Tag: linux
-
Microsoft issues emergency update for macOS and Linux ASP.NET threat
When authentication fails, things can go very, very wrong. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/04/microsoft-issues-emergency-update-for-macos-and-linux-asp-net-threat/
-
Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API
The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in South Asia.”The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses,” the Symantec…
-
Harvester Deploys Linux GoGra Backdoor in South Asia Using Microsoft Graph API
The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in South Asia.”The malware uses the legitimate Microsoft Graph API and Outlook mailboxes as a covert command-and-control (C2) channel, allowing it to bypass traditional perimeter network defenses,” the Symantec…
-
New GoGra malware for Linux uses Microsoft Graph API for comms
A Linux variant of the GoGra backdoor uses legitimate Microsoft infrastructure, relying on an Outlook inbox for stealthy payload delivery. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-gogra-malware-for-linux-uses-microsoft-graph-api-for-comms/
-
VirtualBox 7.2.8 is out with Linux kernel 7.0 support and crash fixes
Oracle shipped VirtualBox 7.2.8 on April 21, 2026, as a maintenance release covering crashes, networking problems, clipboard issues, and extended Linux kernel compatibility. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/21/virtualbox-7-2-8-released/
-
Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker
Gentlemen is a fast”‘growing ransomware”‘as”‘a”‘service (RaaS) operation now targeting Windows, Linux, NAS, BSD, and VMware ESXi with a new locker written in C for hypervisor environments. Its multi”‘platform design and strong defense”‘evasion features make it a high”‘impact threat to corporate networks worldwide. The Gentlemen RaaS emerged around mid”‘2025 and quickly built an affiliate ecosystem by…
-
Gentlemen RaaS Hits Windows, Linux, and ESXi With New C-Based Locker
Gentlemen is a fast”‘growing ransomware”‘as”‘a”‘service (RaaS) operation now targeting Windows, Linux, NAS, BSD, and VMware ESXi with a new locker written in C for hypervisor environments. Its multi”‘platform design and strong defense”‘evasion features make it a high”‘impact threat to corporate networks worldwide. The Gentlemen RaaS emerged around mid”‘2025 and quickly built an affiliate ecosystem by…
-
DFIR Report The Gentlemen SystemBC: A Sneak Peek Behind the Proxy
ey Points The Gentlemen RaaS The Gentlemen ransomware”‘as”‘a”‘service (RaaS) operation is a relatively new group that emerged around mid”‘2025. The operators advertise their services across multiple underground forums, promoting their ransomware platform and inviting penetration testers (and other technically skilled actors) to join as affiliates. The RaaS provides affiliates with multi”‘OS lockers for Windows, Linux,…
-
Claude Mythos ist der Hype gerechtfertigt?
Tags: ai, bug, cve, cybersecurity, data, exploit, linux, openai, sans, technology, update, vulnerabilityClaude Mythos wird derzeit von ausgesuchten Organisationen getestet in erster Linie großen Tech-Konzernen aus den USA.Anthropic | ScreenshotDer Hype um Anthropics Security-Modell Mythos bekommt erste Risse: Während KI-Konkurrent OpenAI plant, mit einem eigenen Cybersecurity-fokussierten KI-Modell ‘entgegenzuwirken”, stellen die Sicherheitsexperten von VulnCheck in einer aktuellen Untersuchung die praktischen Auswirkungen von Claude Mythos, respektive ‘Project Glasswing” in…
-
Decades-old Linux UI bug fixed by dev younger than the window manager
Kamila Szewczyk prefers old software, as back then people understood something could actually be finished First seen on theregister.com Jump to article: www.theregister.com/2026/04/15/enlightenment_e16_bug_patched/
-
Claude Mythos: Prepare for your board’s cybersecurity questions about the latest AI model from Anthropic
Tags: ai, api, application-security, attack, authentication, automation, best-practice, business, ceo, cisa, cloud, compliance, container, control, cve, cvss, cyber, cybersecurity, data, data-breach, endpoint, exploit, fedramp, finance, flaw, framework, governance, group, HIPAA, identity, injection, insurance, kev, law, linkedin, linux, LLM, macOS, network, PCI, risk, service, soc, software, strategy, technology, threat, update, vulnerability, vulnerability-management, windows, zero-day, zero-trustWith the Federal Reserve Chairman meeting with bank CEOs to discuss the security implications of Claude Mythos, you can bet that your board of directors will ask you about the impact of the AI model on your cybersecurity strategy. Here’s how to prepare. Key takeaways Anthropic announced Claude Mythos Preview, its most powerful general-purpose frontier…
-
China-linked cloud credential heist runs on typos and SMTP
Typosquatting for cloud-native espionage: The campaign relies heavily on deception, the researchers pointed out, using C2 domains closely resembling legitimate Alibaba Cloud services. The typosquatting approach allows malicious traffic to blend into routine cloud operations, specifically in environments where outbound filtering is absent.The implant used is an obfuscated ELF binary, with an executable designed for…
-
Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses
Tags: access, ai, api, attack, automation, cloud, credentials, crypto, data, github, guide, intelligence, kubernetes, linux, macOS, malicious, malware, open-source, pypi, risk, software, supply-chain, tactics, theft, tool, update, windows, worm<div cla TL;DR Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with most activity focused on credential theft, host reconnaissance, and staged payload delivery. The quarter’s defining pattern was trust abuse: attackers succeeded by…
