linuxsecurity.com / .linuxsecurity-com-linuxsecurity-articles / Page 2

Most of us don't hear about a kernel vulnerability until a CVE lands in our inbox or the vulnerability scanner starts complaining. By then, the patch isn't new anymore. Kernel developers may have been passing it around for review, arguing over the .. ...

Spin up a fresh Linux VPS with default settings and check /var/log/auth.log ninety seconds later. There will already be failed login attempts -- not dozens, hundreds, sometimes before the deployment script has even finished running.

Every Linux server in your fleet produces thousands of events every minute. From journald logs and auditd records to kernel-level eBPF hooks, your systems are constantly talking. Most of that noise is just the mundane churn of system services, CI/CD ...

If you're running Gitea in a container, stop what you're doing and check your versioning right now. We're looking at a critical vulnerability--CVE-2026-20896--shipped directly in Gitea's official Docker images. It's a 9.8 CVSS-rated 'open door' that ...

There was a time when Linux meant server rooms and hobbyist forums. These days it's on regular laptops, and a big part of that is people getting fed up with commercial operating systems scraping their data, shipping telemetry nobody asked for, and .. ...

There's a gap between what Linux systems log by default and what you actually need to detect a compromise. Most environments have logging active, which creates a sense of coverage that doesn't hold up under investigation.

When you're digging through an incident, your logs are the only thing you can actually trust. The problem is, attackers know that too. If someone gets root on your server, their first move is almost always to delete the evidence and cover their ...

Security scanners flag exposed API keys in public repositories every day. The initial response is usually predictable: delete the commit, revoke the credential, and move on. That's a mistake.

Root access on a Linux system rarely arrives through a zero-day.

When an attacker breaks into a Linux system, their work is rarely done. Usually, the real work starts after the initial exploit: hiding their tracks. If you're a Linux admin or security analyst, there is nothing worse than logging in, running a few . ...