Researchers have identified a new piece of Linux malware called Showboat, which has been targeting a telecommunications provider in the Middle East since at least mid-2022. This malware acts as a modular framework that allows attackers to gain remote access to systems, transfer files, and create a SOCKS5 proxy for further exploitation. The use of such a backdoor poses significant risks to the telecommunications infrastructure, potentially compromising sensitive data and disrupting services. As the attack has been ongoing for over a year, it raises concerns about the security measures in place within the affected organization and signals a growing trend of targeted attacks on critical sectors. Companies in similar industries should be vigilant and enhance their security protocols to protect against such sophisticated threats.
Articles tagged "Linux"
Found 69 articles
Recent reports indicate that Chinese advanced persistent threat (APT) groups are using a Linux backdoor called 'Showboat' to target telecommunications providers in Central Asia. This backdoor has been linked to espionage activities aimed at intercepting communications from smaller markets. The attacks raise concerns about the security of telecom infrastructure in the region, as they highlight how vulnerable these systems can be to state-sponsored hacking. The use of such sophisticated malware suggests that these APTs are not only looking to gather intelligence but also to potentially disrupt communications. As these attacks unfold, the implications for privacy and security in the telecommunications sector are significant, particularly for users relying on these services.
Infosecurity Magazine
A nine-year-old vulnerability in the Linux kernel, specifically related to the ptrace system call, has been identified by security researchers at Qualys. This flaw can allow attackers with local access to leak sensitive information, including SSH keys and password hashes. The issue affects various Linux distributions and could potentially be exploited by users who already have access to the system. This highlights a significant security risk as it can enable further attacks or unauthorized access if sensitive credentials are compromised. System administrators should prioritize reviewing their systems for this vulnerability and implementing necessary security measures to protect against potential exploitation.
Researchers have revealed a vulnerability in the Linux kernel, identified as CVE-2026-46333, which has remained unnoticed for nine years. This flaw involves improper privilege management, allowing unprivileged local users to access sensitive files and execute commands with root privileges on default installations of several major Linux distributions. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level. Affected users include those running various Linux distributions, which could expose them to significant risks if exploited. It's crucial for system administrators and users to be aware of this vulnerability and take appropriate action to secure their systems.
Security Affairs
A newly discovered Linux local privilege escalation vulnerability, named PinTheft, affects the RDS subsystem and has a public exploit available. This flaw poses a significant risk to Arch Linux users, as they are particularly vulnerable to attacks utilizing this exploit. The vulnerability was identified by the V12 security team, and given the increasing number of similar security issues in Linux, users are urged to take immediate action. Patching the affected systems is crucial to prevent potential exploitation. This incident serves as a reminder for users and administrators to stay vigilant and regularly update their systems to safeguard against emerging threats.
A new vulnerability known as PinTheft has been identified in Arch Linux systems, allowing local attackers to escalate their privileges to root. This flaw has been patched recently, but now a proof-of-concept exploit has been released publicly, which could make it easier for malicious actors to take advantage of the vulnerability. Users running Arch Linux should be particularly vigilant, as this could lead to unauthorized access and control over affected systems. The presence of a publicly available exploit raises concerns about potential attacks, especially in environments where security measures may not be robust. It’s crucial for users to apply the latest patches and updates to mitigate the risks associated with this vulnerability.
Researchers recently released a proof of concept (PoC) for a vulnerability in the Linux kernel known as DirtyDecrypt, which was patched back in April. This vulnerability allows local attackers to gain elevated privileges, potentially giving them root access to affected systems. While the vulnerability was addressed in a previous update, the release of the PoC means that those who haven't applied the patch could be at risk. It is crucial for users and administrators of Linux systems to ensure they are running the latest updates to mitigate this risk. The implications of this vulnerability are significant, especially for environments where security is paramount, such as servers and critical infrastructure.
A recently discovered vulnerability in the Linux kernel's rxgk module allows attackers to escalate their privileges and gain root access on certain systems. This flaw has been patched, but a proof-of-concept exploit is now available, which can be used by malicious actors to take control of affected machines. Users of Linux systems, particularly those running versions that include the vulnerable module, are at risk. It's crucial for system administrators to apply the latest patches to protect against potential exploitation. The existence of an exploit in the wild raises significant concerns about the security of Linux environments, especially in sensitive applications.
