Underground forums share eBPF rootkit code and tutorials
A Russian-language Duty Free guide covers process hiding, magic-packet activation, and AES-256-GCM command-and-control.
Stories per day · 30 days
17 RSS
Relatedkernel20privilege-escalation10vm-escape8kvm7ubuntu7cve-2026-999996android5xen5anthropic4cl-unk-12114credential-theft4pwnescape4supply-chain4sysgorat4use-after-free4vercel4backdoor3ddos3
224 stories, newest first · one card per story
Stories tagged #linux
Ubuntu Advises on Linux Kernel NVIDIA Vulnerabilities
Ubuntu releases security update for Linux kernel flaws, including CVE-2023-20585 allowing out-of-bounds conditions in SEV-SNP guests.
Xen XSA-528: guest-triggered use-after-free in Linux xen-blkback
Xen-blkback driver fails to serialize reads of I/O statistics allowing use-after-free during device teardown.
X.Org fixes eight X server and Xwayland memory flaws
Fixes are in xorg-server 21.1.26 and xwayland 24.1.15; X.Org gave no severity scores or exploitation status.
Study traces CVE-linked vulnerable code copied across projects
Using SQVDT on NVD data, the authors report copy-paste reuse of high-severity patterns inside and between projects.
Cyanogen co-founder unveils Kora, an AI desktop OS for 2027
The free Linux system targets Intel, AMD, and Snapdragon PCs, with enterprise Humain OS also planned for 2027.
sblim-sfcb CIM-XML parser bug enables pre-auth remote denial of service
Espilon VR is seeking a CVE because upstream sfcb, last released as 1.4.9 in 2017, is abandoned.
Claude document-skill flaw can run attacker code on Linux
AIR Security says an unverified library in a shared temp directory can load via LD_PRELOAD; Anthropic declined to fix it.
Critical Terminal2Shell flaw grants instant shell on all OS
Design flaw in every terminal emulator on macOS Linux Windows and more allows attackers to gain instant shell with full user privileges with no patches available.
38
CISA lists OpenSSH auth bypass in KEV catalog (CVE-2026-123158)
Federal agencies must apply vendor mitigations or stop using the product by November 12, 2026.
Practical Guide to Out-of-Tree Mitigations on Linux
Step-by-step instructions for deploying hardened allocators such as hardened_malloc, mimalloc secure mode, and scudo to defend against heap overflows and use-after-free bugs on Linux.
1
Hackers Deploy CWPdoor Backdoor via Trojanized CWP Server
A new Linux malware called CWPdoor is distributed through trojanized versions of cwpsrv in the Control Web Panel web server, affecting over 340,000 exposed instances.
OpenSSH 10.6p2 released with musl libc workaround
OpenSSH 10.6p2 includes immediate mitigation for critical vulnerability affecting Linux systems using musl libc without PAM.
OpenAI Pipeline Generates 948 Linux Root Escalation Exploits
OpenAI's AI pipeline discovered and patched 948 Linux local privilege escalation exploits in 30 hours at $1.2 million cost, using an upcoming cyber model.
1
Ubuntu extends nginx security fixes to older LTS releases (USN-8955-2)
The notice also fixes CVE-2026-42533, which can let a remote attacker crash nginx or possibly run code.
Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.
Attackers push malicious updates to OpsShield cPGuard customers
Attackers compromised the vendor update channel for 70 minutes and distributed fake updates to ~2,950 customer servers, exposing password hashes and SSH keys; OpsShield is rebuilding affected systems and urging…
1
Kremlin-linked hackers exploit iOS and Android flaws to infect phones
Attackers injected JavaScript to profile devices and steal cookies, Wi-Fi passwords, and full device data from visitors to targeted sites including america250.org.
Red Hat Patches Critical Linux TCP RCE Flaw CVE-2026-98432
Red Hat released fixed kernels for RHEL 8, 9 and 10 while Ubuntu keeps updates in testing channel.
Hackers Compromise cPGuard Update Channel to Install Backdoor
Attacker accessed cPGuard distribution infrastructure to distribute malicious script installing backdoor and collecting files from Linux servers.
3
Akamai BloghighLinux Kernel TCP Stack Remote Use-After-Free Vulnerability
Akamai reports on CVE-2026-98432, a remote use-after-free flaw in the Linux kernel TCP stack.
Ubuntu delays critical Linux kernel TCP vulnerability patch
Ubuntu has not patched CVE-2026-98432 which allows remote root on servers, despite Debian and others shipping the fix.
Government Linux servers targeted with SysGoRAT and AI-generated scripts
Palo Alto Unit 42 tracks CL-UNK-1211 campaign using SysGoRAT RAT and AI scripts to compromise government Linux servers for espionage
Linux syscall tables for 27 architectures updated with JSON exports and API
The updated site covers syscalls from Linux 3.3 to 7.3 across 27 architectures and offers kernel selectors plus JSON downloads of syscall history.