Kairos botnet infects Linux hosts through passwordless Telnet
Nozomi honeypots saw the same Go binary, which holds thousands of TCP sockets open during each attack.
52
- Mentions · 7d5
- Mentions · 30d14
- All mentions25
- First seenAug 17, 2026
- Last mentioned13h ago
Timeline
25 articles · newest firstKairos DDoS botnet opens idle TCP sessions from Linux hosts
Nozomi says the Go bot arrives over Telnet with an empty root password and has no persistence.
58
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Unreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
74
Runbook hardens shared Linux hosts against cache covert channels
The guide covers KVM, Firecracker and QEMU: separate cores, disable KSM, keep CPU mitigations, and partition L3 with resctrl.
42
AI-Assisted Hackers Compromise Government Linux Servers to Deploy Backdoors and Steal Credentials
Unit 42 says unattributed cluster CL-UNK-1211 backdoored government Linux servers and stole administrator credentials.
74
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Unit 42 says CL-UNK-1211 used AI-assisted scripts to steal Linux sudo passwords from government targets.
76
Epic's EAC2 v2 seems fairly easily bypassable
Matthew Garrett says Epic's Linux Easy Anti-Cheat 2 attestation can be spoofed with a reset or spare TPM.
44
Linux Lockdown and Hibernation (again)
Linux Lockdown blocks hibernation because root can forge swap images that resume into attacker-controlled kernel memory.
46
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets
Xen XSA-522 warns a malicious backend can crash Linux guests via malformed xen-netfront packets, CVE-2026-98375.
52
Show HN: Procinsh – A 3D Linux process inspector
Hacker News features Procinsh, a 3D inspector for visualizing Linux processes.
6
Mission-Aware Attestation Envelopes for Time-Critical Autonomous Action: A Hardware-in-the-Loop V2I Study
Researchers define mission-aware attestation that rejects stale or late integrity evidence on a hardware-in-the-loop V2I platform.
36
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
ClingSTUN, a Linux backdoor, exploits 24 known flaws and turns IoT devices into proxies via public STUN servers.
52
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Citrix NetScaler and Fortinet FortiMail zero-days are under active attack, alongside ransomware arrests and new threat activity.
88
File Notification Attacks Let Hackers Track Keystrokes and Website Visits on Linux, Windows and macOS
Researchers showed file-notification APIs can leak keystrokes and website visits on Linux, Windows, and macOS.
64
Implementing Data Diodes Using Commodity Hardware and Open Source Software
Researchers show commodity fiber gear and open-source software can implement reliable data diodes, releasing pydiode.
40
Other users can watch your browsing and time your keystrokes through OS file notifications
Graz researchers showed local accounts can infer browsing and keystroke timing through OS file notifications.
62
Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
58
File Notification Attacks: Side-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS
CCS paper shows Linux, Android, Windows, and macOS file notifications leak activity without revealing file contents.
63
Decades-old file security flaws found in Android, Linux, macOS, and Windows
TU Graz researchers showed file-notification side channels on Linux, Windows, Android, and macOS leak user activity.
68
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
An oss-security reply discusses packaging limits around four named Linux local root vulnerabilities.
35
Evaluating Coding Agents on Kernel Exploit Generation
KEX-bench finds coding agents rarely turn kernel bugs into exploit primitives without a reference PoC.
58
Flock cameras are riddled with security vulnerabilities and hardcoded creds
Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.
68
CISA Warns of Six Exploited Flaws in Microsoft, Linux, Red Hat and Citrix Products
CISA added six actively exploited vulnerabilities in Microsoft, Linux, Red Hat and Citrix products to its KEV catalog on August 26.
72
Backdoor Xz Utils Linux Open Source
Infosecurity Magazine covers the XZ Utils open-source backdoor, a malicious implant in liblzma that targeted OpenSSH on major Linux distributions.
60
Related CVEs
by mentions- CVE-2025-68788<1%—Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…
- CVE-2025-55182100%10.0Unauthenticated RCE in React Server Components (React2Shell)
- CVE-2026-1042865%9.8Unauthenticated path traversal file write in Fortinet FortiMail
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2021-19052%7.8Use-After-Free in Qualcomm Snapdragon Chipsets Allows Local Privilege Escalation
- CVE-2024-309486%10.0Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0
- CVE-2018-9568<1%7.8In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion
- CVE-2025-277383%6.5Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network
Appears with
- Microsoftvendor · 9
- Androidproduct · 7
- Windowsproduct · 7
- macOSproduct · 6
- Googlevendor · 6
- Applevendor · 6
- Firefoxproduct · 4
- Graz University of Technologyorganization · 4
- WhatsAppproduct · 3
- KDE Plasmaproduct · 3
- CISAorganization · 3
- CL-UNK-1211threat actor · 2
- Palo Alto Networksvendor · 2
- Citrixvendor · 2
- Kairosmalware · 2
- Palo Alto Networksorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.