Featured Linux Articles - Page 2

Discover LinuxSecurity Features

Keylogging in Linux (Part 1): Understanding Attacks and DefensesKeylogging in Linux (Part 1): Understanding Attacks and DefensesKeylogging in Linux (Part 1): Understanding Attacks and Defenses Keylogging in Linux (Part 1): Understanding Attacks and DefensesKeylogging in Linux (Part 1): Understanding Attacks and DefensesKeylogging in Linux (Part 1): Understanding Attacks and Defenses

Keylogging in Linux (Part 1): Understanding Attacks and Defenses

Keylogging turns up more often than people think. You see it in audits, red team work, and during investigations where credentials quietly leak through input streams. This piece breaks down how it actually happens on Linux — where keystrokes travel, how the system reports them, and how simple code can listen in.

MaK Ulac
Nov 12, 2025

Examining Open-Source Security: Benefits and Risks for the FutureExamining Open-Source Security: Benefits and Risks for the FutureExamining Open-Source Security: Benefits and Risks for the Future Examining Open-Source Security: Benefits and Risks for the FutureExamining Open-Source Security: Benefits and Risks for the FutureExamining Open-Source Security: Benefits and Risks for the Future

Examining Open-Source Security: Benefits and Risks for the Future

Open-source security sits right in the middle of how we build software now. Most teams grab code from public repos, plug it in, and move fast. That’s fine until something deep in the stack breaks or turns out to be risky. Transparency helps, but that value depends on the people behind it.

MaK Ulac
Nov 03, 2025

Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001 Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001

Linux: Tee.Fail Moderate TEE Side-Channel Attack for 2024-001

The tee.fail attack targets how Linux handles trusted execution environments. Think of it as a way to peek inside hardware-backed enclaves that should be locked tight. The attack plays with timing and cache behavior to pull data from those protected spaces, and researchers proved it works without needing full kernel access. That’s what makes it unsettling — it sidesteps the layers we usually rely on to keep sensitive code and keys safe.

MaK Ulac
Oct 29, 2025

Contribute to LinuxSecurity

Don’t sit on the sidelines of history. Join the Linux Security community
and write real news & articles about Linux that matters the most.

Contribute Now

The Linux Command Line: Bridging Security Awareness for SysadminsThe Linux Command Line: Bridging Security Awareness for SysadminsThe Linux Command Line: Bridging Security Awareness for Sysadmins The Linux Command Line: Bridging Security Awareness for SysadminsThe Linux Command Line: Bridging Security Awareness for SysadminsThe Linux Command Line: Bridging Security Awareness for Sysadmins

The Linux Command Line: Bridging Security Awareness for Sysadmins

I’ve been around Linux long enough to stop expecting much from intro books. Most of them walk through commands — maybe a few flags — and never explain why those commands behave the way they do. You end up memorizing steps instead of understanding the system underneath.

MaK Ulac
Oct 28, 2025

PAM: Important Risks in Linux Authentication Trust ChainPAM: Important Risks in Linux Authentication Trust ChainPAM: Important Risks in Linux Authentication Trust Chain PAM: Important Risks in Linux Authentication Trust ChainPAM: Important Risks in Linux Authentication Trust ChainPAM: Important Risks in Linux Authentication Trust Chain

PAM: Important Risks in Linux Authentication Trust Chain

PAM sits at the center of Linux authentication. Every login, SSH session, and privilege escalation request runs through it. It checks credentials, enforces policy, and chains together modules that decide who can access the system. Most teams rely on it daily without ever tracing what actually happens inside.

Dave Wreski
Oct 27, 2025

What is an Out-of-Bounds Write Linux Security Vulnerability?What is an Out-of-Bounds Write Linux Security Vulnerability?What is an Out-of-Bounds Write Linux Security Vulnerability? What is an Out-of-Bounds Write Linux Security Vulnerability?What is an Out-of-Bounds Write Linux Security Vulnerability?What is an Out-of-Bounds Write Linux Security Vulnerability?

What is an Out-of-Bounds Write Linux Security Vulnerability?

It starts as an innocuous bug. A developer miscalculates an offset, a boundary check is missing, a buffer is too small—just a simple oversight in code. But in the world of software security, even the smallest mistakes can rip holes in your defenses. Enter the out-of-bounds write Linux security vulnerability: a coding flaw with the potential to destabilize systems, corrupt data, or worse, create a direct path for attackers to execute malicious code. If you’re managing Linux systems—whether in production, testing, or anywhere in between—this is the kind of vulnerability you don’t ignore.

Brittany Day
Oct 18, 2025

CVE-2025-11371: Linux Security Must Prepare for Cross-Stack BreachCVE-2025-11371: Linux Security Must Prepare for Cross-Stack BreachCVE-2025-11371: Linux Security Must Prepare for Cross-Stack Breach CVE-2025-11371: Linux Security Must Prepare for Cross-Stack BreachCVE-2025-11371: Linux Security Must Prepare for Cross-Stack BreachCVE-2025-11371: Linux Security Must Prepare for Cross-Stack Breach

CVE-2025-11371: Linux Security Must Prepare for Cross-Stack Breach

CVE-2025-11371 doesn’t target Linux directly. It doesn’t need to.

