Tag: linux
-
BPFDoor Variants Hide with Stateless C2 and ICMP Relay Tactics
Seven new BPFDoor variants that push Linux backdoor tradecraft deep into the kernel, making them harder to spot in large telecom networks. These implants use Berkeley Packet Filters (BPF) to quietly inspect traffic inside the operating system kernel, waiting for a “magic packet” that activates a hidden shell. Once triggered, the backdoor blends into normal…
-
Supply chain security is now a board-level issue: Here’s what CSOs need to know
Tags: access, android, attack, automation, best-practice, compliance, cybersecurity, edr, encryption, firewall, firmware, flaw, infrastructure, linux, mitigation, regulation, risk, sbom, software, supply-chain, switch, threat, tool, update, vulnerability, windows, zero-dayThe hidden complexity that drowns security teams: SBOMs are no longer used solely to track software licensing; they are key to managing supply chain security as they enable the identification and tracking of vulnerabilities across ecosystems.Finding a problem is just the start, you need to determine if the vulnerability affects your implementation. For example, if…
-
Druckersystem: Cups-Lücken gefährden zahlreiche Linux-Systeme
Ein Forscher hat KI-Agenten auf das Druckersystem Cups angesetzt. Zwei entdeckte Sicherheitslücken verleihen Angreifern Root-Zugriff aus der Ferne. First seen on golem.de Jump to article: www.golem.de/news/von-ki-agenten-entdeckt-print-server-luecken-gefaehrden-zahlreiche-linux-systeme-2604-207281.html
-
Von KI-Agenten entdeckt: Print-Server-Lücken gefährden zahlreiche Linux-Systeme
Ein Forscher hat seine KI-Agenten auf das Druckersystem Cups angesetzt. Zwei entdeckte Lücken verleihen Angreifern Root-Zugriff aus der Ferne. First seen on golem.de Jump to article: www.golem.de/news/von-ki-agenten-entdeckt-print-server-luecken-gefaehrden-zahlreiche-linux-systeme-2604-207281.html
-
AI agents found vulns in this popular Linux and Unix print server
CUPS server shown spilling out remote code execution and root access First seen on theregister.com Jump to article: www.theregister.com/2026/04/06/ai_agents_cups_server_rce/
-
Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps
Your attack surface no longer lives on one operating system, and neither do the campaigns targeting it. In enterprise environments, attackers move across Windows endpoints, executive MacBooks, Linux infrastructure, and mobile devices, taking advantage of the fact that many SOC workflows are still fragmented by platform. For security leaders, this creates a First seen on…
-
Poisoned Axios Package Spreads Cross-Platform Malware via Phantom Dependency
Hackers hijacked the npm account of Axios’s lead maintainer. They used it to push two malicious releases that silently installed a cross”‘platform remote access trojan (RAT) on macOS, Windows, and Linux systems. Axios is one of the JavaScript ecosystem’s most widely used HTTP clients, with over 100 million weekly downloads on npm, making it deeply…
-
Supply Chain Attacks Surge in March 2026
Tags: access, ai, api, attack, authentication, awareness, cloud, container, control, corporate, credentials, crypto, data-breach, github, group, hacking, identity, infrastructure, Internet, kubernetes, least-privilege, linux, LLM, macOS, malicious, malware, mfa, network, north-korea, open-source, openai, phishing, pypi, software, startup, supply-chain, threat, tool, update, vulnerability, windowsIntroductionThere was a significant increase in software supply chain attacks in March 2026. There were five major software supply-chain attacks that occurred including the Axios NPM package compromise, which has been attributed to a North Korean threat actor. In addition, a hacking group known as TeamPCP was able to compromise Trivy (a vulnerability scanner), KICS…
-
Cisco fixes critical IMC auth bypass present in many products
Tags: access, ai, api, apt, attack, authentication, cisco, computing, credentials, cybersecurity, dns, email, exploit, firewall, firmware, flaw, group, infrastructure, linux, malicious, monitoring, network, password, ransomware, risk, router, vulnerability, zero-day[ Related: More Cisco news and insights ] The Cisco IMC is a baseboard management controller (BMC), a dedicated controller embedded into server motherboards with its own RAM and network interface that gives administrators monitoring and management capabilities as if they were physically connected to the server with a keyboard, monitor, and mouse (KVM). Because BMCs run…
-
Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers
Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, according to findings from the Microsoft Defender Security Research Team.”Instead of exposing command execution through URL parameters or request bodies, these web shells rely on threat actor-supplied cookie values to gate…
-
We know what day it is but these Raspberry Pi price hikes are no joke
Hot DRAM! Who is going to drop nearly $400 on an underpowered Linux computer? First seen on theregister.com Jump to article: www.theregister.com/2026/04/01/raspberry_pi_price_hikes/
-
Google Warns of New Chrome Zero-Day Under Active Exploitation Users Urged to Update Immediately
Google has released an urgent security update for its Chrome desktop browser to address 21 vulnerabilities, including a critical zero-day flaw that is actively being exploited in the wild. Users are strongly urged to update their browsers immediately to version 146.0.7680.177/.178 for Windows and Mac, or 146.0.7680.177 for Linux . Active Zero-Day Threat The most…
-
ImageMagick Zero-Day Enables RCE on Linux and WordPress Servers
