Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 157 articles for you...
83
web securitymalware preventionsite integrityWordPress Security: Protecting Against Backdoors and Attacks
Wordfence security researchers recently shed light on an infamous supply chain attack that may have affected as many as 36,000 WordPress websites. Five widely used plugins were infected with malware , which opened a backdoor that allowed attackers to manipulate SEO elements and gain administrative access. This shocking discovery is a necessary warning to developers, administrators, and website owners about the dangers lurking within software supply chains. . Let's examine this discovery and the broader trend it highlights. We'll then provide practical mitigation strategies for securing WordPress against this backdoor and similar threats. Understanding This Recent WordPress Backdoor & Its Impact This attack, announced by WordFence on Monday, June 24, 2024, subtly added backdoors to plugins at WordPress.org. Social Warfare, BLAZE Retail, Wrapper Link Elementor, and Contact Form 7 Multi Step Addon are among the plugins affected. This malicious act is not a benign event. It indicates the introduction of unauthorized administrative accounts, SEO spamming, and power plays by unknown actors. This attack is a wake-up call for developers and admins who have worked hard to build and maintain plugins and could see their reputations tarnished in an attack. Victims face the risk of data breaches or SEO penalties and will be left scrambling to restore the integrity of their websites. This threat reinforces that no one in the WordPress community is immune from such sophisticated supply-chain attacks. The Broader Trend: Rising Supply-Chain Attacks Supply-chain attacks are among today's most dangerous cyber threats because of their insidious nature. These attacks are not direct but instead target trusted software repositories. They can have a more significant impact on users who install or update the software. The WordPress ecosystem narrowly avoided disaster this year when a backdoor in the XZ Utils library code was discovered moments before its widespread release. Anotherrecent supply-chain attack was reported by security companies Checkmarx and Datadog. To infect devices, the malicious actors behind this campaign distributed Trojanized versions of open-source software through NPM and GitHub. The package @0xengine/xmlrpc masqueraded as an official JavaScript implementation, but it contained a backdoor that activated malicious codes, allowing attackers to steal credentials and sensitive information, including SSH keys and AWS access keys. This malware campaign resulted in 390,000 WordPress credentials being stolen. It has continued to persist due to its subtlety. Multiple factors can be blamed for this escalation of supply-chain attacks. Interconnectivity between software components and open-source libraries makes it possible to exploit many touchpoints. The sheer volume of code also makes it impossible to monitor every line, especially since stealthy malware can lay dormant for long periods and escape detection. Infiltration opportunities increase as software development tools and techniques become more complex. How Can I Fortify WordPress Against These Threats? Protecting a WordPress install requires a multifaceted approach that includes preventive measures and rapid response protocols. Here are a few actionable steps for improving WordPress security : Install Cautiously: Before installing any plugin or theme, it is essential to conduct a thorough review. Check out the developer's track record, update history, and feedback from other users. Regular Audits: Conduct regular security audits on your WordPress site. Scan for unauthorized file changes, rogue accounts, and suspicious log activity. Reduce the number of plugins to those you need: The more plugins you have, the greater your attack surface. Update protocols: Stay current with the latest updates, but be cautious. Verify updates from multiple sources and test new versions in staging environments. Keep regular site backups: Maintaining regular site backupswill allow you to restore your website to a secure state in case of a breach. Implement Security Plugins and a Firewall: Use security plugins such as firewalls and vulnerability scanners. WPScan is a valuable tool for Linux admins who want to protect WordPress sites against malware and other persistent threats. WPScan scans for malware and other risks to WordPress sites, allowing admins to find issues like outdated plugins, weak passwords, and vulnerable themes that need to be fixed. The installation is simple and quick, and the vulnerability database is updated regularly to keep administrators safe from new threats. User Permission Control: To minimize internal exploits, limit administrative privileges to trusted individuals, and implement role-based access controls. Developer Vigilance: Developers should monitor their environments for irregularities and use robust authentication mechanisms, like two-factor authentication, to prevent their accounts from being the weakest link. Our Final Thoughts on Securing WordPress Sites Against Backdoors & Hacks WordPress site owners are more responsible than ever for their online presence. The recent supply chain backdoor intrusion into WordPress plugins was not an isolated incident but part of a worrying trend in cyber threats. The discovery of this backdoor has highlighted the need to tighten security measures in general. WordPress users can better protect their sites from high-caliber hacks by educating the community and implementing robust cybersecurity measures. This will help ensure their sites remain secure and accessible amidst heightened cyber risk. . Given recent revelations about WordPress backdoor breaches, it's crucial to explore their impacts and find effective ways to bolster your website’s security against such threats. WordPress Security,Supply Chain Attack,Plugin Security,Malware Protection. . Brittany Day
