#Linux
All CosmicBytez Labs articles tagged #Linux, across news, security advisories, how-to guides, and projects.
- News
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
A public 'AnyPwn' exploit abuses a heap overflow in AnyDesk Linux 8.0.2's session protocol for pre-auth root RCE; AnyDesk fixed it quietly in 8.0.3.
- Security
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
A local privilege escalation flaw lets the zammad user gain root on any Zammad instance; chainable with CVE-2026-102489, actively exploited, now in CISA KEV.
- News
WSL Containers Reaches General Availability, Bringing Native Linux Containers to Windows
Microsoft's WSL Containers feature exits preview with a new wslc.exe CLI, a Windows API, and enterprise controls — no Docker Desktop required.
- Security
CVE-2026-96276: Flatpak build-init Path Traversal Enables Arbitrary File Writes
A malicious Flatpak SDK extension can abuse build-init path resolution to write attacker files outside the build tree.
- News
CISA Warns of Active Exploitation of Three Linux Kernel Flaws
CISA added three Linux kernel CVEs to its KEV catalog, ordering federal agencies to patch and forensically triage by end of day.
- News
Cyber Op Targets South Korean Media & Automotive Sectors
A North Korea-aligned APT embedded a custom backdoor in HAProxy load balancers at two South Korean firms, intercepting decrypted traffic for months.
- Security
CVE-2026-75092: Leapp RHEL Upgrade Flaw Lets a Compromised MySQL Account Escalate to Root
A flaw in leapp-repository's scan_mysql actor runs mysqld as root during RHEL 9-to-10 upgrades, letting a compromised mysql account escalate to full root.
- News
Homebrew 7.0.0 Gets Built-In GUI, Better Security Controls
Homebrew 7.0.0 ships a native GUI (BrewUI), a built-in brew vulns scanner, and Landlock sandboxing in its biggest security release yet.
- Security
CVE-2026-44950: Critical Heap Overflow in libXfont2 Font Server Client
A missing cumulative bounds check in libXfont2's fs_read_glyphs() lets a malicious font server smash the heap via overlapping glyph writes.
- Security
CVE-2026-59679: libXfont2 Out-of-Bounds Read/Write via Mismatched Glyph Counts
libXfont2's fs_read_glyphs() trusts an attacker-controlled glyph count without cross-checking it against the allocated encoding array size.
- News
Linux Rootkit Injects Fileless PHP Web Shells Into Breached F5 BIG-IP APM Servers
A stealthy Linux rootkit dubbed PoisonedRefresh hooks PHP on F5 BIG-IP APM webtop servers to run in-memory web shells that leave disk files untouched.
- News
"Poisoned Refresh" Rootkit Injects Fileless PHP Web Shells on Breached F5 BIG-IP Devices
Sophos found a stealthy Linux rootkit hooking PHP on F5 BIG-IP APM servers to inject memory-only web shells, leaving disk files untouched.
- News
'Ted' Backdoor Hides Inside Trojanized HAProxy Builds to Intercept Web Traffic
Rapid7 found a DPRK-linked Linux implant compiled into trojanized HAProxy binaries at two South Korean firms, hijacking traffic via hidden C2 channels.
- Security
CVE-2026-65083: Critical Sandbox Provisioning Flaw in NVIDIA OpenShell
A CVSS 9.9 flaw in NVIDIA OpenShell's sandbox provisioning API can leave AI agent sandboxes with an incomplete block-list, opening the door to RCE.
- Security
CVE-2026-65093: Critical Sandbox Escape in NVIDIA OpenShell for Linux
NVIDIA disclosed a CVSS 9.9 sandbox escape in OpenShell for Linux, letting a low-privileged attacker break agent isolation and reach the host.
- Security
CVE-2026-52490: Critical Code Injection in libtiff tiffcrop
CVSS 9.8 code injection in libtiff's tiffcrop.c allows unauthenticated remote code execution. No patch confirmed; PoC published.
- Security
CVE-2026-66897: Critical LXD Path Traversal Allows Host File Overwrite
A CVSS 9.9 path traversal flaw in LXD's template processing lets attackers with container permissions overwrite arbitrary host files.
- News
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
UAT-10147 uses agentic AI to automate attacks on 170,000 web servers, deploying SPECTRE with BYOVD EDR bypass and an AI-assisted Linux kernel rootkit.
- News
14 Trojanized npm Packages Deploy RedC2 4.0 Linux Backdoor with AI-Assisted Command and Control
TrendAI found 14 npm packages masquerading as streak utilities that silently install a Linux backdoor linked to the RedC2 4.0 crimeware kit.
- Security
CVE-2026-62316: Microsoft UFO MCP Server DNS Rebinding and SSRF via Missing Host Validation
CVSS 8.8: Microsoft's UFO framework MCP server binds to localhost but skips Host/Origin header checks, enabling DNS rebinding and SSRF attacks. Fixed in 3.0.8.
- HOWTO
Writing and Deploying YARA Rules for Malware Detection
Learn to write effective YARA rules to identify malware, hunt threats, and scan endpoints for indicators of compromise — from basic syntax to real-world...
