The flaws affect several networking components that have been part of the Linux kernel for years. They are known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill and are tracked as:

• CVE-2026-80844 — DirtyAH6
• CVE-2026-81000 — TUNderflow
• CVE-2026-68121 — PPPoEject
• CVE-2026-74469 — DiagSpill

Upstream fixes are now available for the affected kernel code.

DirtyAH6: IPv6 Memory Handling Bug

DirtyAH6 affects Linux IPsec/XFRM code responsible for processing IPv6 Authentication Headers.

The problem occurs when specially crafted IPv6 routing-header values are processed without properly checking the segments_left field. This can cause the kernel to use an invalid memory location and perform an out-of-bounds operation.

The main concern is local privilege escalation, particularly on systems where an attacker can create or control network namespaces.

In certain configurations, IPv6 routers or gateways using Authentication Header transport mode could also face a denial-of-service condition.

Researchers demonstrated root access in a controlled laboratory environment, although carrying out the same technique remotely was described as difficult.

TUNderflow Targets Virtual Networking

TUNderflow affects the Linux TUN/TAP virtual networking subsystem.

A local attacker can potentially provide unusually large receive-headroom values through certain network-device configurations, including paths involving Open vSwitch.

This can trigger an integer underflow while the kernel allocates a socket buffer. As a result, packet data may be placed outside the expected memory area, creating opportunities for out-of-bounds reads and writes.

PPPoEject Creates a Use-After-Free

PPPoEject affects Linux’s PPP-over-Ethernet implementation.

The vulnerability occurs because pppoe_sendmsg() can retain a pointer to a PPPoE header while another function modifies the underlying socket buffer.

If that buffer is reallocated, the original pointer becomes invalid. Subsequent operations using the stale pointer can then modify memory that has already been freed.

The upstream fix addresses the issue by retrieving the header pointer again after the device-header operation completes.

DiagSpill Can Corrupt Kernel Memory

DiagSpill affects SCTP diagnostic processing through sock_diag.

The vulnerability is related to a mismatch between the maximum number of SCTP peer transports and the size of the counter used to track them.

When the counter reaches its limit, it can wrap around to zero. The kernel may then allocate too little space before copying peer information, potentially causing data to be written beyond the allocated Netlink response buffer.

Unlike the other three vulnerabilities, DiagSpill does not require unprivileged user namespaces or special capabilities when SCTP and sctp_diag are enabled.

Remote crash scenarios may also be possible when certain SCTP address-configuration features are active, although those features are disabled by default.

Linux Kernel Updates Available

The vulnerabilities were reported to the Linux kernel security team in July, and fixes have now been released through the coordinated disclosure process.

The stable kernel releases containing fixes for all four vulnerabilities include:

• Linux 5.10.270
• Linux 5.15.221
• Linux 6.1.188
• Linux 6.6.157
• Linux 6.12.109
• Linux 6.18.50
• Linux 7.2.4

Administrators should update affected systems to a kernel version containing the fixes.

If an immediate update is not possible, organizations can reduce exposure by restricting unprivileged user namespaces and disabling networking features that are not required, such as AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag.

These workarounds provide only partial protection. In particular, disabling user namespaces does not prevent DiagSpill, so applying the appropriate kernel security updates remains the primary mitigation.

The post Four Linux Kernel Flaws Could Enable Root Access appeared first on First Hackers News.

The malware can disguise itself as a normal Linux kernel process, remain active after a reboot, and communicate with attackers through a hidden control endpoint.

Researchers say the malware appears designed for servers, embedded Linux devices, and IoT-related systems. Its exact method of getting onto vulnerable devices is still unknown.

Built to Stay Out of Sight

Tengu does more than simply run in the background. It takes several steps to make detection and removal more difficult.

The malware can:

• Rename itself to look like a Linux kernel worker.
• Reduce the chance of being terminated when the system runs low on memory.
• Hide normal output while running.
• Continue operating even after its original executable is removed.
• Create multiple methods to start automatically after a reboot.

Researchers observed persistence through systemd, SysV startup scripts, OpenWrt scripts, scheduled tasks, and local startup files.

Using several persistence methods allows the malware to survive across different Linux environments.

More Than Just a DDoS Bot

Tengu includes several capabilities that can be used together during an attack.

It can generate different types of network traffic, including UDP floods, HTTP requests, and SSH connection activity. It also supports proxy functionality, allowing compromised machines to act as traffic relays.

The malware can gather basic information about the infected system and network before communicating with its operators.

Its HTTP functionality supports common request methods such as GET, POST, and HEAD, while randomized forwarding headers can make the generated traffic less predictable.

This combination gives attackers more flexibility than a basic DDoS-only malware.

