⚠️ China-linked spies hid where security tools often don’t look.

They used BRICKSTORM, PLENET, and AGENTPSD on #Linux appliances, including Egnyte Storage Sync, pfSense, and Synology NAS.

The access lasted at least 18 months.

Full story: https://thehackernews.com/2026/06/verdantbamboo-deploys-bsd-variant-of.html

🚨 A single stray "!" in the #Linux kernel's firewall code (nftables).

That one character let any normal logged-in user become root, and step out of the container.

The fix? One line.

And the exploit (CVE-2026-23111) to abuse it just went public.

Read: https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html

🚨 A China-linked hacking group hid inside a network for nearly 10 years.

Not by dropping obvious malware, but by quietly changing the #Linux login software itself.

Researchers say Velvet Ant backdoored PAM and OpenSSH components to steal credentials, log commands, and keep access inside a network with no direct internet access.

Read the full story: https://thehackernews.com/2026/06/china-linked-hackers-backdoored-linux.html

🚨 Attackers hijacked 400+ Arch #Linux AUR packages by taking over abandoned projects and changing their build scripts.

The payload stole developer secrets, targeted tokens and SSH keys, and could hide with an eBPF rootkit if it ran as root.

If you used AUR after June 11, check your system.

Details ➝ https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html

🚨 A backdoor once thought to target #Linux has now moved to Windows.

ESET found two Windows versions of SprySOCKS, linked to a China-nexus espionage group.

One version uses kernel drivers to hide files, processes, registry keys, and network connections.

Read ➝ https://thehackernews.com/2026/06/china-linked-sprysocks-backdoor-expands.html

🛑 A new #Linux kernel flaw lets a local user rewrite /usr/bin/su in memory and gain #root.

The file on disk never changes. No audit trail.

DirtyClone (CVE-2026-43503) is the fourth bug with this failure mode in two months.

Details and what to do ↓ https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html

🛑 A new #Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk.

It poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean.

The root shell is already open.

Details here ↓ https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html

⚡ New "Bad Epoll" (CVE-2026-46242) vulnerability affects #Linux 6.4+ kernels and may reach newer #Android devices.

It can turn a local user into root; the PoC hit 99% reliability and may trigger from Chrome’s renderer sandbox.

🔗 Read how the bug works: https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html

⚠️ New Java RAT is being sold as MaaS.

QuimaRAT is built to run on Windows, #Linux, and #macOS, with encrypted plugins, OS-specific persistence, C2 rotation via Pastebin, and a browser-cache loader for staging payloads.

Read: https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html

🔥 A new 16-year-old #Linux KVM flaw lets a rooted nested VM crash the x86 host and take down other tenants on the same machine.

Dubbed "Januscape" (CVE-2026-53359), the bug sits in KVM’s shadow MMU.

Researcher says a full guest-to-host escape exploit also exists in a controlled setup; only the host-crash PoC is public.

Explained here: https://thehackernews.com/2026/07/16-year-old-linux-kvm-flaw-lets-guest.html

🛑 A newly found 15-year-old #Linux kernel flaw, GhostLock (CVE-2026-43499), could let any logged-in user gain root on unpatched distributions.

A working exploit code is now public, and it escaped containers in tests.

Read details here: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html

🚨 A flaw in Ubuntu’s snap-confine could turn local user access into root.

CVE-2026-8933 chains FUSE and symlink race conditions to plant malicious udev rules and execute commands as root.

Default Ubuntu #Linux Desktop 24.04, 25.10, and 26.04 installations are affected.

Read how the exploit works: https://thehackernews.com/2026/07/ubuntu-snap-confine-flaw-could-give.html

🛑 A newly disclosed, 9-year-old #Linux flaw lets unprivileged users overwrite root-owned files and gain persistent root access.

On affected XFS systems, the overwrite survives reboot without changing ownership, permissions, timestamps, or the setuid bit.

Read: https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html

🛑 A researcher says AI helped turn a #Linux traffic-control race into a root exploit.

CVE-2026-53264 lets a local user gain root on the tested CentOS Stream 9 build, but needs user namespaces, specific kernel options, and build-specific ROP offsets.

Read how the exploit works: https://thehackernews.com/2026/07/researcher-says-ai-helped-develop-linux.html

🚨 A new Mirai-derived botnet called Tengu can reboot compromised #Linux devices when defenders kill its main process, giving the malware another chance to return.

It also supports 25 DDoS methods, SOCKS5 proxying, shell commands, and additional ELF or APK payloads.

See how Tengu resists removal: https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html

🚨 Alibaba tool users were targeted with a cross-platform RAT.

Researchers linked 18 malicious npm packages to a layered dependency chain that served Windows, #Linux, and #macOS payloads with command execution, persistence, file transfer, and lateral movement capabilities.

How the npm attack worked: https://thehackernews.com/2026/08/18-malicious-npm-packages-deliver-cross.html

⚡ Adobe patches a Magento zero-day already exploited to deploy malware.

CVE-2026-75650 abuses Magento template processing for unauthenticated code execution. Attacks have delivered a Rust #Linux backdoor and PHP web shell.

How the chain works: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

‼️ ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready.

One can be triggered WITHOUT authentication.

Neither has a mainline kernel fix.

Details here ↓ https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

‼️ OpenAI's AI agents generated 948 working #Linux exploits that can escalate local user access to root.

In a 30-hour run, its pipeline reproduced 1,724 vulnerabilities and developed 291 information-leak PoCs.

Total API cost ➜ $1.2 million.

Read ↓ https://thehackernews.com/2026/11/openai-ai-pipeline-generates-948-linux.html

🚨 OpenSSH flaw exploited within hours of disclosure.

Attackers are targeting CVE-2026-123158 (SSHole), which bypasses password authentication under specific #Linux configurations.

Root access confirmed on an Alpine Linux honeypot.

Details: https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html