- News
New Evooo1Bot Linux Botnet Turns Routers Into Traffic Relay Nodes
FortiGuard Labs uncovers Evooo1Bot, a Mirai-derived Linux botnet exploiting 8 CVEs to compromise routers and convert them into persistent SOCKS5 relay proxies.
- HOWTO
OpenSSH Hardening with Certificate-Based Authentication
Replace static SSH keys with a short-lived certificate authority. Harden sshd_config, eliminate lateral-movement risk, and enforce zero-trust access...
- HOWTO
AIDE File Integrity Monitoring: Detect Unauthorized Changes on Linux
Deploy AIDE (Advanced Intrusion Detection Environment) to build a cryptographic baseline of your Linux filesystem and automatically alert on unauthorized...
- News
Arch Linux Disables AUR Package Adoption to Stop Malware Flood
Arch Linux has temporarily disabled the adoption of orphaned AUR packages after a wave of malicious takeovers — attackers claimed unmaintained packages...
- HOWTO
WireGuard VPN: Secure Remote Access for IT Professionals
Deploy a modern, high-performance WireGuard VPN server on Linux for secure remote access. Covers server setup, client configuration, multi-peer...
- News
In Other News: Dolphin X AI Malware, Car Anti-Theft Hack, 432 Linux Kernel CVEs
This week's security roundup covers an AI-prioritizing infostealer targeting developer machines, a hardcoded Bluetooth key in 2.2 million car anti-theft...
- Security
CVE-2026-16606: Critical Pre-Auth RCE in Fujitsu openFT (CVSS 9.8)
A critical unauthenticated remote code execution vulnerability in Fujitsu Software openFT allows attackers to execute arbitrary code on Linux and Solaris...
- HOWTO
Nginx + ModSecurity WAF: Protecting Web Apps with OWASP CRS
Deploy ModSecurity v3 as an Nginx module, wire in the OWASP Core Rule Set, tune false positives, and verify SQL injection and XSS are blocked — all on a...
- HOWTO
Lynis: Linux Security Auditing and Hardening in Practice
Learn how to use Lynis to audit, score, and harden Linux systems. Covers installation, scan interpretation, automated reporting, and CI integration for...
- HOWTO
Fail2ban: Automated Brute Force Protection for Linux Servers
Deploy Fail2ban to automatically ban IPs hammering your SSH and web services. Covers installation, jail configuration, custom filters, and monitoring...
- News
New 'Bad Epoll' Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A use-after-free bug in the Linux kernel's epoll subsystem — CVE-2026-46242 — lets any local user escalate to root on Linux 6.4+ with ~99% reliability. A...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- News
Critical SimpleHelp Flaw Exploited to Deploy Djinn Infostealer
Hackers are actively exploiting CVE-2026-48558 in SimpleHelp remote support software to deploy Djinn Stealer, a previously undocumented cross-platform...
- News
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Attackers poisoned at least 18 npm and Go packages with a novel technique: hiding malware in .vscode/tasks.json auto-run tasks, bypassing npm v12's...
- HOWTO
Linux auditd: Kernel-Level Security Monitoring and Compliance Logging
Deploy and tune the Linux Audit Framework (auditd) to capture privileged operations, file access, and authentication events — building a tamper-resistant...
- News
Linux Foundation Unveils New Open Source Security Project Akrites
The Linux Foundation has launched Akrites, a new open source security initiative designed to give the community standardized tools and channels to report,...
- HOWTO
Docker Security Hardening: Locking Down Container Environments
A practical, step-by-step guide to hardening Docker deployments — from non-root users and read-only filesystems to capability drops, resource limits, and...
- Security
CVE-2026-54420: LiteSpeed cPanel Plugin Symlink Escape on Shared Hosting
A high-severity symlink vulnerability in the LiteSpeed cPanel plugin (CVSS 8.5) allows users with FTP or web shell access to escape CloudLinux/CageFS...
- News
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia researchers uncovered Velvet Ant, a China-nexus APT that spent close to a decade hidden inside Linux authentication infrastructure by backdooring...
- Security
CVE-2026-12183: Critical Auth Bypass in Gas Station Automation System
A CVSS 9.8 authentication bypass in Nefteprodukttekhnika's BUK TS-G Gas Station Automation System allows any unauthenticated attacker to gain full...
- Security
CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability
A Linux kernel vulnerability in the cgroups v1 release_agent feature allows local attackers to escalate privileges and escape containers. Added to CISA KEV…
- News
Microsoft's Coreutils Project Brings Linux Commands to Windows
Microsoft announced Coreutils for Windows at Build 2026, bringing widely used Linux command-line utilities — ls, grep, cat, awk, and more — to Windows as…
- HOWTO
Osquery Endpoint Visibility & Threat Hunting
Use SQL to query your endpoints like a database. Deploy osquery across Linux and Windows hosts to surface process trees, network connections, user activity…
- Security
CVE-2026-4408: Samba OS Command Injection via Check Password Script
A CVSS 9.0 OS command injection flaw in Samba allows remote attackers to execute arbitrary commands on file servers and domain controllers using the %u...