Multiple Ways to Flood a Target

Tengu’s UDP attack functionality includes two approaches.

One can create raw IPv4 packets with controlled network-header information, while another uses standard datagram sockets. Having both options allows the malware to continue generating traffic even when raw network access is restricted.

The malware also includes SSH-related activity that performs connection and handshake operations. Researchers did not find evidence that this capability is being used to exploit SSH authentication.

The larger concern is the variety of attack methods available from a single infected device.

Why Linux and IoT Devices Are at Risk

Linux servers and internet-connected devices are attractive targets for botnet operators because many remain exposed to the internet and may not receive regular security maintenance.

Once compromised, a device that appears to be operating normally could quietly become part of a larger attack infrastructure.

Tengu’s ability to hide its process, establish persistence, and support multiple traffic-generation methods makes these infections particularly difficult to spot through basic monitoring.

What Security Teams Should Watch For

Organizations managing Linux servers, embedded systems, or IoT devices should look for unusual behavior rather than relying only on malware signatures.

Important warning signs include:

• A suspicious process pretending to be a kernel worker.
• Unexpected changes to memory-management settings.
• New systemd services or startup scripts.
• Unknown scheduled tasks.
• Unusual UDP traffic or large traffic bursts.
• Unexpected SSH connection activity.
• HTTP traffic containing unusual forwarding headers.
• Connections to unknown command-and-control infrastructure.

If a device is suspected of being compromised, it should be isolated and investigated before removing suspicious files or persistence mechanisms.

Tengu highlights how Linux-based botnets continue to evolve beyond simple DDoS functionality.

By combining stealth, persistence, proxy capabilities, and multiple attack methods, the malware can turn an ordinary Linux or IoT device into a remotely controlled attack platform.

Keeping internet-facing systems patched, removing unnecessary services, restricting remote access, and continuously monitoring network behavior can significantly reduce the chance of devices becoming part of the next botnet.

IoCs

The post Tengu Linux Botnet Hides as System Process appeared first on First Hackers News.

The vulnerability affects the Stream Control Transmission Protocol (SCTP) component of the Linux kernel. Surprisingly, the underlying flaw has existed since Linux 2.6.25, released in 2007, meaning it remained undiscovered for nearly 18 years.

How the Vulnerability Works

The issue is caused by a use-after-free memory bug in SCTP’s Dynamic Address Reconfiguration (ASCONF) feature.

By sending specially crafted SCTP packets in a specific sequence, an attacker can trick the kernel into freeing an object while it is still being referenced. When the kernel later tries to access that memory, it creates a use-after-free condition that can be exploited.

This flaw allows attackers to manipulate kernel memory and eventually execute privileged operations.

Privilege Escalation to Root

Researchers from TencentOS Security Team developed a working exploit that successfully turns the vulnerability into a full privilege-escalation attack.

Their exploit leaks kernel memory addresses, bypasses security protections such as Kernel Address Space Layout Randomization (KASLR), and creates fake kernel objects to obtain root privileges.

Notably, the attack does not rely on shellcode or traditional Return-Oriented Programming (ROP) techniques, making it more difficult for some security solutions to detect.

Container Escape Demonstrated

Researchers also proved that the vulnerability can be used to escape Linux containers.

Instead of requiring elevated system privileges, the exploit uses standard SCTP socket options available within containers. Once exploited, attackers can break out of the container environment and execute code on the underlying host.

This makes the vulnerability particularly concerning for organizations running containerized workloads or multi-tenant environments.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

Affected Systems

The exploit was successfully tested on several Linux distributions, including:

• Ubuntu 24.04
• Debian 13
• Rocky Linux 9
• Multiple Linux kernel versions from 5.14 through recent 7.x release candidates

The researchers achieved root access on every tested environment.

Severity and Impact

CVE-2026-64564 has received a CVSS v4.0 score of 8.5 (High).

If exploited successfully, attackers could:

• Gain full root privileges
• Escape container environments
• Compromise the underlying host
• Access sensitive data
• Modify system configurations
• Completely take control of affected Linux systems

Security Updates Available

The Linux kernel maintainers have released patches to address the vulnerability.

Fixes are available in the following kernel versions:

• 6.6.148
• 6.12.101
• 6.18.42
• 7.1.6

The vulnerability was officially disclosed on August 4, 2026, following responsible disclosure to the Linux kernel security team.

How Organizations Can Protect Their Systems

Organizations running Linux servers should prioritize applying the latest kernel updates, especially if SCTP is enabled.

Security teams should also:

• Apply the latest patched kernel versions.
• Monitor systems for unusual privilege-escalation attempts.
• Limit local user access wherever possible.
• Regularly review container security configurations.
• Monitor kernel and authentication logs for suspicious activity.

