Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 11 articles for you...
67
security advisorydata theftweb application securityCanonical Snap Store Incident: Investigating Malicious Apps Threat
Several fake cryptography applications have appeared on Canonical's Snap Store . These web application security vulnerabilities seek to steal user funds and inflict other damaging data and network security issues. Canonical is investigating the matter, and access is restricted while investigating the risky cryptography today.. Snap users have reported these recently published Snaps since they are potentially malicious in stealing user funds. The Snap Store has removed the reported risks and incorporated a manual review requirement for new registrations so threat actors cannot impersonate legitimate applications with similar names to manipulate Snap users. Here is the report Canonical’s Snap Store has utilized to notify users: "If you try registering a new snap while the requirement is active, you will be prompted to ‘request reserved name.’ The name will be registered upon a successful manual review from the Snap Store staff. Uploading and releasing revisions for existing snaps will not be affected. We apologize for any inconvenience this may cause our Snap publishers and developers. It is the most prudent action at this moment. We want to thoroughly investigate this incident without introducing any noise into the system. More importantly, we want to ensure that our users have a safe and trusted experience with the Snap Store. Please bear with us while we conduct our investigation. We will provide a more detailed update in the coming days." . Users report malicious apps in Canonical's Snap Store, leading to enhanced security measures being implemented during the ongoing investigation. Malicious Applications,Snap Store Safety,Canonical Security,Data Theft Risks,Web Application Threats. . LinuxSecurity.com Team
Oct 01, 2023
•
Cryptography
209
risk managementsecurity practicesapplication securityEffective Security Management With The OWASP Top 10 Framework
What is the OWASP Top 10, and – just as important – what is it not? In this review, we look at how you can make this critical risk report work for you and your organization. . OWASP is the Open Web Application Security Project, an international non-profit organization dedicated to improving web application security. It operates on the core principle that all of its materials are freely available and easily accessible online, so that anyone anywhere can improve their own web app security. It offers a number of tools, videos, and forums to help you do this – but their best-known project is the OWASP Top 10. The link for this article located at The Hacker News is no longer available. . The OWASP stands for the Open Web Application Security Project, a vital entity dedicated to improving the security of web applications through essential guidelines and frameworks.. owasp top ten, application risks, security practices. . Brittany Day
Oct 14, 2022
•
Security Trends
79
code executionconfiguration managementnginxReducing Code Execution Threats in Nginx with PHP-FastCGI Misconfigurations
Several days ago, I had to deal with a compromised web application: an attacker had somehow managed to upload PHP backdoor scripts onto the application. As I researched the vulnerability a bit more, however, I realized that many of the nginx / PHP setup tutorials found on the Internet suggest that people use vulnerable configurations. The misconfiguration As I mentioned, the attack was made possible by a very simple misconfiguration between nginx and php-fastcgi. Consider the configuration block below, taken from a tutorial at https://www.linode.com/docs/guides/nginx-and-phpfastcgi-on-fedora-14/ The link for this article located at NealPoole is no longer available. . As I researched the vulnerability a bit more, however, I realized that many of the nginx / PHP setup. compromised, application, attacker, somehow, managed. . LinuxSecurity.com Team
Apr 08, 2011
•
Security Projects
67
web application securityencryption attackcrypto vulnerabilitiesPadding Oracle Exploit Tool: Insights and Implications for Web Security
Researchers last week introduced a new penetration-testing tool that makes it possible to capture poorly encrypted Web session data -- such as cookies and HTML parameters. Now they say they're looking into how similar attacks against Web applications can be used to advance attacks against Web-facing databases with sloppy encryption-key deployment.. Demonstrated this spring at Black Hat Europe and officially released last week, the Padding Oracle Exploit Tool (Poet) takes advantage of and automates a side-channel attack called a Padding Oracle Attack, which was introduced to the cryptographic community in 2002. This attack leverages commonly used cryptographic padding oracles that receive cipher text, decrypts it, and replies to the sender whether the padding is valid or invalid. The attack is carried out if attackers can intercept padded messages encrypted in CBC mode, effectively gaining access to encrypted information without a key. "What happens in Web apps is that it is very common for the programmer to send something encrypted to the client/Web browser [and] not to share it with the client, just to store it for some time like cookies, [which] is a perfect scenario to implement what is called 'chosen cipher text attacks,' where the cipher text is modified and [sent] again to the Web application," says Juliano Rizzo, who together with Thai Duong developed Poet. "Poet should help to show that is not easy to implement cryptography correctly, [and] attacks that could look theoretical are very practical and dangerous." The link for this article located at Dark Reading is no longer available. . In today’s digital landscape, the Poet serves as a tool for capturing weakly encrypted data, raising major concerns about web application security and privacy risks. Padding Oracle Attack, Web Application Security, Penetration Testing. . LinuxSecurity.com Team