Dec 17, 2024
•
Hacks/Cracks
81
web securityopen sourcesecurity featuresDiscover LibreWolf: Enhanced Privacy Over Firefox for Safe Browsing
Privacy and security are top concerns for many internet users today. With data breaches, tracking, and surveillance threats seemingly everywhere online, finding a web browser that truly protects your information is critical. . This article examines LibreWolf , a rising privacy-focused browser built on Firefox that aims to give users control, security, and peace of mind each time they go online. For sysadmins, infosec professionals, and open source enthusiasts who value privacy, understanding LibreWolf's protections and how it stacks up to other alternatives like Firefox can be useful in determining the best browsing experience. By stripping away potential privacy risks, enabling security by default, and putting user control first, LibreWolf makes a compelling case as a go-to browser for those who desire freedom and safety online. This article details how LibreWolf accomplishes this through its features, configurations, and community philosophies. For readers looking to take control of their web browsing data and activity, LibreWolf presents a promising option worth consideration. What Is LibreWolf? LibreWolf is a fork of the popular open-source Firefox browser created by the privacy-focused community at wolvic.org. The LibreWolf project began in 2020 with the goal of creating an enhanced version of Firefox that better protects user privacy and blocks online trackers by default. LibreWolf is based on Firefox but configured with stricter privacy defaults right out of the box. The developers have tweaked hundreds of settings and preferences to optimize LibreWolf for privacy protection over convenience or compatibility. For example, it ships with total cookie protection enabled, blocks fingerprinting scripts, and disables telemetry/data collection. While Firefox focuses on balancing privacy, usability, and compatibility, LibreWolf puts privacy first, even if it impacts website functionality. The developers believe that with the rise of online tracking, a hardened browser is needed to give users morecontrol over their data. LibreWolf caters to privacy-conscious individuals like security experts, activists, journalists, and those concerned about their digital footprint. LibreWolf's Privacy Features LibreWolf was created to provide a stronger privacy browser than even Firefox, and it includes some key protections built-in by default. For example, LibreWolf automatically enables protections against fingerprinting, which prevents websites and ad companies from gathering info about your browser settings to track you across the internet. This includes default protection from canvas, font, and WebGL fingerprinting. LibreWolf also includes "Total Cookie Protection" turned on, which isolates cookies to the specific website that created them to prevent tracking. No third-party cookies are allowed to develop cross-site tracking profiles. Additionally, LibreWolf has extremely strict tracking protection enabled for all windows that block a wide array of known trackers, analytics scripts, pixels, cookies, cryptominers, and more. Only content deemed essential for sites to function properly is allowed through. This gives you private browsing-like tracking protection always without having to open a private window. Beyond that, LibreWolf disables telemetry and data collection, meaning none of your browsing data is sent back to Mozilla or anywhere else. It also disables Pocket by default, Mozilla's built-in article recommendation system that can monitor your browsing to suggest content. How Does LibreWolf Compare to Firefox? LibreWolf is based on Firefox but takes privacy and security to the next level. While Firefox has some enhanced privacy features compared to other major browsers like Chrome, LibreWolf goes much further. Some key differences in privacy protections include: LibreWolf blocks over 3000 trackers and ads by default compared to a couple hundred blocked in Firefox. This prevents far more user data collection and tracking. Fingerprinting protections are stricter in LibreWolf,making it much harder for sites to identify and track users. Firefox allows some crypto miners and social media trackers, while LibreWolf blocks these. LibreWolf enables encrypted SNI by default to prevent ISPs from seeing what websites you visit. Firefox does not. The privacy-focused search engine DuckDuckGo is set as the default in LibreWolf rather than Google for Firefox. So, in summary, LibreWolf takes Firefox's enhanced privacy and cranks it up significantly more through stricter defaults, block lists, and anti-tracking protections. For those prioritizing privacy, LibreWolf keeps users far better protected versus Firefox's more modest