Security Affairs
Researchers have identified a new vulnerability in the Linux kernel, named Fragnesia and tracked as CVE-2026-46300, which could allow local attackers to gain root access through page cache corruption. This flaw affects the XFRM ESP-in-TCP subsystem and has a CVSS score of 7.8, indicating a significant risk. If exploited, it could enable attackers to take complete control of the affected systems. It's crucial for users of affected Linux systems to be aware of this vulnerability and take necessary precautions. The disclosure of this flaw highlights ongoing security challenges within the Linux ecosystem.
Help Net Security
CVE-2026-46300Researchers have discovered a new local privilege escalation vulnerability in the Linux kernel, identified as CVE-2026-46300, and nicknamed 'Fragnesia.' This vulnerability is related to the earlier Dirty Frag bugs and affects the xfrm-ESP Linux module. The flaw was unintentionally introduced when a patch was applied to fix one of the original Dirty Frag vulnerabilities, specifically CVE-2026-43284. This means that systems using the affected module could be at risk, potentially allowing attackers to gain elevated privileges. It is crucial for users and administrators of Linux systems to stay informed about this issue and apply necessary updates as they become available.
Infosecurity Magazine
A new vulnerability known as the Fragnesia flaw has been discovered in the Linux kernel, allowing unprivileged local users to escalate their privileges to root access. This flaw poses a significant risk as it enables attackers with local access to gain complete control over affected systems. Researchers have indicated that various Linux distributions could be impacted, making it crucial for system administrators to assess their environments. The potential for exploitation is concerning, especially in multi-user setups where unauthorized users could exploit this flaw to compromise system integrity. Users and administrators should prioritize patching their systems to mitigate the risk associated with this vulnerability.
A new vulnerability named Fragnesia has been discovered in the Linux kernel, marking the third major flaw identified within two weeks. Researchers indicate that artificial intelligence tools are accelerating the process of uncovering these security issues, often faster than developers can implement fixes. This vulnerability could potentially affect a wide range of Linux-based systems, posing risks to users and organizations relying on this operating system. The ongoing discovery of these flaws raises concerns about the security of Linux environments, especially as they are commonly used in servers and critical infrastructure. As the situation develops, it is essential for users to stay informed and apply necessary updates to protect their systems.
A new variant of a local privilege escalation vulnerability in the Linux kernel, named Fragnesia, has been identified. This vulnerability, tracked as CVE-2026-46300 with a CVSS score of 7.8, allows local attackers to gain root access through page cache corruption. This marks the third such vulnerability discovered in the Linux kernel within just two weeks, raising concerns for users and administrators. The flaw is rooted in the kernel's XFRM component, which is responsible for managing IPsec protocols. This means that systems using affected kernel versions could be at risk if not addressed promptly, as attackers could exploit this vulnerability to gain elevated privileges and potentially take control of vulnerable systems.
SCM feed for Latest
Sasha Levin, a co-maintainer of the Linux kernel, has introduced a proposal for a runtime killswitch designed to disable vulnerable kernel functions temporarily. This mechanism would be accessible through securityfs, allowing system administrators to quickly mitigate risks associated with known vulnerabilities. The proposal aims to provide a practical solution for managing vulnerabilities in the Linux kernel, which is critical given the widespread use of Linux in servers and devices. By enabling a quick response to potential exploits, this initiative could help enhance the security posture of systems utilizing the Linux kernel. The implementation of such a killswitch is especially relevant as cyber threats continue to evolve, targeting vulnerabilities in operating systems.
Schneier on Security
A newly disclosed Linux vulnerability, dubbed 'copy.fail', poses a serious risk across multiple distributions, including Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and Fedora. Revealed by Theori on April 29, 2026, this local privilege escalation flaw allows attackers to manipulate the Linux kernel's crypto API to write unauthorized data into the page cache of files they do not own. Importantly, the exploit does not modify files on disk, making it difficult for traditional monitoring tools like AIDE and Tripwire to detect. This vulnerability is concerning because it affects a wide range of systems without requiring any specific modifications for different distributions. Organizations using these Linux variants should prioritize assessing their security posture and applying necessary mitigations to protect against potential exploitation.