Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Security Vulnerabilities 
cisa kev vulnerability prioritization
cisa kev vulnerability prioritization Most Linux teams don't struggle to find vulnerabilities anymore. They struggle to decide which ones deserve attention first. Between daily scanner results, vendor advisories, and hundreds of new CVEs each month, the challenge isn't visibility—it's prioritization. . To solve this, organizations typically lean on the National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities Catalog. But these aren’t competing lists. They answer two entirely different questions. While the...
Jul 22, 2026
Desktop Securitysecurity advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 3 articles for you...
78
security advisorydata theftconsumer electronicsDiscovering Security Flaws in Internet-Ready TVs Leads to Data Theft
New York: Researchers at Mocana are being troubled with their recent discovery of an easy way of hacking into a best-selling internet-ready HDTV model. The security technology company in San Francisco easily discovered a loop hole in the software that shows Web sites on the TV and used that as an opportunity in order to gain a control on the information being sent to the television. . By doing this, it becomes a cakewalk for them to put up a fake screen for a site like Amazon.com and then request for a credit card billing detail regarding the purchase made. This strategy also enables them to monitor data being sent from the TV to sites, reports Ashlee Vance from the New York Times. "Consumer electronics makers as a class seem to be rushing to connect all their products to the Internet," said Adrian Turner, Mocana's chief executive. "I can tell you for a fact that the design teams at these companies have not put enough thought into security.". By doing this, it becomes a cakewalk for them to put up a fake screen for a site like Amazon.com and. researchers, mocana, being, troubled, their, recent, discovery. . LinuxSecurity.com Team
Dec 28, 2010
•
Vendors/Products
83
phishingweb vulnerabilitiesssl certificateJacob Appelbaum's SSL Certificate Trick and Associated Risks
On the Noisebridge hacker mailing list, security specialist Jacob Appelbaum has published an SSL certificate and pertinent private key that together allow web servers to avoid triggering an alert in vulnerable browsers - irrespective of the domain for which the certificate is submitted. Phishers, for example, could use the certificate to disguise their servers as legitimate banking servers . For his trick, Appelbaum modified the certificate according to the method demonstrated by Moxie Marlinspike at the Black Hat conference, entering a zero character (\0) in the name field (CN, Common Name). Unlike Marlinspike, however, Appelbaum didn't enter the zero between the domain name and the name of Marlinspike's thoughtcrime.org domain. Instead, he entered *\00thoughtcrime.noisebridge.net, effectively creating a wild card certificate for arbitrary domain names: The link for this article located at H Security is no longer available. . The misuse of SSL certificates allows potential threat actors to mask malicious servers as authentic, creating considerable dangers.. ssl certificate, phishing attack, browser exploits. . LinuxSecurity.com Team
Sep 30, 2009
•
Hacks/Cracks
82
network securitydos attackonline threatsDenial-of-Service Attacks Impact Estonia's Government Sites
Many of Estonia's government agencies are still unreachable via the Web today after hackers launched denial-of-service attacks that rendered many of their sites useless over the weekend. . The DOS attacks are presumed to be extensions of Russian nationalists' protests against the Estonian government, which have resulted in one death, more than 150 injuries, and 1,100 arrests over the last few days. The link for this article located at Dark Reading is no longer available. . The DOS attacks are presumed to be extensions of Russian nationalists' protests against the Estonian. estonia's, government, agencies, still, unreachable, today, hackers, launched. . Brittany Day
May 01, 2007
•
Government
83
data breachrisk assessmentsecurity surveyWeb Security Survey Finds 70% of Websites at High Risk of Breaches
The security vendor today is touting its yearlong survey of 3,200 Web sites that purportedly shows 70% of them contained vulnerabilities that pose a medium- to high-level risk of an important data breach. "Without sounding apocalyptic, I believe the 70% figure should send tremors not just ripples in the market," says Kevin Vella, vice president of sales and operations, sounding apocalyptic in a press release. . I forwarded the release to my go-to guy on all security matters, Joel Snyder, a stalwart in the Network World Lab Alliance and senior partner at Opus One in Tucson, Ariz. "This is just sensationalist nonsense, not credible on its face, and dishonest in its goal of inspiring fear," Snyder says. And he's willing put his money behind his mockery. The link for this article located at NetworkWorld is no longer available. . I forwarded the release to my go-to guy on all security matters, Joel Snyder, a stalwart in the Netw. security, vendor, today, touting, yearlong, survey, sites, purportedly, shows. . LinuxSecurity.com Team
Feb 16, 2007
•
Hacks/Cracks
77
security risksattack vectorssecurity awarenessExploring CSRF Attacks to Enhance Web Application Security Awareness