privacy benefits. Additional Privacy Extensions Out of the box, LibreWolf comes with strong privacy protections, but users can further enhance their privacy by installing additional extensions. Two of the most popular and effective options are NoScript and Privacy Badger. NoScript is designed to block malicious scripts and cross-site tracking on websites. It prevents JavaScript, Java, Flash, and other plugins from running unless explicitly authorized by the user. This protects against many drive-by download attacks and tracking methods. NoScript takes a default-deny approach, so users must whitelist the domains and scripts they trust on each site. This provides excellent protection, albeit with more hands-on management required. Privacy Badger was created by the Electronic Frontier Foundation (EFF). It utilizes heuristic analysis to detect and block user tracking, advertisements, and other objectionable content. The extension "learns" over time to identify and block invisible trackers without any configuration required by the user. Privacy Badger only blocks domains that appear to track the user across multiple sites based on its algorithms. This makes it less strict than extensions like NoScript but also easier to use. By combining the embedded protections in LibreWolf with stringent extensions like NoScript and Privacy Badger, userscan browse the web with confidence that their privacy is strongly guarded. The extensions complement LibreWolf's built-in features, providing customizable layers of added privacy. Security Benefits LibreWolf aims to provide robust security protections right out of the box. It blocks known malicious sites, shields you from phishing attempts, prevents fingerprinting, and more. Some key security features include: Blocks are known malware sites through disconnect.me's list of over 5000 tracking and malicious domains. This helps protect users from accidentally visiting dangerous sites that distribute malware. Enforces HTTPS Everywhere by default to ensure connections are encrypted wherever possible. Unencrypted HTTP sites are increasingly being used for malware attacks and surveillance. Disables WebRTC by default to prevent IP address leakage that could allow sites to gather information about your location and connection details. Shutting this potential data leak down improves privacy. Includes privacy-focused configurations for permissions to limit how much access websites have to things like your location, camera, microphone, and more. This reduces the surface area for potential misuse. It ships with several privacy extensions preinstalled, like Cookie AutoDelete, to purge tracking cookies automatically after each browsing session. Limiting cookies reduces how much sites can monitor your online activity and build profiles. Overall, LibreWolf aims to limit any unnecessary exposure through malicious sites, unsecured connections, tracking technologies, and excessive permissions. The browser tries to be secure and privacy-preserving right out of the box without any tricky configuration needed. For users who want enhanced protection beyond Firefox with less effort, it delivers. Performance and Customization LibreWolf aims to provide a balance between privacy, security, and performance. Regarding speed, LibreWolf leverages the performance optimizations present in Firefoxwhile limiting some convenience features that can impact speed. Overall, benchmarks show LibreWolf's performance is on par or slightly faster than Firefox in most scenarios. Memory usage is also comparable to Firefox. LibreWolf's hardened security does require some additional background processes that can increase RAM usage slightly, but overall it remains lightweight. Those wanting to maximize performance can tweak LibreWolf's configuration for lower memory usage. One of LibreWolf's advantages is extensive customization options inherited from Firefox. Users can customize the interface, change default search engines, modify toolbars, and install additional add-ons. LibreWolf makes it easy to mold the browser to suit your specific needs and preferences. The customization options strike a balance between usability and privacy. Overall, LibreWolf delivers solid performance while still providing hardened privacy protections. Users who value both privacy and speed will find that LibreWolf meets their needs. The open-source project leverages Firefox's optimizations and provides ample customization options suited for power users. Downsides and Limitations LibreWolf lacks full compatibility with some websites and web apps compared to the more mainstream Firefox browser. This is partly due to LibreWolf's hardened privacy and security defaults that can break certain sites. LibreWolf also has a much smaller user base and contributor community than Firefox. This means individual users may need to troubleshoot issues themselves without as much support available. While LibreWolf strives for maximum privacy, there are still some weaknesses that privacy-focused users should be aware of. LibreWolf doesn't provide protection against browser fingerprinting, unlike Tor Browser, which uses fingerprinting resistance techniques. LibreWolf still relies on central authorities for TLS certificates rather than using certificate pinning. So there's room for improvement regarding anti-tracking and traffic analysis protections. Overall, LibreWolf prioritizes user privacy at the