Tag: linux
-
Über 400 ArchPakete im AUR manipuliert
Hacker haben über 400 Community-Pakete im Arch User Repository manipuliert, um Passwörter zu stehlen und ein eBPF-Rootkit zu installieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/linux-pakete-manipuliert
-
Über 400 ArchPakete im AUR manipuliert
Hacker haben über 400 Community-Pakete im Arch User Repository manipuliert, um Passwörter zu stehlen und ein eBPF-Rootkit zu installieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/linux-pakete-manipuliert
-
Windows and Linux users: The deadline to update Secure Boot keys is near
What you need to know about the expiration of keys securing your machine’s boot sequence. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/windows-and-linux-users-the-deadline-to-update-secure-boot-keys-is-near/
-
SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic
Windows variants of SprySOCKS, a backdoor long associated with FishMonger (aka Earth Lusca/TAG-22), expanding a toolset that was until now Linux-only. The two Windows builds internally labelled WIN_DRV and WIN_PLUS preserve the original SprySOCKS protocol and command set while adding Windows-native loading techniques and, in WIN_DRV’s case, a kernel-mode driver that substantially increases stealth and…
-
SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic
Windows variants of SprySOCKS, a backdoor long associated with FishMonger (aka Earth Lusca/TAG-22), expanding a toolset that was until now Linux-only. The two Windows builds internally labelled WIN_DRV and WIN_PLUS preserve the original SprySOCKS protocol and command set while adding Windows-native loading techniques and, in WIN_DRV’s case, a kernel-mode driver that substantially increases stealth and…
-
China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints
China-linked FishMonger used two SprySOCKS Windows variants that leveraged kernel drivers and the Print Spooler to target governments in four countries. ESET researchers have found two previously undocumented Windows versions of SprySOCKS, a backdoor that the security community had until now treated as Linux-only. Trend Micro first documented the Linux variant in September 2023 and…
-
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection
FishMonger, a China-nexus threat group, has deployed an undocumented version of the Linux backdoor against government targets in Honduras, Taiwan, Thailand, and Pakistan. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/sprysocks-windows-variant-kernel-drivers
-
SprySOCKS Backdoor Expands From Linux to Windows
China-linked SprySOCKS backdoor gains stealthy Windows variants and 30-plus C2 commands First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/sprysocks-backdoor-windows/
-
(g+) Linux-Rechteausweitung: Wie ein normaler Linux-Nutzer zu Root wird
Tags: linuxIm Mai 2026 trafen drei universelle Linux-Rechtelücken zusammen, alle nach demselben alten Muster. Was zu tun ist. First seen on golem.de Jump to article: www.golem.de/news/linux-rechteausweitung-wie-ein-normaler-linux-nutzer-zu-root-wird-2606-209788.html
-
(g+) Linux-Rechteausweitung: Wie ein normaler Linux-Nutzer zu Root wird
Tags: linuxIm Mai 2026 trafen drei universelle Linux-Rechtelücken zusammen, alle nach demselben alten Muster. Was zu tun ist. First seen on golem.de Jump to article: www.golem.de/news/linux-rechteausweitung-wie-ein-normaler-linux-nutzer-zu-root-wird-2606-209788.html
-
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Cybersecurity researchers have flagged two previously undocumented Windows variants of what was believed to be a Linux-only backdoor called SprySOCKS.”The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS,” ESET said in a report shared with The Hacker News. “Both come with a hard-coded C&C [command-and-control] configuration and support communication over TCP, UDP, First…
-
Windows version of SprySOCKS Linux malware used to attack govt orgs
Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/
-
CVE-2022-0492 wird aktiv ausgenutzt – Vier Jahre alte Linux-Kernel-Lücke erlaubt Container-Ausbruch
First seen on security-insider.de Jump to article: www.security-insider.de/linux-kernel-cve-2022-0492-container-ausbruch-cgroups-a-dfa9ed0a068ebd2d08d9dccbb4b05916/
-
Zehn Jahre unentdeckt: Hacker manipulieren Linux-Login
Die Hackergruppe Velvet Ant hat über fast zehn Jahre hinweg Linux-Login-Systeme mit einer Hintertür versehen, um unbemerkt Netzwerke auszuspionieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/manipulierter-linux-login-zehn-jahre
