Tag: Linux
All articles about Linux.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Exploited UnrealIRCd flaw CVE-2026-114713 lets any user run commands with server authority
On Friday 13 November 2026 CISA added CVE-2026-114713, a flaw in the UnrealIRCd IRC server, to its Known Exploited Vulnerabilities catalog and gave federal agencies just three days to fix it. The bug in the labeled-response module lets any user on a network with two or more linked servers inject server-to-server commands that are executed with server authority, such as KILL or GLINE. The project's maintainer called it the most critical UnrealIRCd issue in 15 years. The fix shipped on 7 November as version 6.2.7.1 and as a hot-patch that needs no restart.
Patch available
PostgreSQL fixes 52 security flaws; the worst, CVE-2026-6460, lets a database user run code on the server
On Thursday 12 November 2026 the PostgreSQL project released 18.7, 17.12, 16.16, 15.20 and 14.25, fixing 52 security vulnerabilities and more than 140 other bugs. The one to focus on is CVE-2026-6460 (CVSS 8.8): a user who can create objects in the database can trigger a type confusion after ALTER … SET DATA TYPE and run arbitrary code as the operating system account the database runs under. Full protection also requires rebuilding C-language extensions. No exploitation has been reported. PostgreSQL 14.25 is the final release of the 14 branch.
Patch available
Apache HTTP Server 2.4.71 fixes a critical mod_http2 flaw that can lead to remote code execution
The Apache HTTP Server project released version 2.4.71 on 11 November 2026. It fixes three vulnerabilities, one of them critical: CVE-2026-119618 in mod_http2, the module that handles HTTP/2. A race condition while processing headers can corrupt the heap and, according to Apache, lead to remote code execution. Versions 2.4.55 through 2.4.70 with HTTP/2 enabled are affected. There are no reports of exploitation so far. Here is how to check whether your server is exposed and what to do until your distribution ships a fixed package.
Actively exploited
Attackers abuse GSocket for stealthy access to Linux servers
On 11 November 2026 Microsoft published an analysis of intrusions in which attackers, after breaking in through a vulnerable web application, install the legitimate open-source tool GSocket on Linux servers. The connection goes out through a shared relay network, so inbound firewall rules never see it, and the attackers keep access even after the original flaw is patched. The write-up includes paths, hashes, domains and hunting queries.
Critical
Firefox 160 fixes 99 flaws, 57 rated high and nine sandbox escapes - update ESR too
Mozilla shipped Firefox 160 on 10 November 2026, along with Firefox ESR 153.7 and 115.45. The Firefox 160 advisory alone lists 99 vulnerabilities, 57 of them rated high. Mozilla describes nine of those as sandbox escapes, meaning flaws that can break the isolation meant to keep a malicious page away from the operating system. There are no reports of exploitation so far. Here is what to update and how to check it across a fleet.
Actively exploited
Openwave Webtop Media Transcoder: an old document converter flaw is now exploited
Run Openwave Webtop webmail for your customers? Media Transcoder versions before 1.1.22.0 ignore the file type restrictions the administrator has set. The vendor has confirmed attacks and CISA added the flaw to its exploited list on 10 November, even though the vendor says the fixed release shipped back in December 2021.
Actively exploited
IBM Aspera Faspex: an authorization flaw hands users full admin rights, and it is already exploited
Use IBM Aspera Faspex 5 to move large files? On 7 November 2026 IBM fixed CVE-2026-123218, which lets an ordinary signed-in user take full administrative control. Two days later CISA added it to its list of known exploited vulnerabilities and gave US federal agencies only until 12 November to fix it.
Actively exploited
Attackers exploit a critical Xen Orchestra flaw to take over XCP-ng virtualization
On 10 November 2026 Vates published security advisory VSA-2026-062 for a critical flaw in Xen Orchestra, the web management console for XCP-ng. An unauthenticated attacker can make REST API requests as the owner of a valid login token, typically an administrator, and from there run code on managed XCP-ng hosts as root. Vates says a threat actor is already exploiting it. Fixed xo-server 5.213.1 and 5.211.2 shipped the same day.
Actively exploited
Cisco BroadWorks: an August XXE flaw is now exploited, and attackers are stealing server private keys
Run Cisco BroadWorks? CVE-2026-20320 has been fixed since 19 August 2026, but CISA added it to its exploited list on 10 November. Malbear Labs has described an intrusion at a European telecoms provider in which the attacker used it to steal the server's private keys and certificates.
Actively exploited
CopperDragon supplies China-nexus spies with the Sparrow toolset
On 10 November 2026 Check Point Research published a year-long investigation into the Sparrow tool family and its likely developer, which it calls CopperDragon. According to CPR, several China-nexus espionage groups share the tools against telecoms, governments and the military – and one of the three campaigns it describes used compromised websites showing a fake Chrome certificate error.
Actively exploited
FreeSWITCH: one SIP MESSAGE is enough to run commands on your VoIP server
Run a PBX, contact centre or VoIP service built on FreeSWITCH? Check your version now. Attackers are already exploiting CVE-2026-116779, according to both the vendor and CISA, and the fix is in 1.11.3.
Critical
Ruby on Rails fixes 21 flaws – a crafted image upload can make ImageMagick write and read server files
On 4 November 2026 the Ruby on Rails team shipped security releases 8.1.4.1 and 8.0.5.2, fixing 21 vulnerabilities. The worst is in Active Storage, the part of Rails that handles file uploads: an app that analyses images with ImageMagick can let an unauthenticated attacker write files on the server and, in common setups, read them – secret keys included.
Actively exploited
OpenSSH on Alpine Linux: attackers can log in over SSH without knowing the password
Run servers, VMs or containers on Alpine Linux with an SSH server? Check your openssh package. Under certain conditions, CVE-2026-123158 lets anyone in who sends a long enough password. OpenSSH and Alpine shipped fixes on 5 November 2026, and attackers have been exploiting it since 7 November.