Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Server Security
security practices application security
security practices application security Accepting file uploads is basically inviting strangers to throw random objects through your front window and hoping your living room furniture catches them. Whether it's profile pictures, PDF invoices, or archive files, handling raw uploads means you're trusting external input to behave. . The file sitting on your disk isn't actually the threat. A malicious JPEG doesn't execute code just by existing in a directory. The real danger is the parser—the image library, the unmanaged C-based PDF...
Jul 27, 2026
Security Vulnerabilities email security Linux server
email security Linux server You've probably trained your team to look for red flags. Odd sender names, urgent language, mismatched links. But a well-crafted spoofed email won't trip any of those wires. It looks legitimate, sounds legitimate, and often comes from a domain that passes every automated check you throw at it. . Attackers know exactly how humans scan an inbox. They design around it. This guide walks you through the techniques attackers use to slip a spoofed email past both your filters and your users and what...
Jul 25, 2026
Security Vulnerabilities cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 1 articles for you...
79
arbitrary code executionsecurity flawdata theftPoet Tool: Data Theft via JavaServer Faces Security Flaw
Researchers have released software that exposes private information and executes arbitrary code on sensitive websites by exploiting weaknesses in a widely used web development technology.. Short for Padding Oracle Exploitation Tool, Poet is able to decrypt secret data encrypted by the JavaServer Faces web development framework without knowing the secret key. Attackers can use the technique to access private customer data on websites operated by banks, e-commerce companies and other businesses, according to a paper (PDF) released in February by researchers Juliano Rizzo and Thai Duong. In some cases, the exploit can be used to run malicious software on the underlying server. Released Monday, Poet exploits a well-known vulnerability in the way many websites encrypt text stored in cookies, hidden HTML fields and request parameters. The text is designed to help servers keep track of purchases, user preferences and other settings while at the same time ensuring account credentials and other sensitive data can't be intercepted. By modifying the encrypted information and sending it back to the server, the attackers can recover the plaintext for small chunks of the data, allowing them to access passwords and restricted parts of a webserver. The link for this article located at The Register UK is no longer available. . Study uncovers Poet, a mechanism for unveiling encrypted information on vulnerable platforms, highlighting dangers within JavaServer Faces architecture.. Poet Tool, JavaServer Faces Security, Data Breach Risks. . LinuxSecurity.com Team
Jun 09, 2010
•
Security Projects
83
malwarevulnerabilitysecurity breachCyber Attack on WordPress Sites Hits DreamHost GoDaddy Bluehost
According to various reports, in the past few days a number of websites created using WordPress have been hacked. While the attack initially appeared to be limited to web sites hosted by American ISP DreamHost, it has since become apparent that blogs hosted at GoDaddy, Bluehost and Media Temple have also been affected. . Unconfirmed reports by WPSecurityLock suggest that other PHP-based management systems, such as the Zen Cart eCommerce solution, have also been targeted. The hacked web pages appear to have been infected with scripts, which not only install malware on users' systems, but also prevent browsers like Firefox and Google Chrome, which use Google's Safe Browsing API, from issuing an alert when users try to access the page. When Google's search bot encounters such a specially crafted page, the page responds by simply returning harmless code. This camouflage strategy takes advantage of the browser switch normally used by developers to return browser specific code to suit functional variations in different browser, such as Internet Explorer and Firefox. The link for this article located at H Security is no longer available. . Widespread cyber attacks have targeted Joomla platforms hosted on various service providers, raising alarm about potential vulnerabilities.. WordPress Security, Malware Attack, Web Exploitation, ISP Threat, PHP Exploitation. . LinuxSecurity.com Team
May 10, 2010
•
Hacks/Cracks
83
security issuenetwork attackssl protocolNew SSL Protocol Threat Uncovered by Leviathan Security Group