-
APT41 Targets Linux Cloud Servers With New Winnti Backdoor
A previously undocumented Linux backdoor attributed to China-linked threat group APT41 (Winnti) has been uncovered, targeting cloud workloads across AWS, GCP, Azure, and Alibaba Cloud. The ELF-based implant, currently showing zero detections on VirusTotal, transforms Linux servers into stealthy credential theft nodes using a novel SMTP-based command-and-control (C2) mechanism. The discovery indicates a new phase in APT41’s Linux and cloud-targeted…
-
Fake Linux leader using Slack to con devs into giving up their secrets
Google Sites lure leads to bogus root certificate First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/linux_foundation_social_engineering/
-
Linux 7.0 debuts as Linus Torvalds ponders AI’s bug-finding powers
Makes Rust support official, adds code for ancient Alpha and SPARC CPUs First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/linux_kernel_7_releaseed/
-
Linux 7.0 debuts as Linus Torvalds ponders AI’s bug-finding powers and their impact on release process
Makes Rust support official, adds code for ancient Alpha and SPARC CPUs First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/linux_kernel_7_releaseed/
-
OpenSSF Flags Malware Campaign on Slack Posing as Linux Foundation Figures
OpenSSF warns hackers impersonate Linux Foundation leaders on Slack, tricking developers into installing malware that can compromise entire systems. First seen on hackread.com Jump to article: hackread.com/openssf-malware-slack-linux-foundation-figures/
-
The fully free Linux OS Trisquel gets a major update with version 12.0 Ecne
Trisquel GNU/Linux, a free operating system aimed at home users, small enterprises, and educational centers, released version 12.0. The release, codenamed Ecne, is declared … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/13/trisquel-12-0-ecne-released/
-
France to ditch Windows for Linux to reduce reliance on US tech
France’s move to ditch Windows for Linux is its latest effort to reduce its reliance on American tech giants. First seen on techcrunch.com Jump to article: techcrunch.com/2026/04/10/france-to-ditch-windows-for-linux-to-reduce-reliance-on-us-tech/
-
Little Snitch for Linux shows what your apps are connecting to
Network monitoring on Linux has long been a gap for users who want per-process visibility into outbound connections. Existing tools either operate at the command line or were … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/10/little-snitch-for-linux-privacy/
-
Little Snitch for Linux shows what your apps are connecting to
Network monitoring on Linux has long been a gap for users who want per-process visibility into outbound connections. Existing tools either operate at the command line or were … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/10/little-snitch-for-linux-privacy/
-
What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure
Tags: access, advisory, ai, attack, authentication, automation, backup, cctv, chatgpt, cisa, communications, compliance, control, credentials, crypto, cve, cyber, cybersecurity, data, data-breach, defense, detection, dns, email, exploit, finance, firewall, flaw, government, group, healthcare, infrastructure, intelligence, international, Internet, iot, iran, kev, leak, linux, malicious, malware, mitigation, mitre, monitoring, network, office, openai, password, radius, resilience, risk, router, service, siem, software, strategy, switch, technology, threat, tool, update, vpn, vulnerability, vulnerability-managementAn Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. critical infrastructure sectors. Key takeaways: CyberAv3ngers is a state-directed threat group operating under Iran’s IRGC Cyber-Electronic Command. The U.S. Treasury sanctioned six named officials in February 2024 and the State Department…
-
Critical Chrome Flaws Let Attackers Execute Arbitrary Code
Google has released an urgent security update for its Chrome browser, resolving multiple dangerous vulnerabilities. The Chrome team promoted version 147 to the stable channel for Windows, Mac, and Linux users on April 7, 2026. This major release patches flaws that could allow attackers to execute arbitrary code and take full control of affected systems.…
-
Chaos malware expands from routers to Linux cloud servers
Chaos, Go-based malware first documented by Lumen’s Black Lotus Labs, has historically targeted routers and edge devices. A new variant observed in March 2026 shows the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/08/chaos-malware-cloud-misconfigured-servers/
-
Flatpak 1.16.4 fixes sandbox escape and three other security flaws
Flatpak, a Linux application sandboxing and distribution framework, released version 1.16.4, patching four security vulnerabilities. The most severe fix addresses a complete … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/08/flatpak-1-16-4-released-fixes-sandbox-escape/
-
Patch to end i486 support hits Linux kernel merge queue
After a year of patchwork, maintainers look ready to start retiring 486-class CPUs First seen on theregister.com Jump to article: www.theregister.com/2026/04/06/patch_to_end_i486_support/
-
BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics
Seven new BPFDoor variants that push Linux backdoor tradecraft deep into the kernel, making them harder to spot in large telecom networks. These implants use Berkeley Packet Filters (BPF) to quietly inspect traffic inside the operating system kernel, waiting for a “magic packet” that activates a hidden shell. Once triggered, the backdoor blends into normal…