-
China-nexus group hid in Linux login system for nearly a decade
First seen on scworld.com Jump to article: www.scworld.com/brief/china-nexus-group-hid-in-linux-login-system-for-nearly-a-decade
-
Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide…
-
400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide…
-
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Instead of hiding on the laptops and servers defenders watch most closely, a China-nexus group spent close to a decade hidden inside the Linux login system itself.Sygnia, which tracks the group as Velvet Ant, says it backdoored the PAM and OpenSSH components that decide who is allowed to sign in, planting its access where ordinary…
-
Atomic Arch Campaign Hijacks 20+ Linux AUR Packages to Deliver Malware
Over 20 Linux packages were compromised in the Atomic Arch campaign, which abuses AUR ownership transfers to drop rootkit-like malware. First seen on hackread.com Jump to article: hackread.com/atomic-arch-hijacks-linux-aur-packages-malware/
-
Over 400 Arch Linux packages compromised to push rootkit, infostealer
More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/
-
PoC Exploit Released for Linux Kernel GuestHost Escape Vulnerability
A proof-of-concept (PoC) exploit has been publicly released for a critical Linux kernel vulnerability, tracked as CVE-2026-46316, enabling guest-to-host escape in KVM/arm64 environments. The flaw, dubbed “ITScape” by security researcher Hyunwoo Kim (V4bel), affects the Kernel-based Virtual Machine (KVM) subsystem and allows a malicious guest virtual machine to execute arbitrary commands on the host with…
-
Attacke über Dienstleister: VerdantBamboo infiziert Linux-Appliances
Die Hackergruppe VerdantBamboo nutzt eine BSD-Variante der BRICKSTORM-Malware sowie die Schadprogramme PLENET und AGENTPSD zur Linux-Spionage. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/linux-appliances-verdantbamboo
-
High-severity vulnerability in Linux caused by a single faulty character
Use-after-free bug can be exploited to evade sandbox defenses. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/
-
High-severity vulnerability in Linux caused by a single faulty character
Use-after-free bug can be exploited to evade sandbox defenses. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/
-
High-severity vulnerability in Linux caused by a single errant character
Use-after-free bug can be exploited to evade sandbox defenses. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/
-
A single errant character in the Linux kernel allows attacker to gain root
Use-after-free bug can be exploited to evade sandbox defenses. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/a-single-errant-character-in-the-linux-kernel-allows-attacker-to-gain-root/
-
CVE-2026-23111: Linux nf_tables Flaw Enables Root Exploits
A Linux kernel nf_tables bug lets local users gain root via use-after-free caused by a logic error; patch removes a single “!”. CVE-2026-23111 lives in nf_tables, the Linux kernel’s packet filtering framework. Exodus Intelligence researcher Oliver Sieber found the bug in early 2025 and chained it into a full local privilege escalation. The flaw was…
-
CVE-2026-23111: Linux nf_tables Flaw Enables Root Exploits
A Linux kernel nf_tables bug lets local users gain root via use-after-free caused by a logic error; patch removes a single “!”. CVE-2026-23111 lives in nf_tables, the Linux kernel’s packet filtering framework. Exodus Intelligence researcher Oliver Sieber found the bug in early 2025 and chained it into a full local privilege escalation. The flaw was…
-
Linux Kernel Flaw Allows Local Attackers to Gain Root Privileges
A newly disclosed Linux kernel vulnerability tracked as CVE-2026-23111 allows local attackers to escalate privileges to root by exploiting a use-after-free flaw in the nftables subsystem. The vulnerability, patched upstream on February 5, 2026, affects the netfilter framework, specifically nftables, which is widely used for packet filtering, NAT, and firewall rule management across modern Linux…
-
One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to root and break out of a container.The flaw, CVE-2026-23111, sits in the kernel’s nf_tables packet-filtering code and was patched upstream on February 5, 2026. Exodus Intelligence released its full technical walkthrough on June 8,…