expense of convenience and compatibility in some cases. For those wanting a hardened browser optimized for privacy over everything else, LibreWolf is a great option. But more casual users may prefer sticking with Firefox for greater app support and less hassle while still getting solid privacy protections. Who Should Use LibreWolf? LibreWolf is a great option for users who prioritize privacy and security in their web browsing. However, it does require some sacrifices in convenience compared to mainstream browsers like Chrome or even Firefox. LibreWolf removes a lot of questionable default settings present in Firefox in order to enhance user privacy. This means some websites or web apps may not work properly out of the box. Configuring site permissions and toggling certain protections on and off will likely be required for full functionality on some sites. In general, LibreWolf is ideal for technically inclined users who understand the privacy tradeoffs and are willing to tweak settings to get websites to work properly. Casual users who just want things to work seamlessly without any configuration may find LibreWolf frustrating at times. LibreWolf also receives updates less frequently than Firefox, so it may occasionally fall behind in supporting the latest web technologies and standards. For users who depend on always having the most up-to-date browsing experience for development or testing purposes, this could be a drawback. Overall, LibreWolf best suits privacy-focused power users who are technically skilled enough to handle the occasional hassle of configuring site permissions or toggling protections off. It offers unmatched protection against trackers and fingerprinting for those willing to work through any minor usability challenges that arise. Our Final Thoughts on Using LibreWolf for Secure & Private Browsing The niche LibreWolf browser offers an admirable commitment to user privacy and security. Based on Firefox but with tighteneddefaults, it blocks tracking by default while permitting flexibility via user configuration. Though not for everyone, LibreWolf caters to the minority of users concerned foremost with enhanced privacy. By enabling privacy protections by default that users would otherwise need to configure manually, LibreWolf makes private browsing more accessible. Its preconfigured settings raise the bar for out-of-the-box privacy while allowing power users to customize further as desired. While the more limited configuration options and lack of full Firefox add-on support may frustrate some, this tradeoff boosts privacy and security. Ultimately, LibreWolf succeeds in its mission to deliver a no-nonsense, privacy-focused browsing experience. While more research is needed, its independent security audits and a fundamental commitment to user privacy set LibreWolf apart. For users who prioritize privacy above all else, LibreWolf presents a compelling choice as an alternative to Firefox. . This article examines LibreWolf, a rising privacy-focused browser built on Firefox that aims to give. privacy, security, concerns, internet, users, today, breaches, tracking. . LinuxSecurity.com Team
Jan 04, 2024
•
Privacy
82
encryptionweb securitybrowser securityArticle 45: Assessing Risks to EU Web Security and User Privacy Concerns
The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from enforcing modern security requirements on certain CAs without the approval of an EU member government. Which CAs? . Specifically, the CAs that were appointed by the government, which in some cases will be owned or operated by that selfsame government. That means cryptographic keys under one government’s control could be used to intercept HTTPS communication throughout the EU and beyond. This is a catastrophe for the privacy of everyone who uses the internet, but particularly for those who use the internet in the EU. Browser makers have not announced their plans yet, but it seems inevitable that they will have to create two versions of their software: one for the EU, with security checks removed, and another for the rest of the world, with security checks intact. We’ve been down this road before when export controls on cryptography meant browsers were released in two versions: strong cryptography for US users and weak cryptography for everyone else. It was a fundamentally inequitable situation, and the knock-on effects set back web security by decades. Read what LinuxSecurity.com Founder and Linux Security expert Dave Wreski has to say about the implications of this proposed regulation in a new LinkedIn update. . Investigating the impact of Article 45 on digital safety and personal data protection for online users within the European Union framework.. Web Security Regulations, Certificate Authorities EU, Privacy Encryption Laws, Internet Governance Compliance. . Brittany Day
Nov 08, 2023
•
Government
78
firefoxweb securitybrowser securityFirefox 90 Release for Linux: FTP Removal and New Security Features
