Do Son CISA, FBI, and HHS issue a joint advisory on Interlock ransomware, active since Sep 2024, targeting businesses and critical infrastructure with double extortion tactics.
Linux
Firefox v141.0 rolls out with new AI-powered tab grouping that keeps your data local, significant memory optimizations for Linux, and WebGPU support for Windows users.
AhnLab uncovers SVF Bot, a Python-based DDoS botnet abusing Discord as its C&C channel to target misconfigured Linux servers and launch HTTP/UDP floods.
Intel has officially discontinued Clear Linux OS, its high-performance distribution. This move, part of broader cost-cutting, ends a decade of innovation and requires users to migrate immediately.
Debian 13 "Trixie" is entering full freeze on July 27 and launching August 9, marking the first official release with RISC-V architecture support.
Ubuntu 24.10 "Oracular Oriole" reaches End of Life today, July 10, 2025. Upgrade to Ubuntu 25.04 or 24.04 LTS to ensure continued security and support!
Trend Micro uncovers BERT ransomware (Water Pombero) deploying multi-threaded variants against Windows, Linux, and ESXi systems, showing code similarities to REvil's Linux variant.
NSFOCUS uncovers Hpingbot, a rapidly evolving Go-based botnet using Pastebin for payloads and hping3 for DDoS. It targets Windows/Linux/IoT, focusing on stealth and persistence.
APT36 (Transparent Tribe) is now targeting Indian government agencies via BOSS Linux with spear-phishing. It uses malicious .desktop files to deploy Go-based malware for espionage.
A critical Linux flaw (CVE-2025-6019) in udisksd/libblockdev allows local privilege escalation to root. PoC available. Update now to secure your system!
A flaw (CVE-2025-53367, CVSS 8.4) in DjVuLibre allows remote code execution on Linux via out-of-bounds write. PoC is available; patch to v3.5.29 immediately.
FortiGuard Labs exposes RondoDox, a stealthy botnet exploiting critical flaws (CVE-2024-3721, CVE-2024-12856) in TBK DVRs & Four-Faith routers to launch sophisticated DDoS attacks.
A flaw (CVE-2025-6297, CVSS 8.2) in dpkg-deb allows DoS via disk quota exhaustion by leaving temporary files. Update immediately to prevent system instability.
ASEC uncovers attacks on Linux servers installing legitimate proxy software (TinyProxy, Sing-box) to hijack resources for covert operations, bypassing traditional malware detection.
Two Sudo flaws (CVE-2025-32463 & CVE-2025-32462) allow local users full root via PoC. Critical privilege escalation vulnerabilities revealed by Stratascale CRU.
ASEC uncovers sophisticated attacks targeting South Korean Windows IIS and Linux systems, deploying WogRAT, MeshAgent, and SuperShell for cyber-espionage and lateral movement.
SecurityScorecard's STRIKE team exposes "LapDogs," a covert China-Nexus ORB network with 1,000+ infected SOHO devices, using the custom ShortLeash backdoor for cyberespionage.
Intel GPUs face up to 20% performance loss from security mitigations. Ubuntu is considering disabling them in compute stacks, as Intel itself allows unmitigated builds due to minimal risk.
The Prometei botnet is back with a stealthy Linux variant, actively mining Monero and stealing credentials. It uses DGA, custom UPX packing, and sophisticated anti-analysis techniques.
A C++ backdoor named Pickai is actively exploiting ComfyUI servers, compromising nearly 700 AI image generation hosts and posing a supply chain risk
A high-severity flaw (CVE-2025-6020) in Linux PAM's pam_namespace allows unprivileged users to gain root via symlink attacks and race conditions.
Qualys uncovered two critical Linux flaws (CVE-2025-6018, CVE-2025-6019) allowing local root privilege escalation via PAM and UDisks. Patching is urgent for major distros.