A Seattle computer security consultant says he's developed a new way to exploit a recently disclosed bug in the SSL protocol, used to secure communications on the Internet. The attack, while difficult to execute, could give attackers a very powerful phishing attack.. Frank Heidt, CEO of Leviathan Security Group, says his "generic" proof-of-concept code could be used to attack a variety of Web sites. While the attack is extremely difficult to pull off -- the hacker would first have to first pull off a man-in-the-middle attack, running code that compromises the victim's network -- it could have devastating consequences. The attack exploits the SSL (Secure Sockets Layer) Authentication Gap bug, first disclosed on Nov. 5. One of the SSL bug's discoverers, Marsh Ray at PhoneFactor, says he's seen a demonstration of Heidt's attack, and he's convinced it could work. "He did show it to me and it's the real deal," Ray said. The link for this article located at Network World is no longer available. . Frank Heidt, CEO of Leviathan Security Group, says his 'generic' proof-of-concept code could be used. seattle, computer, security, consultant, developed, exploit, recently, disclosed. . LinuxSecurity.com Team
Nov 23, 2009
•
Hacks/Cracks
77
POP3 serversecurity breachinternet securityExtended HTML Form Attack on Browser Cookies via POP3 Exploit
An independent network security researcher has uncovered a new way to steal the secret browser "cookies" of Web surfers with the help of Internet servers that were never intended to communicate with browser software. The exploit, described by a researcher who uses the handle "Obscure" and posted on the Eye On Security Web (EOS) site, relies on common Internet server software other than Web servers that can "echo" hijacked submissions from HTML forms.. . .. An independent network security researcher has uncovered a new way to steal the secret browser "cookies" of Web surfers with the help of Internet servers that were never intended to communicate with browser software. The exploit, described by a researcher who uses the handle "Obscure" and posted on the Eye On Security Web (EOS) site, relies on common Internet server software other than Web servers that can "echo" hijacked submissions from HTML forms. In a demonstration of the exploit, which Obscure calls the Extended HTML Form Attack, a POP3 (post office protocol) e-mail server at Ebay was used to divulge the browser cookies of users who had visited the auction giant's Web site. As delivered by some Web sites, browser cookies may contain such private information as user IDs and passwords. The link for this article located at Newsbytes is no longer available. . A new browser cookie theft technique using POP3 servers has been discovered by an independent network security researcher.. Browser Cookie Theft, Network Security Research, Internet Exploitation Techniques. . LinuxSecurity.com Team
Feb 07, 2002
•
Server Security
81
timing attackdata privacybrowser securityTiming Attack: Risks To User Privacy And Data Tracking Techniques
A technique that exploits the way in which Web browsers store recently viewed data could compromise privacy by allowing an attacker to check what sites a Netizen has visited recently. Called a "timing attack," the exploit allows an unethical Web site . . . . A technique that exploits the way in which Web browsers store recently viewed data could compromise privacy by allowing an attacker to check what sites a Netizen has visited recently. Called a "timing attack," the exploit allows an unethical Web site to play 20 questions (or more) with a user's browser and check whether the surfer has recently viewed sites from a predetermined list. "The attacks allow any Web site to determine whether or not each visitor... has recently visited some other site (or set of sites)," said Princeton University computer science professor Edward Felten and graduate student Michael Schneider in a paper published at a technical conference last month. "The attacker can do this without the knowledge or consent of either the user or the other site." The link for this article located at ZDNet is no longer available. . A technique that exploits the way in which Web browsers store recently viewed data could compromise . technique, exploits, which, browsers, store, recently, viewed, compromise. . LinuxSecurity.com Team
Dec 12, 2000
•
Privacy
74
security threatshacking techniquessite securityHow Hackers Exploit Weak Site Security Through Search Engines
"... With a bit of ingenuity, anyone can skirt basic password authentication and go straight to the goodies on those sites where administrators are foolish enough to post them. If the desired information is contained in a Web page, anyone . . .. "... With a bit of ingenuity, anyone can skirt basic password authentication and go straight to the goodies on those sites where administrators are foolish enough to post them. If the desired information is contained in a Web page, anyone can find it." The link for this article located at TheRegister is no longer available. . Uncover the methods utilized by cybercriminals to exploit inadequate online security and simplistic login vulnerabilities through search engines, highlighting major threats.. web exploits, site security issues, online authentication flaws. . Anthony Pell
Jun 05, 2000
•
Network Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!