MaK Ulac
Oct 13, 2025

Linux eBPF Security Advisory Addresses Kernel Visibility ConcernsLinux eBPF Security Advisory Addresses Kernel Visibility ConcernsLinux eBPF Security Advisory Addresses Kernel Visibility Concerns Linux eBPF Security Advisory Addresses Kernel Visibility ConcernsLinux eBPF Security Advisory Addresses Kernel Visibility ConcernsLinux eBPF Security Advisory Addresses Kernel Visibility Concerns

Linux eBPF Security Advisory Addresses Kernel Visibility Concerns

The Extended Berkeley Packet Filter (eBPF) was created to make Linux more observable and secure. It extends kernel functionality without requiring new modules or recompilation, enabling precise monitoring, tracing, and policy enforcement at runtime. For defenders, it promised transparency. For attackers, it opened a new space to hide.

MaK Ulac
Oct 10, 2025

Why Software Supply Chain Security Matters in Linux SystemsWhy Software Supply Chain Security Matters in Linux SystemsWhy Software Supply Chain Security Matters in Linux Systems Why Software Supply Chain Security Matters in Linux SystemsWhy Software Supply Chain Security Matters in Linux SystemsWhy Software Supply Chain Security Matters in Linux Systems

Why Software Supply Chain Security Matters in Linux Systems

For Linux users, software supply chain security means protecting the entire path from source to install. It covers who authors and reviews the code, how it is built, how artifacts and metadata are signed, where they are mirrored, and which keys the client trusts. In short: provenance, freshness, and scoped trust across the package pipeline.

MaK Ulac
Oct 01, 2025

Open-Source Vulnerability Assessment Tools & ScannersOpen-Source Vulnerability Assessment Tools & ScannersOpen-Source Vulnerability Assessment Tools & Scanners Open-Source Vulnerability Assessment Tools & ScannersOpen-Source Vulnerability Assessment Tools & ScannersOpen-Source Vulnerability Assessment Tools & Scanners

Open-Source Vulnerability Assessment Tools & Scanners

Computer systems, software, applications, and Linux servers are all vulnerable to network security threats. Failure to identify these cybersecurity vulnerabilities, often using a Linux vulnerability scanner, can leave companies vulnerable.

MaK Ulac
Sep 25, 2025

Top Linux Malware Scanners for Detection and System HardeningTop Linux Malware Scanners for Detection and System HardeningTop Linux Malware Scanners for Detection and System Hardening Top Linux Malware Scanners for Detection and System HardeningTop Linux Malware Scanners for Detection and System HardeningTop Linux Malware Scanners for Detection and System Hardening

Top Linux Malware Scanners for Detection and System Hardening

In this blog, we will break down the most relevant examples, so you’ll see exactly what kinds of attacks are active today and why scanning tools are necessary to catch them before they cause damage.

MaK Ulac
Sep 24, 2025

What Is a Speculative Execution Linux Security Vulnerability?What Is a Speculative Execution Linux Security Vulnerability?What Is a Speculative Execution Linux Security Vulnerability? What Is a Speculative Execution Linux Security Vulnerability?What Is a Speculative Execution Linux Security Vulnerability?What Is a Speculative Execution Linux Security Vulnerability?

What Is a Speculative Execution Linux Security Vulnerability?

Modern CPUs are fast—blindingly fast—partly because they don’t always wait around for instructions. Instead, they guess which calculations, memory fetches, or code branches might be needed next and execute those guesses ahead of time through a process called speculative execution.

Brittany Day
Sep 23, 2025

Disk Encryption: An Authoritative Guide for Linux UsersDisk Encryption: An Authoritative Guide for Linux UsersDisk Encryption: An Authoritative Guide for Linux Users Disk Encryption: An Authoritative Guide for Linux UsersDisk Encryption: An Authoritative Guide for Linux UsersDisk Encryption: An Authoritative Guide for Linux Users

Disk Encryption: An Authoritative Guide for Linux Users

A lost Linux laptop or a recycled server drive can leak everything on it — from system files to sensitive data. Disk encryption changes that. It locks the entire drive, and nothing can be read until the right key is supplied. In this guide, we’ll look at what disk encryption does, how it works on Linux, where it helps most, and the options that are still worth using in 2025.

MaK Ulac
Sep 23, 2025

What Is a Checksum? Meaning, Examples & Why You Should Use ThemWhat Is a Checksum? Meaning, Examples & Why You Should Use ThemWhat Is a Checksum? Meaning, Examples & Why You Should Use Them What Is a Checksum? Meaning, Examples & Why You Should Use ThemWhat Is a Checksum? Meaning, Examples & Why You Should Use ThemWhat Is a Checksum? Meaning, Examples & Why You Should Use Them

What Is a Checksum? Meaning, Examples & Why You Should Use Them

A checksum is a calculated value that represents the exact contents of a file or message. If the file changes — even by a single byte — the checksum changes as well. That’s why it’s often described as a digital fingerprint for data integrity.