- News
Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets
This week's security roundup covers Linux privilege escalation zero-days, actively exploited Windows Defender vulnerabilities, router botnets hijacking DNS.
- News
Packagist Supply Chain Attack Infects 8 Packages Using
A coordinated supply chain attack campaign has infected eight Packagist Composer packages with malicious code that downloads and executes a Linux binary...
- News
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI
This week's threat intelligence bulletin covers Linux rootkit campaigns, an actively exploited router zero-day, AI-assisted intrusions, new scam kit...
- News
Microsoft Exchange, Windows 11 Hacked on Second Day of Pwn2Own
On day two of Pwn2Own Berlin 2026, competitors demonstrated 15 unique zero-day vulnerabilities and collected $385,750 in awards, successfully exploiting...
- News
New Critical Exim Mailer Flaw Allows Remote Code Execution
A critical vulnerability in certain configurations of the Exim open-source mail transfer agent allows unauthenticated remote attackers to execute...
- HOWTO
CrowdSec: Deploy a Community-Powered Intrusion Prevention System
Install and configure CrowdSec on Linux to detect and block attacks using crowdsourced threat intelligence, custom scenarios, and iptables/nftables bouncers.
- News
Quasar Linux RAT Steals Developer Credentials for Software
A newly discovered Linux implant called Quasar Linux RAT (QLNX) is silently targeting software developers to harvest credentials, log keystrokes, and...
- News
JDownloader Site Hacked to Replace Installers with Python
The official website for JDownloader, one of the most widely-used open-source download managers, was compromised to distribute malicious Windows and Linux...
- News
New Linux 'Dirty Frag' Zero-Day Gives Root on All Major
A new unpatched Linux zero-day exploit dubbed 'Dirty Frag' allows local attackers to gain root privileges on virtually all major Linux distributions with...
- Security
CVE-2026-41501: electerm Linux Command Injection via Install Script
A critical command injection flaw in electerm's Linux installer allows remote attackers to execute arbitrary shell commands by injecting into unsanitized...
- News
CISA Adds Actively Exploited Linux Root Access Bug
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-31431, a Linux kernel privilege escalation flaw enabling root access, to its...
- News
Vect 2.0 Ransomware Acts as Wiper Thanks to Design Error
The emerging Vect 2.0 ransomware — deployed against TeamPCP supply chain attack victims — permanently destroys files larger than 131KB due to a critical...
- News
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB
Threat hunters warn that VECT 2.0 ransomware contains a critical flaw in its encryption implementation that acts more like a wiper for files over 131KB...
- News
New 'Pack2TheRoot' Flaw Gives Hackers Root Linux Access
A newly disclosed vulnerability in the PackageKit daemon, dubbed Pack2TheRoot, allows local Linux users to escalate privileges to root by abusing the...
- Security
CVE-2026-39860: Nix Symlink Attack Allows Root File
A bypass of the CVE-2024-27297 patch in the Nix package manager allows attackers to follow symlinks during fixed-output derivation builds, enabling...
- News
Microsoft Details Cookie-Controlled PHP Web Shells
Microsoft Defender researchers have documented a stealthy PHP web shell technique that uses HTTP cookies as a covert command-and-control channel on Linux...
- Project
WireGuard Road Warrior VPN Server
Build a self-hosted WireGuard VPN server on Ubuntu for secure remote access — with NAT masquerading, DNS leak protection, QR-code client provisioning, and...
- HOWTO
Suricata IDS/IPS Deployment: From Install to Active Threat
Deploy Suricata as a full-featured Network Intrusion Detection and Prevention System on Ubuntu. Covers installation, interface capture, Emerging Threats...
- Project
Build a Collaborative IPS with CrowdSec
Deploy CrowdSec on a Linux server to get community-powered intrusion prevention — block brute-force attacks, credential stuffing, and vulnerability...
- News
Critical Unpatched GNU Telnetd Flaw (CVE-2026-32746)
Researchers have disclosed a critical unauthenticated remote code execution vulnerability in the GNU InetUtils telnet daemon (telnetd). CVE-2026-32746...
- News
SSHStalker Linux Botnet Uses IRC Protocol for Command and Control
Security researchers discover a new Linux botnet named SSHStalker that leverages the legacy IRC protocol for C2 operations, marking a return to old-school...
- Checklist
Server Hardening Security Checklist
Comprehensive checklist for hardening Linux and Windows servers before production deployment. Covers OS configuration, network security, access controls,...
- News
VoidLink: AI-Generated Cloud-Native Malware Framework
Researchers uncover VoidLink, an 88,000-line Zig-based malware framework built with AI assistance that targets AWS, Azure, GCP, and Kubernetes environments.
- HOWTO
SSH Hardening Best Practices
Secure your SSH servers with essential hardening techniques including key-based authentication, fail2ban configuration, and advanced security measures.
- HOWTO
WireGuard VPN Setup and Security Hardening on Linux
Deploy a hardened WireGuard VPN server on Linux — key generation, server and client config, firewall rules, and security best practices for production use.
- HOWTO
Linux Server Hardening: Complete Security Checklist
Comprehensive guide to hardening Linux servers covering user management, service configuration, kernel security, and ongoing maintenance for production systems.