An overview of targeted attacks and APTs on LinuxKaspersky Securelist·Sep 10, 10:00 UTC · Sep 10, 2020Data breachCVE-2015-511960
First Linux variant of Clop ransomware targeted universities, colleges but was flawedThe Record·Feb 10, 17:22 UTC · Feb 10, 2023Ransomware60
PinTheft: Another Linux Privilege Escalation, Another Working Exploit, This Time Targeting ArchSecurity Affairs·May 20, 20:32 UTC · May 20, 2026Vulnerability in the wild60
Coinminers, web shells and ransomware made up 56% of malware targeting Linux systems in H1 2021Help Net Security·Aug 25, 00:00 UTC · Aug 25, 2021Ransomware60
Halcyon offers ransomware protection for Linux environmentsHelp Net Security·Oct 1, 00:00 UTC · Oct 1, 2024Ransomware60
DirtyDecrypt PoC Released for Linux Kernel CVE-2026The Hacker News·May 20, 04:10 UTC · May 20, 2026Exploit / PoCCVE-2026-31635CVE-2026-31431CVE-2026-43284+4 CVEs60
Linux maintainers were infected for 2 years by SSHArs Technica · Security·May 15, 00:00 UTC · May 15, 2024Exploit / PoC60
IceFire Ransomware Targets Linux Enterprise NetworksInfosecurity Magazine·Mar 10, 16:30 UTC · Mar 10, 2023RansomwareCVE-2022-4798660
Rushed Patches Follow Broken Embargo on Linux Kernel VulnerabilitiesInfosecurity Magazine·May 11, 14:30 UTC · May 11, 2026Vulnerability in the wildCVE-2026-31431CVE-2026-43284CVE-2026-43500160
⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and MoreThe Hacker News·May 11, 12:36 UTC · May 11, 2026Malware in the wildCVE-2026-6973CVE-2026-030060
Critical Linux CUPS Printing System Flaws Could Allow Remote Command ExecutionThe Hacker News·Oct 9, 04:05 UTC · Oct 9, 2024RansomwareCVE-2024-47176CVE-2024-47076CVE-2024-47175+1 CVEs60
Alchimist: A new attack framework in Chinese for Mac, Linux and WindowsCisco Talos·Oct 13, 12:00 UTC · Oct 13, 2022Exploit / PoC in the wildCVE-2021-4034160
Dirty COW — Critical Linux Kernel Flaw Being Exploited in the WildThe Hacker News·Oct 25, 15:07 UTC · Oct 25, 2016Exploit / PoC in the wildCVE-2016-519560
Bad Epoll Flaw Gives Attackers Root Access on Linux and AndroidSecurity Affairs·Jul 6, 08:24 UTC · Jul 6, 2026Exploit / PoC in the wildCVE-2026-46242CVE-2026-4307460
Dirty Frag: Linux kernel hit by second major security flaw in two weeksThe Record·May 11, 12:30 UTC · May 11, 2026VulnerabilityCVE-2026-43284CVE-2026-4350060
CyberArk Identity Bridge manages user access and authentication for Linux environmentsHelp Net Security·Jan 31, 00:00 UTC · Jan 31, 2025Ransomware60
Google Hacker Discloses New Linux Kernel Vulnerability and PoC ExploitThe Hacker News·Sep 28, 08:35 UTC · Sep 28, 2018Exploit / PoCCVE-2018-1718260
Linux Operation Windigo hit 500000 PC and 25000 dedicated serversSecurity Affairs·Aug 6, 20:36 UTC · Aug 6, 2017Exploit / PoC60
Containers on fire: from container escapes to supply chain attacksKaspersky Securelist·Jun 1, 10:00 UTC · Jun 1, 2026Vulnerability in the wildCVE-2019-5736CVE-2022-0492CVE-2024-21626160
U.S. CISA adds a flaw in Linux Kernel to its Known Exploited Vulnerabilities catalogSecurity Affairs·May 4, 10:26 UTC · May 4, 2026Exploit / PoC in the wildCVE-2026-3143160