New research from Octagon Networks reveals a critical zero-day ImageMagick vulnerability that allows Remote Code Execution (RCE) via simple image uploads affecting Ubuntu, Amazon Linux, and WordPress. This magic byte shift bypasses even the most secure policies. First seen on hackread.com Jump to article: hackread.com/imagemagick-zero-day-rce-linux-wordpress-servers/
-
North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems
A North Koreanexus threat actor has hijacked the popular Axios NPM package in a high”‘impact software supply chain attack that can silently backdoor Windows, macOS, and Linux systems. Between March 31, 2026, 00:21 and 03:20 UTC, attackers used a compromised maintainer account to push backdoored Axios releases 1.14.1 and 0.30.4 to NPM. The attackers changed…
-
North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems
A North Koreanexus threat actor has hijacked the popular Axios NPM package in a high”‘impact software supply chain attack that can silently backdoor Windows, macOS, and Linux systems. Between March 31, 2026, 00:21 and 03:20 UTC, attackers used a compromised maintainer account to push backdoored Axios releases 1.14.1 and 0.30.4 to NPM. The attackers changed…
-
PyPI Telnyx Python SDK Backdoored to Steal Credentials on Windows, macOS, and Linux
Telnyx Python SDK on PyPI, using a multi”‘stage WAV steganography payload to steal credentials across Windows, macOS, and Linux systems. The backdoor lives in telnyx/_client.py and is triggered at module scope, so simply importing telnyx is enough to execute the payload before any application code runs. The rogue releases remained available for roughly 6.5 hours before PyPI quarantined them…
-
Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack
Tags: ai, attack, breach, cloud, control, credentials, crypto, github, incident response, linux, LLM, macOS, malicious, malware, monitoring, open-source, openai, powershell, pypi, rat, spam, supply-chain, tool, windowspostinstall hook that would execute a dropper script when it was pulled in by a different package as a dependency.Shortly after midnight UTC on March 31 a new version of the Axios package, axios@1.14.1, was published on npm followed by axios@0.30.4 39 minutes later. Both listed plain-crypto-js@4.2.1 as a dependency in their package.json files, but…
-
Attackers hijack Axios npm account to spread RAT malware
Threat actors hijacked the npm account of Axios to distribute RAT malware via malicious package updates. Threat actors compromised the npm account of Axios, a widely used library with over 100M weekly downloads, and published malicious versions to spread remote access trojans across Linux, Windows, and macOS. The supply chain attack was identified by multiple…
-
Hackers compromise Axios npm package to drop cross-platform malware
Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-compromise-axios-npm-package-to-drop-cross-platform-malware/
-
SystemRescue 13 updates its kernel to Linux 6.18 LTS, adds new recovery tools
Bootable Linux recovery environments occupy a specific niche in the systems administration and incident response toolkit. SystemRescue, an Arch-based live distribution built … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/30/systemrescue-13-released/
-
Espionage campaign targets telecom with stealthy Linux-based backdoor
A China-nexus actor has been able to gain long-term access in a bid to gather intel on government agencies and critical infrastructure providers. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/espionage-campaign-telecom-linux-backdoor-China/815978/
-
Hackers Implant Stealthy BPFdoor Backdoors in Telecom Networks for Persistent Access
A China-nexus threat actor known as Red Menshen is planting stealthy backdoors deep inside global telecommunications networks. According to a recent investigation by Rapid7 Labs, this long-term espionage campaign utilises a highly evasive Linux kernel malware called BPFdoor. Instead of launching noisy, disruptive attacks, these hackers are building dormant sleeper cells in the telecom backbone.…
-
Digitale Schläferzellen: Versteckte Linux-Malware in Telko-Netzwerken entdeckt
Forscher haben Netze von Telko-Providern untersucht und eine versteckte Backdoor-Malware gefunden. Hacker sollen damit Spionage betreiben. First seen on golem.de Jump to article: www.golem.de/news/digitale-schlaeferzellen-versteckte-linux-malware-in-telko-netzwerken-entdeckt-2603-207004.html
-
VoidLink Rootkit Leverages eBPF and Kernel Modules to Stealthily Infiltrate Linux Systems
VoidLink is a new Linux rootkit family that combines classic kernel modules with eBPF to hide processes and network activity deep inside modern cloud environments. It targets distributions from CentOS 7 up to Ubuntu 22.04, giving attackers a stealthy way to persist across a wide range of kernel versions. VoidLink is part of a broader…
-
Kali Linux 2026.1 Launches with 8 New Tools, UI Refresh, and Kernel Upgrade
Kali Linux continues to evolve as a leading platform for penetration testing, and its latest release, Kali Linux 2026.1, introduces a mix of visual updates, new tools, and system-level improvements. This release not only refines the user experience but also pays tribute to its roots in BackTrack, marking a significant milestone in the project’s history. First seen…
-
Unbreakable Enterprise Kernel 8.2 ships with confidential computing support, XFS live repair
Many enterprise Linux deployments rely on hardware-level memory isolation to protect sensitive workloads from co-tenants and compromised hypervisors. Oracle’s … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/26/oracle-unbreakable-enterprise-kernel-8-2/