Jun 16, 2010
•
Cryptography
79
security threatsprogramming errorsIT securityTop 25 Programming Errors Impacting IT Security According to SANS
When it comes to programming errors, some are more common than others. A new report from the SANS Institute identifies the top 25 programming errors that have led to nearly every type of IT security threat over the last year. The report draws on the input of 28 different groups including those in government and the private sector and leverages the CWE (Common Weakness Enumeration) numbering system to label vulnerabilities.. The report follows one done by SANS on the same topic for 2009, and provides similar findings this time around. But while the SANS lists attempt to identify the top programming errors, there is some disagreement when it comes to the top programming errors that Linux developers face. "The takeaway from this list isn't so much that there is anything here that is particularly new or surprising at all," Alex Horan, director of product management at Core Security, said in a e-mail to InternetNews.com. "In fact, what it reinforces is that most organizations, and software/Web app developers, continue to struggle with the same types of security issues that they've been dealing with for years." The 2010 SANS list is structured differently than the 2009 list which provided the top 25 in a list broken down by three categories. For 2010, SANS has also provided a general ranking of the top 25 with Cross Site Scripting (XSS) The link for this article located at CodeGuru is no longer available. . Highlighting the top programming errors from SANS Institute's latest report and their impact on IT security.. programming errors, IT security, software vulnerabilities, SANS report. . LinuxSecurity.com Team
Feb 19, 2010
•
Security Projects
77
security risksinput validationweb application securityAddressing Security Risks in PHP Command Execution Environments
As the Web continues its march towards becoming the de facto interface for the world's software applications, developers must find effective ways to not only communicate with server processes such as MySQL, but also other operating system tools such as a shell or Ruby script. In this tutorial, I'll show you how to securely execute a variety of system-based commands via a PHP script, demonstrating how to build web applications that can tightly integrate with both the operating system and third-party software.. Minding the Security Risks Hopefully, you understand how important it is to thoroughly validate all user input accepted through a web form; after all, if you neglect this task, your data could be stolen or damaged via a SQL injection attack, or your users could be spoofed via a cross-site scripting attack. The risks of not properly vetting operating system commands initiated through a PHP script are no less severe! With this in mind, before jumping into a few examples it's worth taking a moment to understand how this particular feature can pose a significant security risk to not only your web site, but also to the stability of the entire web server. The link for this article located at PHP Builder is no longer available. . Master the art of safely running system commands within PHP while addressing possible security vulnerabilities in web applications and ensuring server reliability.. PHP Security, System Command, Input Validation, Web App Security. . LinuxSecurity.com Team
Jan 29, 2010
•
Server Security
74
attack preventiontraffic managementsecurity tipsEnhance Your Application Security With Quick Tips Against Attacks
A traditional firewall is commonly employed to restrict Web site access to Ports 80 and 443, used for HTTP and Secure Sockets Layer communications, respectively. However, such a device does very little to deter attacks that come over these connections. URL query string manipulations including SQL injection, modification of cookie values, tampering of form field data, malformed requests and a variety of other nasty tricks are often given free passage on allowed, legitimate traffic. Making your Web Application secure is a important feature to implement. This article looks at some quick but important things you can do to improve your application security.. . A traditional firewall is commonly employed to restrict Web site access to Ports 80 and 443, used fo. traditional, firewall, commonly, employed, restrict, ports. . Bill Locke
Jun 05, 2008
•
Network Security
79
web application securityaudit toolweb server scannerWebshag V1.00: A Multi-Platform Python Audit Tool for Web Servers
Webshag is a multi-threaded, multi-platform web server audit tool. Written in Python, it gathers commonly useful functionalities for web server auditing like website crawling, URL scanning or file fuzzing. Fuzzing is always a lot of fun - throw as much pasta against the wall and something is bound to stick (at least that's what my mom would say). This tool provides interesting capabilities such as "retrieving the list of domain names hosted on a target machine and file fuzzing using dynamically generated filenames". Why not check the article out, download the tool, and start throwing some pasta today?. The link for this article located at Darknet.org is no longer available. . Delve into Webshag v1.00, an innovative Python-driven utility designed for meticulous web server analysis and fuzz testing operations.. Webshag, Multi-Platform Scanner, Web Server Security. . LinuxSecurity.com Team
Mar 27, 2008
•
Security Projects
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!