Looking for the best Linux distros for your servers in 2025? Check out our in-depth guide to the top 5 RHEL-based distributions—AlmaLinux, Rocky Linux, Oracle Linux, CentOS Stream, and SUSE Liberty Li...

Light

Light

BPFDoor was initially discovered in 2022 read more about New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks

Struggling to choose between rolling release and fixed release Linux distros? 🚀 Our latest blog breaks down the pros, cons, and fresh 2025 data from DistroWatch and Steam Surveys. Whether you're a gam...

  Cybersecurity experts have discovered a new attack that targets Linux systems using fake programming tools. These harmful tools were shared on GitHub, a popular website where developers post and download code. Inside these fake packages was dangerous malware designed to completely erase everything on a computer's hard drive. How the Attack Works The attackers used a type of programming module written in Go (Golang), a language often used by developers for creating server software. They uploaded three of these modules to GitHub, pretending they were useful tools for developers. However, once someone downloaded one of these modules, it secretly contacted another server and downloaded a harmful script without the user's knowledge. This script, once running, carried out a destructive command that wipes out all the data on the system’s main storage device. It replaces the existing information with zeroes, which makes the system completely unusable and all files impossible to recover. The attack is aimed directly at Linux computers and servers, and it checks to make sure it is running on a Linux system before carrying out the harmful actions. What Was Affected The three fake Go modules uploaded to GitHub had names that made them look like real software. They were: • github[.]com/truthfulpharm/prototransform • github[.]com/blankloggia/go-mcp • github[.]com/steelpoor/tlsproxy Each of these was designed to look like a normal tool. One claimed to help with data formatting, another with secure communications. Because they seemed helpful, developers could have easily included them in their projects without realizing they were dangerous. Why This Is a Serious Threat This type of attack is especially harmful because it wipes the entire system. It doesn't just delete files — it destroys the operating system, settings, and everything else on the main disk. Once this happens, the machine cannot be restarted, and the data cannot be brought back. Also, since the Go programming environment allows many developers to use similar names for packages, attackers can upload fake versions that look almost like the real thing. This makes it harder for users to tell the difference. What Can Be Done Developers should be careful when downloading code or tools from the internet. They should only use software from trusted and verified sources. Before adding a new module to a project, it's important to research it and check whether it comes from a reliable developer. This attack is a reminder that even trusted platforms like GitHub can be misused, and that one wrong download can lead to total data loss. Staying alert and verifying software before use is the best way to stay safe.

Microsoft Defender Security Research Team found that threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers to enable remote code execution while remaining dormant during normal traffic. The technique leverages cookie-gated activation, obfuscation, and cron-based recreation to create a self-healing persistence mechanism...

A sophisticated and elusive malware known as "Perfctl," has been discovered targeting millions of Linux servers worldwide.

A Linux malware, dubbed "perfctl," actively targeting millions of Linux servers worldwide, exploits over 20,000 server misconfigurations