CISA Adds Actively Exploited Linux Root Access Bug CVE-2026The Hacker News·May 3, 06:26 UTC · May 3, 2026Advisory in the wildCVE-2026-3143160
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for monthsHelp Net Security·May 3, 00:00 UTC · May 3, 2026Vulnerability in the wildCVE-2026-32202CVE-2026-21510CVE-2026-21513+3 CVEs260
Copy Fail: New Linux bug enables Root via page‑cache corruptionSecurity Affairs·Apr 30, 18:23 UTC · Apr 30, 2026Exploit / PoCCVE-2026-31431160
Akira ransomware continues to evolveCisco Talos·Oct 21, 16:50 UTC · Oct 21, 2024Ransomware in the wildCVE-2024-40766CVE-2020-3259CVE-2023-20263+5 CVEs60
Penetration Testing with Kali Linux 2023 released: New modules, exercises, challenges (PEN-200)Help Net Security·Mar 16, 00:00 UTC · Mar 16, 2023Ransomware60
Linux Botnet Adding BlueKeep-Flawed Windows RDP Servers to Its Target ListThe Hacker News·Jul 25, 11:08 UTC · Jul 25, 2019MalwareCVE-2019-11581CVE-2019-10149CVE-2019-0192+3 CVEs60
Linux Kernel Gets Patch For YearsThe Hacker News·Mar 15, 00:00 UTC · Mar 15, 2017Vulnerability in the wildCVE-2017-263660
Week in review: Cisco patches SD-WAN 0-day, unpatched Microsoft Exchange Server flaw exploitedHelp Net Security·May 17, 00:00 UTC · May 17, 2026Vulnerability in the wildCVE-2026-44413CVE-2026-41940CVE-2026-46300+2 CVEs160
New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache CorruptionThe Hacker News·May 15, 00:00 UTC · May 15, 2026Exploit / PoC in the wildCVE-2026-4630060
Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major DistrosThe Hacker News·Jul 4, 12:49 UTC · Jul 4, 2025VulnerabilityCVE-2025-32462CVE-2025-3246360
New Bootkit “Bootkitty” Targets Linux Systems via UEFIInfosecurity Magazine·Nov 27, 16:30 UTC · Nov 27, 2024Exploit / PoC60
Microsoft discovers ‘several’ vulnerabilities affecting Linux desktop endpointsThe Record·Jan 12, 00:00 UTC · Jan 12, 2023Vulnerability in the wildCVE-2022-29799CVE-2022-2980060
Critical Flaws Discovered in Azure App That Microsoft Secretly Installs on Linux VMsThe Hacker News·Sep 17, 19:17 UTC · Sep 17, 2021Exploit / PoCCVE-2021-38647CVE-2021-38648CVE-2021-38645+1 CVEs60
A critical Linux Wi-Fi bug could be exploited to fully compromise systemsSecurity Affairs·Oct 19, 13:45 UTC · Oct 19, 2019VulnerabilityCVE-2019-17666160
Grinch Bug Could be worse than Shellshock, Says ExpertsSecurity Affairs·Nov 5, 23:20 UTC · Nov 5, 2018Exploit / PoC in the wild60
Zerodium offers up to $500,000 for Linux ZeroSecurity Affairs·Jul 1, 12:29 UTC · Jul 1, 2018Exploit / PoC60
⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and MoreThe Hacker News·Jun 29, 14:42 UTC · Jun 29, 2026Malware in the wildCVE-2026-43503CVE-2026-12569CVE-2026-47729+19 CVEs60
Zero-Day Flaw in Linux Kernel Found by AIInfosecurity Magazine·May 1, 10:45 UTC · May 1, 2026Exploit / PoCCVE-2026-3143160
U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs·Jan 27, 14:54 UTC · Jan 27, 2026Exploit / PoC in the wildCVE-2018-14634CVE-2025-52691CVE-2026-21509+2 CVEs60
Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)Help Net Security·Apr 8, 13:25 UTC · Apr 8, 2024VulnerabilityCVE-2024-309460