MaK Ulac
Sep 16, 2025

What Is a Container Escape Vulnerability?What Is a Container Escape Vulnerability?What Is a Container Escape Vulnerability? What Is a Container Escape Vulnerability?What Is a Container Escape Vulnerability?What Is a Container Escape Vulnerability?

What Is a Container Escape Vulnerability?

For Linux admins and security professionals, containers are often the backbone of modern infrastructure. They’re lightweight, portable, and isolate applications in predictable, well-defined environments. But here's the flipside: containers aren’t impermeable fortresses. They have their flaws, and one of the most critical is the container escape vulnerability—a type of weakness that lets an attacker break out of the container’s restricted environment and gain unauthorized access to the host system.

Brittany Day
Sep 08, 2025

Exploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity ApplicationsExploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity ApplicationsExploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity Applications Exploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity ApplicationsExploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity ApplicationsExploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity Applications

Exploring Open Source Intelligence (OSINT) Techniques And Tools For Cybersecurity Applications

Open Source Intelligence (OSINT) is the practice of collecting information from published or publicly available sources for intelligence purposes.

Brittany Day
Sep 04, 2025

Linux Rootkits: Detecting, Preventing, and Surviving an AttackLinux Rootkits: Detecting, Preventing, and Surviving an AttackLinux Rootkits: Detecting, Preventing, and Surviving an Attack Linux Rootkits: Detecting, Preventing, and Surviving an AttackLinux Rootkits: Detecting, Preventing, and Surviving an AttackLinux Rootkits: Detecting, Preventing, and Surviving an Attack

Linux Rootkits: Detecting, Preventing, and Surviving an Attack

Let’s talk about a threat that’s smart, sneaky, and dangerous to your Linux systems: rootkits. If you’ve ever heard the term tossed around and wondered what a rootkit is and why it’s such a headache, you’re in the right place. These are not your usual malware nuisances—they’re tools that let attackers dig into a system, stay hidden for the long game, and potentially wreak havoc without leaving many breadcrumbs. For Linux admins and infosec pros, rootkits aren’t just pests; they’re an adversary that requires awareness, vigilance, and a specific approach to deal with.

Brittany Day
Sep 01, 2025

What Is A Virtual Private Network (VPN)?What Is A Virtual Private Network (VPN)?What Is A Virtual Private Network (VPN)? What Is A Virtual Private Network (VPN)?What Is A Virtual Private Network (VPN)?What Is A Virtual Private Network (VPN)?

What Is A Virtual Private Network (VPN)?

If you're managing a Linux environment, on-prem or in the cloud, chances are you've already tangled with questions of network security: firewalls, SSH hardening, package integrity checks — all the usual suspects. But Virtual Private Networks (VPNs)?

Brittany Day
Aug 31, 2025

What Is a Privilege Escalation Vulnerability?What Is a Privilege Escalation Vulnerability?What Is a Privilege Escalation Vulnerability? What Is a Privilege Escalation Vulnerability?What Is a Privilege Escalation Vulnerability?What Is a Privilege Escalation Vulnerability?

What Is a Privilege Escalation Vulnerability?

Imagine this scenario: you're managing Linux servers that host critical applications, where uptime is everything and security is non-negotiable. You're diligent about patching, monitoring, and hardening your systems against threats, but a breach occurs anyway. It's not flashy like a ransomware attack, nor is it obvious like failed login attempts—it’s hidden in plain sight. Someone found a way to elevate their access quietly, bypassing all the restrictions intended to keep users in their lane. That’s privilege escalation—a type of vulnerability that doesn’t kick in at step one of an attack but often paves the way for the worst-case scenario.

Brittany Day
Aug 28, 2025

RingReaper Malware: A Stealthy Challenge for Linux DefendersRingReaper Malware: A Stealthy Challenge for Linux DefendersRingReaper Malware: A Stealthy Challenge for Linux Defenders RingReaper Malware: A Stealthy Challenge for Linux DefendersRingReaper Malware: A Stealthy Challenge for Linux DefendersRingReaper Malware: A Stealthy Challenge for Linux Defenders

RingReaper Malware: A Stealthy Challenge for Linux Defenders

There’s a new tool of mischief in the Linux cybersecurity world, and it’s not just a cause for concern—it’s quite the wake-up call. "RingReaper" isn’t your run-of-the-mill Linux malware. It’s not brute-forcing its way into systems, making loud noises in your process lists, or flooding your logs with anomalous entries. No, this particular piece of malware operates like a whisper in the back of the room—quiet but deliberate, using technology that’s both cutting-edge and largely unfamiliar to traditional security solutions.

Brittany Day
Aug 24, 2025