Mozilla Firefox 90 is now available to Linux users for download, removing built-in FTP (File Transfer Protocol) support, and introducing support for Fetch Metadata Request Headers, a security feature that lets web apps protect themselves and you against various cross-origin threats, such as cross-site request forgery (CSRF), cross-site leaks (XS-Leaks), or speculative cross-site execution side channel (Spectre) attacks. . The biggest change in the Mozilla Firefox 90 release is the deprecation of FTP (File Transfer Protocol) support. Firefox follows on the footsteps of Google Chrome/Chromium, and other web browsers, to no longer allow access to ftp:// links. Mozilla started deprecating FTP support since Firefox 88 , but users where able to re-enable the feature by setting the network.ftp.enabled option from false to true in about:config. But starting with the Firefox 90 release, all FTP code is now gone forever and can’t be re-enabled, which means that you’ll have to use a special app to access your FTP sites. The link for this article located at 9 to 5 Linux is no longer available. . Mozilla Firefox 91 has been released for users on Linux platforms, discontinuing FTP functionality and improving web protection with several new capabilities.. Firefox Update, Linux Security, Web Application Protection. . LinuxSecurity.com Team
Jul 14, 2021
•
Vendors/Products
81
web securityopen sourcelinuxUsing Tor Browser On Linux: Enhance Your Privacy Online
Want to protect your privacy online? Here's how to get started with Tor browser, a free and open-source web browser that helps you browse the web anonymously. . Web browsers are usually quite identical to their counterparts in terms of appearance and functionality. However, Tor Browser is one such browser that stands apart from your regular day-to-day web browser. While it is usually linked to the deep or dark web, there is more to it than what meets the eye. So, how is Tor Browser different, and should you consider using it? If yes, then how can you start using it securely on Linux? Let's find out. . Follow these crucial steps for a secure browsing experience on Linux with Tor Browser: download, verify, install, launch, connect, adjust settings, and stay vigilant. Tor Browser, Linux Privacy, Anonymous Browsing, Online Security. . LinuxSecurity.com Team
Jun 07, 2021
•
Privacy
67
web securitydata privacybrowser securityGoogle Chrome for Linux Adds DNS-Over-HTTPS Support: Key Details
Google Chrome for Linux is getting DNS-over-HTTPS, but there's a catch! Learn the details in this article. . Google Chrome developers have announced plans to roll out DNS-over-HTTPS (DoH) support to Chrome web browser for Linux. DoH has been supported on Google Chrome for other platforms, including Windows, Mac, ChromeOS, and Android, since at least 2020. While the exact version of Chrome for Linux that would come out with DoH support is yet to be announced, the Chromium project expects either M91 or M92 to contain the feature. . Mozilla Firefox on Windows is poised to implement enhanced privacy features, bolstering user data protection while raising important questions.. DNS-over-HTTPS, Chrome Linux, web security, browser feature, data privacy. . LinuxSecurity.com Team
Mar 31, 2021
•
Cryptography
67
security advisoryweb securityprotocol changesTLS 1.0 And 1.1 Support Extended Due To COVID-19 Impacts
COVID-19 is forcing browser makers including Google and Mozilla to continue supporting the TLS 1.0 and TLS 1.1 protocols. . In one of the strangest stories of the year, the COVID-19 virus has halted plans by major browsers to drop support for the ageing and insecure Transport Layer Security (TLS) 1.0 and 1.1 protocols. Mozilla Firefox and Google’s Chrome developers sneaked out the move in recent days with only Microsoft Edge team bothering toformally announce the sudden reprieveon Tuesday. In fairness, with COVID-19 throwing development schedules into minor chaos browser development teams probably have other things on their minds right now anyway. While a temporary delay, it’s still an unexpected retreat for an industry which had showed unity in collectively deciding to banish TLS 1.0 and the lesser used TLS 1.1 by early 2020. The link for this article located at Naked Security is no longer available. . The pandemic has paused the intentions of leading web browsers to phase out support for older TLS versions 1.0 and 1.1, postponing vital security enhancements.. TLS Protocol Support, Browser Development, Web Security Standards. . LinuxSecurity.com Team
Apr 02, 2020
•
Cryptography
78
data protectionweb securityprivacyGoogle's Privacy Initiative: Ending Third-Party Cookies in Chrome
Are you a privacy-conscious Google Chrome user? Google doesn’t want to block third-party cookies in Chrome right now. It has promised to make them obsolete later, though. Wait – what? . The search engine giant gave us the latest update this week in the journey towards what it says will be a more private, equitable web. It announced this initiative, known as the Privacy Sandbox, in August 2019. It wants to make the web more private for users, it said. The discussion about online ads and privacy revolves around cookies because they’re what support many predatory advertising models today. It works like this: you visit a website and it puts a small file on your hard drive. This cookie contains information about the session – when you visited, what you looked at, what IP address you came from, and so on. The link for this article located at Naked Security is no longer available. . Mozilla is set to implement changes to Firefox that will phase out third-party tracking scripts, focusing on user security and privacy online.. Google Chrome, Privacy Sandbox, data protection, online security. . LinuxSecurity.com Team
Jan 16, 2020
•
Vendors/Products
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!