybersecurity threatssocial engineeringGDPR Exploitation Risks: Identity Theft at Black Hat USA Conference
The GDPR (General Data Protection Regulation) is supposed to help individuals keep their information private, but as it turns out, it could also potentially serve to help attackers as well. . In a session at the Black Hat USA conference in Las Vegas, titled, "GDPArrrrr: Using Privacy Laws to Steal Identities", James Pavur, DPhil student and Rhodes Scholar at Oxford University , outlined how he was able to abuse a key component of the GDPR to get access to personally identifiable information for his fiance. Pavur said that there are multiple exploitable properties of GDPR, that a social engineering attacker could seek to exploit. The first is fear of non-compliance, since GDPR prescribes large fines if there is a violation. The link for this article located at Infosecurity is no longer available. . The GDPR was created to protect personal data in the EU, but studies show that malicious actors exploit it using social engineering for identity theft. GDPR exploitation, identity theft awareness, privacy regulations, social engineering tactics, cybersecurity threats. . Brittany Day
Aug 09, 2019
•
Organizations/Events
67
phishingcyber threatuser awarenessFBI Alerts Users: HTTPS Isn't A Trust Guarantee Against Phishing
Would you trust a website simply because the connection to it is secured using HTTPS backed by the green padlock symbol? . Not if you’re informed enough to understand what HTTPS signifies (an encrypted, secure connection with a server) and doesn’t signify (that the server is therefore legitimate). This week the FBI issued a warning that too many web users view the padlock symbol and the ‘S’ on the end of HTTP as a tacit guarantee that a site is trustworthy. The link for this article located at NakedSecurity is no longer available. . Not if you’re informed enough to understand what HTTPS signifies (an encrypted, secure connection . would, trust, website, simply, because, connection, secured, using, https, backed. . LinuxSecurity.com Team
Jun 12, 2019
•
Cryptography
81
user awarenessonline privacyprivacy issuesExploring Data Exploitation Post-#DeleteFacebook Risks and Concerns
Did you #DeleteFacebook in 2018? Caring about our online privacy might be popular right now, but on a wider level, it’s not as easy as we think to escape the hole we’ve dug ourselves into. . Don’t believe that this is more of a trend than a turning point? Just look at the difference between hype and action. Despite 26 percent of Pew poll respondents saying they’ve deleted the Facebook app, the company’s user stats have stayed essentially the same. The link for this article located at The Next Web is no longer available. . Uncover the challenges of avoiding personal data misuse following the #DeleteFacebook movement and the ongoing concerns regarding digital privacy in contemporary society.. Data Exploitation, Online Privacy, Social Media Impact, Digital Footprint. . LinuxSecurity.com Team
Jan 02, 2019
•
Privacy
83
social engineeringsecurity breachphishingUnderstanding User Behavior: Seven Ways Users Compromise Security
Common knowledge has it that users are the weakest link in the IT risk management world. Many of their methods involve just a little bit of psychological sleight of hand because phishing and social engineering tend to play a part in most attacks. Here are some of the worst ways users make themselves open to the onslaught.. Many of their methods involve just a little bit of psychological sleight of hand because phishing an. common, knowledge, users, weakest, management, world. . LinuxSecurity.com Team
Apr 21, 2015
•
Hacks/Cracks
81
data privacyuser awarenessprivacy concerns30% of Americans Alter Digital Habits Following Snowden Revelations
Some 30 percent of American adults say they have altered their digital behavior in the wake of Edward Snowden. In Spring 2013, Snowden, a then NSA contractor working for Booz Allen Hamilton, remotely accessed the NSA The link for this article located at ThreatPost is no longer available. . In Spring 2013, Snowden, a then NSA contractor working for Booz Allen Hamilton, remotely accessed th. percent, american, adults, altered, their, digital, behavior, edwar. . LinuxSecurity.com Team
Apr 02, 2015
•
Privacy
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!