Do Son A new supply chain attack on PyPI is delivering SilentSync, a Python RAT. The malware steals credentials and files from developers' systems.
Linux
A new Linux kernel vulnerability, CVE-2025-21692, can be exploited to achieve remote code execution by manipulating the ETS qdisc, a simple but critical flaw.
A new Linux kernel flaw, CVE-2025-38501, exposes KSMBD servers to unauthenticated remote DoS attacks. A public PoC is available now.
Wine 10.15 is here with a new NTSYNC driver that promises to boost Windows game performance on Linux, paving the way for Proton 11.
New patches for CUPS, the open-source Linux printing system, fix two flaws that can lead to remote DoS and authentication bypass.
A new Linux botnet, Luno, combines cryptomining and modular DDoS attacks. It's a "self-healing" threat that targets gaming platforms and disguises itself as legitimate processes.
CISA adds three new vulnerabilities to its KEV Catalog, including flaws in the Linux kernel, Android Runtime, and Sitecore CMS. All are being actively exploited.
Are antivirus warnings when downloading a Linux ISO a conspiracy? This article explains why security software might flag these files as dangerous.
A new vulnerability (CVE-2025-8067) in the Linux UDisks daemon allows unprivileged users to escalate privileges or cause a denial of service. Admins are urged to patch.
Kaspersky's Q2 2025 report reveals a surge in vulnerabilities, with attackers exploiting classic flaws in Windows and WinRAR while adapting to AI and low-code platforms.
A new report reveals that the Pakistan-linked APT36 is now targeting Indian government and defense entities with Linux-specific malware delivered via Google Drive.
A new report reveals a dangerous Linux malware campaign that uses malicious filenames to execute a stealthy, fileless attack without the victim's knowledge.
A new report reveals that the Pakistan-based APT36 is targeting Indian government entities using spear-phishing and Linux-specific malware to steal sensitive data.
A Red Canary report reveals attackers are exploiting an Apache ActiveMQ flaw to breach Linux systems, then patching the vulnerability to hide their presence.
A JPCERT/CC report reveals a new attack campaign using CrossC2 and a custom loader to compromise both Linux and Windows systems.
BadCam: Critical Flaws in Lenovo Linux Webcams Allow Remote BadUSB Attacks and Persistent Infections
BadCam: Critical Flaws in Lenovo Linux Webcams Allow Remote BadUSB Attacks and Persistent Infections
Eclypsium researchers have uncovered a new class of BadUSB attacks, which leverage critical flaws in Linux-based Lenovo webcams to deliver persistent payloads and bypass security.
A critical vulnerability (CVE-2025-46811, CVSS 9.8) in SUSE Manager allows unauthenticated remote command execution with root privileges on all managed Linux clients.
Group-IB uncovers how UNC2891 used Linux bind mounts (MITRE T1564.013) to hide a physical ATM cyberattack, involving a Raspberry Pi and a plan to tamper with HSMs for fraudulent withdrawals.
Trend Micro reports Gunra ransomware has expanded to Linux, employing 100 parallel encryption threads, partial encryption, and stealthy keystore methods to target global enterprises.
Aqua Security's Nautilus team discovered Koske, an advanced Linux cryptojacker likely crafted by AI, hiding in panda images and using rootkits for stealthy operations.
Google's Android Terminal app in the latest Canary build now supports graphical Linux applications via a Debian VM, bringing a full desktop experience to your phone.
Wiz Research uncovers Soco404, an evolving cryptojacking operation exploiting cloud misconfigurations and PostgreSQL to stealthily mine cryptocurrency across Linux and Windows.