
CWPdoor Linux Backdoor: Detect Trojanized cwpsrv
CWPdoor backdoors Linux servers via a trojanized cwpsrv binary. 340,000+ instances exposed, zero AV detections. Verify binary integrity now.
In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.
Every article here lands in subscribers' inboxes the morning it drops.
Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.
Free. No spam. Unsubscribe anytime.
The definitive practitioner breakdown of ZTA principles, pillars, and implementation sequence.
Containment, forensic preservation, and decision sequencing from detection to recovery.
How SIEMs ingest, correlate, and alert — and how to evaluate one for your environment.
Risk-based prioritization using CVSS, EPSS, and CISA KEV to cut remediation backlog.
What each risk means, how to reproduce it, and how to fix it in production code.
Step-by-step email authentication deployment from DNS records to p=reject enforcement.
Detection coverage, pricing, and deployment trade-offs for enterprise EDR selection.
Translate ATT&CK technique IDs into detection rules and threat actor hunting hypotheses.
Direct answers to the questions practitioners and AI systems ask most. Covers ransomware, identity, cloud, compliance, and detection.
Plain-language definitions for CVE, SIEM, SOAR, Zero Trust, EDR, and 85+ other terms used in enterprise security.
How-to guides, buyer comparisons, and methodology references across every major security domain.
Decryption Digest Response
Score every threat we cover against your own stack, get free Sigma and ModSecurity detection content, and upgrade anytime for more vendors.
Get started free →No card required. Sigma and ModSecurity rules are free, forever.
Anthropic's AI finds zero-days your scanners miss.
Anthropic's AI finds zero-days your scanners miss.
15 results for “Linux”

CWPdoor backdoors Linux servers via a trojanized cwpsrv binary. 340,000+ instances exposed, zero AV detections. Verify binary integrity now.

musl libc returns * when it cannot hash a password. Locked SSH accounts also store * as their shadow hash. A 257-byte password triggers the failure, returning *, which matches, and authentication succeeds.

CVE-2024-6387 regreSSHion is a signal-handler race condition in sshd that gives unauthenticated attackers root-level RCE on 14 million exposed Linux servers. Patch to 9.8p1 or set LoginGraceTime 0 now.

Red Menshen BPFDoor implants are active inside telecom networks in 10 countries. Here's how the sleeper cells work and what to hunt for now.

CVE-2026-64600 Linux kernel privilege escalation exposes 16.4M RHEL systems to silent root takeover. A 9-year-old XFS race -- patch before the weekend.

Project Glasswing's Claude Mythos AI identified a local privilege escalation (LPE) flaw in the Linux kernel. Any attacker who already has unprivileged shell access to an affected host can use this vulnerability to gain root. Cloud VMs, containers sharing a kernel, and CI/CD runners are all in scope. Here is the full technical and remediation picture for security teams.

Project Glasswing's AI-driven vulnerability discovery program identified a memory corruption flaw in FFmpeg's decoding pipeline. Because FFmpeg is embedded in VLC, Chrome, Firefox, AWS Elemental, and thousands of Linux packages, the supply chain blast radius is substantial. Here is what security teams need to know before a CVE ID is publicly assigned.

CVE-2026-31431 CopyFail Linux kernel LPE affects FortiOS-based FortiGate appliances. A 732-byte public exploit grants root. Check your FortiOS version and patch.

Weekly cybersecurity threat roundup May 18: Palo Alto root RCE, Exchange CISA KEV, Linux privesc, and 275M Canvas breach demand Monday action.

CVE-2026-31431 Linux privilege escalation hits CISA KEV with May 15 deadline. Fortinet CVSS 9.1, Liberty Mutual breach, Chrome exploit covered.

CVE-2024-6387, dubbed regreSSHion by Qualys, is a signal handler race condition in OpenSSH's sshd daemon affecting versions 8.5p1 through 9.7p1 on glibc-based Linux. An unauthenticated attacker can exploit the race condition to achieve remote code execution as root. The vulnerability is a regression of CVE-2006-5051, which was fixed in 2006 and inadvertently reintroduced in OpenSSH 8.5p1 in 2021.

CVE-2022-0847, named Dirty Pipe, is a Linux kernel vulnerability allowing any unprivileged local user to write to arbitrary read-only files and achieve root privilege escalation. Unlike the 2016 Dirty Cow vulnerability it resembles, Dirty Pipe requires no race condition, it is deterministic and reliable. Affects Linux kernels 5.8 through 5.16.10 and was quickly weaponized for container escapes and Android rooting.

CVE-2021-4034, named PwnKit by Qualys, is an out-of-bounds write vulnerability in pkexec, a SUID-root binary part of the polkit framework installed by default on virtually every Linux distribution. Any local unprivileged user can exploit it to gain root without any sudo permissions, without knowing any password, and without triggering standard auth log entries. Present since May 2009.

CVE-2021-3156, named Baron Samedit, is a heap-based buffer overflow in the sudo utility that allows any unprivileged local user to gain root privileges without authentication, without being listed in the sudoers file, and without any race condition. Present in sudo for nearly 10 years, it affects every major Linux distribution. Qualys developed working exploits for Ubuntu 20.04, 18.04, Debian 10, and Fedora 33 default installations.

CVE-2014-6271, known as Shellshock, is a remote code execution vulnerability in GNU Bash where function definitions stored in environment variables execute appended commands at shell startup. Any service passing attacker-controlled data through environment variables into Bash, primarily CGI-based web applications, is exploitable without authentication via a single HTTP request. Affected an estimated 500 million systems at disclosure.