vendors/linux.htmlSecurity news, advisories and CVEs for LinuxMon, 19 Oct 2026 12:28:44 GMT https://cybersecuritynews.com/hackers-use-ai-generated-scripts/hrr3laFri, 16 Oct 2026 13:23:48 GMTCybersecurity News. A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users’ shell startup files to…AI https://news.google.com/rss/articles/CBMiX0FVX3lxTE8wYjRFSUVsa0d1SWE4T2x4ekYwWDZwQWo2akpEb2NXYy1jYXBocVYtMHIzYl9hSjE4OWFKcE9FV3RrUEJMZXR0N1JvTTEzOFNZVkhlSjhBZTFET2V0Ukx30gFkQVVfeXFMTzVNcUVjU1BCU0ZSaWlGZ3IyNTJ5alJVWU5iNjYyWG9OSWxfNWs2Q0VWVTg1NERNVXdoem1vUWY4Slc2X2w2UTN1Q0czNnMyNnpzR3MyVUlyZnY2c0VXd3MzaHpSOQ?oc=51d2vb0cFri, 16 Oct 2026 04:08:40 GMTCybersecurity News. Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of Hosts CyberSecurityNewsVulnerability https://cybersecuritynews.com/linus-torvalds-use-claude-code-patches/dwa8zaFri, 16 Oct 2026 04:07:53 GMTCybersecurity News. Linus Torvalds has disclosed that Claude Code helped write Linux kernel patches, test programs, review material, and the first draft of a technical write-up under his direction. The work targets page-cache read performance, showing how AI coding tools are…VulnerabilityAI https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/1vf7y91Thu, 15 Oct 2026 22:00:09 GMTUnit 42. Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.ResearchAPTAI https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html1sbpu0qThu, 15 Oct 2026 20:24:36 GMTThe Hacker News (+3 more sources). A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked…AdvisoryVulnerability https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/3880lmThu, 15 Oct 2026 17:12:31 GMTBleepingComputer (+1 more sources). A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]MalwareSupply chain https://news.google.com/rss/articles/CBMickFVX3lxTE9lWUJ0NXAzMGJWMTQ2Vm13MjdtQ1VnVm1tXzVUU1dSZW12OHVlWjFxRTBmM19mMU5DTjlsdjMtTmZ6V0hmMkF2VGI2WE9YRXBKU01RblRtZHVWUW9wVEhrLWdZRGxUX28tYXE0RkgzOXlGUdIBd0FVX3lxTE9pWjhlY3AtQWkzRUptN0d6ZklsOXBXdUs1TWN4bkJkQVhBWDBBaFZ4aTc1VThkMTJtMTk1b0l0dF9lZ2VWZ1BHOGxqakp3a0Y0ZmVtNnNPNXZPNTJNenlCb1JGN0ZPYVRHSXFKMDhsN3ZXamJxZWxJ?oc=51z1rctWed, 14 Oct 2026 13:22:11 GMTCybersecurity News. PoC Released for Linux Vhost Flaw Enabling Root Privilege Escalation and VM Escape CyberSecurityNewsVulnerability https://thehackernews.com/2026/10/ai-found-linux-kernel-flaw-gives-local.html1vl5xytWed, 14 Oct 2026 07:46:57 GMTThe Hacker News (+1 more sources). A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the…VulnerabilityAI https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.htmlfcin62Fri, 09 Oct 2026 12:59:22 GMTThe Hacker News. Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its…Vulnerability https://www.helpnetsecurity.com/2026/10/07/openssh-10-6-released/1psekbpWed, 07 Oct 2026 05:12:21 GMTHelp Net Security. The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have received a large number of security reports, many found by AI models or with AI help, and…VulnerabilitySupply chain https://thehackernews.com/2026/10/linux-backdoors-impersonate-email.htmltq0w5xTue, 06 Oct 2026 18:24:25 GMTThe Hacker News. Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious…Malware https://www.infosecurity-magazine.com/news/smtp-linux-backdoors-network-edge/qtc6opMon, 05 Oct 2026 14:00:00 GMTInfosecurity Magazine. Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and TaiwanMalware https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/vzi8byMon, 05 Oct 2026 13:00:00 GMTSecurityWeek. ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation.VulnerabilityMalware https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructurearfncxMon, 05 Oct 2026 13:00:00 GMTFortiGuard Labs (+1 more sources). FortiGuard Labs examines how ClingSTUN exploits vulnerable devices and abuses public STUN servers to support a Linux proxy backdoor.ResearchVulnerabilityMalware https://www.darkreading.com/threat-intelligence/malicious-linux-implants-mimic-asian-mail-securityhbvu6sFri, 02 Oct 2026 13:00:00 GMTDark Reading. A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.Malware https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html1ob80tdTue, 29 Sep 2026 17:20:17 GMTThe Hacker News. A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across…VulnerabilityBreach https://www.bleepingcomputer.com/news/security/new-spectre-v2-attack-variant-leaks-linux-root-password-hash-in-minutes/yox74Tue, 29 Sep 2026 17:10:11 GMTBleepingComputer. A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...]Breach https://www.elastic.co/security-labs/blog/linux-endpoint-management-elastic-workflowsidou29Tue, 29 Sep 2026 00:00:00 GMTElastic Security Labs. Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Codex config onto new laptops without piling up duplicate actions on offline hosts, and it works for other config too.Research https://news.google.com/rss/articles/CBMiogFBVV95cUxOYnNWdUdXT0d5YkhSLWdyM05LSHJuTldZcFJLbElRRWtDc3A2N24wQ3lvZ3pmRHRPTmtLQWdKMW9mTXRCQzByWE9jQ1lMeERJSEtUMmJ6MDlVYks0dFplbUx2Y01Ea3NCdUU3V3dFaGVJTVQ0UGhVaG9KVkQ0NGhISlNNVHpDMFh4TnhEN2VmSks1U1JYbHBsTFNnYnBXWC1fLWc?oc=5157lbtrSun, 27 Sep 2026 07:00:00 GMTQualys Threat Research. CISA BOD 26-04 Timelines for Three Linux Kernel CVEs QualysResearch https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/52986721d2yftThu, 24 Sep 2026 17:00:00 GMTThe Register. Security researchers report that Microsoft considers the side-channel leak of file events to be by designVulnerability https://blog.qualys.com/product-tech/2026/09/23/cisa-bod-26-04-timelines-for-three-linux-kernel-cves1qk8p5jWed, 23 Sep 2026 15:00:00 GMTQualys Threat Research (+1 more sources). Executive Summary CISA added three actively exploited Linux kernel vulnerabilities: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog on September 18, 2026, triggering a 3-day remediation deadline that passed on September 21. Under CISA…ResearchVulnerabilityZero-dayAdvisory