You know about cross-site scripting (XSS). It's an attack that injects malicious code into a vulnerable application such that the code executes in the victim's application viewer and, therefore, with the victim's session privileges. In most cases, the viewer is a web browser and the malicious code is written in JavaScript. (XSS won over the arguably more correct abbreviation "CSS" because of confusions with an unrelated term Cascading Style Sheets.) In theory, the victim's viewer could be another application, rather than a web browser. Imagine a vulnerable website that accepts code as input from the attacker and, without properly filtering on input or output, incorporates the code into a spreadsheet that the victim views in Excel. If the attacker could find a way to supply code that Excel will execute, then we have an instance where an XSS attack targeted a non-web browser. . I suppose we could call this a cross-application cross-site scripting (XAXSS) attack. (I wouldn't want to suggest the abbreviation "CAXSS" because then people could confuse it with the term Computer Assisted X-ray Screening System.) XSS has been discussed for a while. Even though the mechanisms of such attacks are well-understood, XSS vulnerabilities continue to plague many web-based applications. SecurityFix mentioned a number of popular sites that have had XSS holes. The link for this article located at SANS is no longer available. . Grasp the intricacies of XSRF/CSRF assaults in online platforms and comprehend how they are distinct from XSS.. CSRF Vulnerability, Web Security Risks, Cross-Site Request Forgery. . LinuxSecurity.com Team
Oct 03, 2006
•
Server Security
77
security flawinput validationmitigationUnvalidated Input Threats In Web Applications: Mitigation Strategies
According to the OWASP Guide, unvalidated input is the most common weakness found in web applications. Tainted input leads to almost all other vulnerabilities in these environments (OWASP, 2005). Before we look at how to prevent this weakness from spreading throughout your web solutions, let. The link for this article located at Infosec Writers is no longer available. . The link for this article located at Infosec Writers is no longer available. . according, owasp, guide, unvalidated, input, common, weakness, found, application. . LinuxSecurity.com Team
Jun 28, 2006
•
Server Security
79
application securityweb vulnerabilitiesOASISOASIS AVDL 1.0 Standard Ratified to Fortify Web Application Security
OASIS addressed another layer of security concerns around Web services Wednesday when it ratified the Application Vulnerability Description Language (AVDL) 1.0 as a standard, the organization's highest level of ratification. AVDL is an XML schema that enables security products to communicate information about new and existing Web application vulnerabilities between themselves, according to AVDL Technical Committee co-chairman Kevin Heineman. . . .. OASIS addressed another layer of security concerns around Web services Wednesday when it ratified the Application Vulnerability Description Language (AVDL) 1.0 as a standard, the organization's highest level of ratification. AVDL is an XML schema that enables security products to communicate information about new and existing Web application vulnerabilities between themselves, according to AVDL Technical Committee co-chairman Kevin Heineman. "This is plugging a pretty big need," said Heineman, who is also the vice president of engineering services at application security software and service provider SPI Dynamics Inc. of Atlanta. SPI Dynamics products are already AVDL compliant, as are similar offerings from NetContinuum Inc. of Santa Clara, Calif., which sells application security gateway software, and Citadel Security Software Inc. of Dallas, which sells vulnerability management software. NetContinuum and Citadel also have representatives on the AVDL TC. Research firm Gartner Inc. said close to 80 new application vulnerabilities are announced every week. The AVDL spec takes a step toward reducing the threat posed by the rapidly closing window between the time a vulnerability is announced and when hackers have an exploit ready. "In the past, there was no good way for customers to do assessments of Web applications to find vulnerabilities and act on them," Heineman said. "With AVDL, customers can now have a seamless way to find vulnerabilities." The link for this article located at techtarget.com is no longer available. . ISO has ratified HDXN 2.5 to enhanceprotection measures targeting mobile software weaknesses.. Application Security, AVDL, Web Application Standards. . LinuxSecurity.com Team
Jun 24, 2004
•
Security Projects
81
data protectionidentity theftprivacy concernUnderstanding Privacy Risks: Protecting Against Scams And Identity Theft
It starts out innocently enough. You're browsing the Web, dreaming of the weekend and your next golf game, and you happen across a great-looking site that promises to drop your handicap in three easy lessons. Sounds good, but you've got . . . . It starts out innocently enough. You're browsing the Web, dreaming of the weekend and your next golf game, and you happen across a great-looking site that promises to drop your handicap in three easy lessons. Sounds good, but you've got a meeting in 5 minutes, so you hastily sign up for the site's weekly newsletter and dash off. When the newsletter arrives several days later, however, it's not alone. Every day, more and more new spam crams your mailbox, hawking Caviar Quarterly subscriptions or pitching wild weekends in Las Vegas. Who knew one newsletter would have so many pushy friends--and who invited them in the first place? Companies that collect facts about you often have obscure data-handling practices, so your name, address, and account numbers could end up spreading across the Web faster than a cold at a corporate retreat. Your problems don't stop there--you also have to guard against ever more sophisticated scammers and hackers who are out to steal your identity or your company's data. And studies show that these problems keep getting worse both for individuals and for businesses. The link for this article located at PCWorld is no longer available. . Investigate prevalent privacy issues in today's online world. Protect your information from intrusive advertising and identity fraud.. Online Privacy, Data Protection, Identity Theft Awareness, Digital Safety. . LinuxSecurity.com Team
Oct 22, 2003
•
Privacy
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!