Conclusion

The discovery of SCTPhantom (CVE-2026-64564) highlights how critical vulnerabilities can remain hidden in widely used software for many years. With the ability to gain root access and escape containers, this flaw presents a significant security risk for Linux environments.

Organizations should update affected systems as soon as possible and strengthen monitoring to reduce the risk of exploitation.

The post Critical Linux Kernel Flaw Grants Root Access appeared first on First Hackers News.

The vulnerability affects the copy-on-write (CoW) feature of XFS. It is caused by a race condition that occurs when two O_DIRECT write operations access the same reflink-enabled file at nearly the same time.

How the Vulnerability Works

Normally, when a shared file is modified, XFS creates a new private copy of the data before writing changes. However, during this process, the kernel briefly releases an internal lock while waiting for transaction log space.

If another write request arrives during this short window, it can change the file mapping before the first operation finishes. As a result, the first write uses outdated information and writes data directly to the original disk block instead of a new one.

Since O_DIRECT bypasses the page cache, the corrupted data is written straight to disk, allowing attackers to overwrite protected system files.

Why It Is Dangerous

Qualys demonstrated that a normal local user could exploit the flaw on a default RHEL 10.2 system and remove the root account’s password protection within seconds. After the attack, the system granted passwordless root access.

The attack is difficult to detect because:

• No kernel log entries are generated.
• The changes remain after a reboot.
• Even systems protected by SELinux are vulnerable.
• Existing Linux security protections do not block the attack.

Researchers believe the vulnerability has existed since Linux kernel version 4.11, released in 2017, potentially affecting more than 16 million systems worldwide.

Who Is Affected?

A system is vulnerable if it has:

• Linux kernel 4.11 or later without the security patch.
• An XFS filesystem with reflink=1 enabled.
• A directory writable by an unprivileged user.
• A valuable target file such as a SUID binary or protected system file.

Confirmed affected distributions include:

• RHEL 8, 9 and 10
• CentOS Stream 8, 9 and 10
• Oracle Linux 8, 9 and 10
• Rocky Linux 8, 9 and 10
• AlmaLinux 8, 9 and 10
• CloudLinux 8, 9 and 10
• Amazon Linux 2 and Amazon Linux 2023
• Fedora Server 31 and later

Lower-risk distributions

• Debian
• Ubuntu
• SUSE

These distributions are mainly affected only if XFS with reflink support has been manually configured.

Existing Security Features Cannot Stop It

One of the biggest concerns is that common Linux security protections do not prevent this attack. Technologies such as SELinux, KASLR, SMEP, SMAP, kernel lockdown, and container isolation operate at different layers and cannot stop exploitation of this filesystem flaw.

At present, there is no temporary workaround that completely mitigates the vulnerability. Installing the security update is the only effective solution.

AI Helped Discover the Flaw

The vulnerability was identified through a collaboration between Qualys and Anthropic. Researchers used Anthropic’s Claude Mythos Preview AI model to search for race-condition vulnerabilities similar to the well-known Dirty COW bug.

After identifying the issue, Qualys engineers independently verified the findings, created a proof-of-concept, and responsibly disclosed the vulnerability to Linux maintainers.

Part of a Growing Trend

RefluXFS is one of several major Linux privilege escalation vulnerabilities disclosed during 2026. Other recent discoveries include:

• Copy Fail (CVE-2026-31431)
• Dirty Frag (CVE-2026-43284 and CVE-2026-43500)
• DirtyClone (CVE-2026-43503)

These vulnerabilities highlight a growing trend of attackers exploiting flaws that allow protected files or memory to be modified, ultimately leading to privilege escalation.

What Organizations Should Do

Organizations should patch affected systems as soon as possible, especially internet-facing servers, multi-tenant environments, and shared systems.

Security updates are already available for major enterprise Linux distributions, including RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora. After installing the update, administrators should perform a full system reboot to ensure the patched kernel is running.

Since there is currently no reliable mitigation other than patching, keeping systems updated is the best defense against the RefluXFS vulnerability.

The post Critical RefluXFS Flaw Threatens Linux Systems appeared first on First Hackers News.

Researchers demonstrated that the vulnerability can be exploited to modify a SUID binary, such as /usr/bin/su, allowing attackers to execute code with root privileges. The issue affects Linux kernel v6.16-rc1 and later on systems using a 4 KB page size.

How the Vulnerability Works

The flaw is caused by improper validation of directory entry sizes before they are copied into the kernel page cache. When an oversized directory entry is processed, it can trigger a small memory overflow beyond the page boundary.

Researchers showed that this overflow can corrupt cached executable files, including SUID binaries such as /usr/bin/su. When the modified binary is executed, the injected code runs with root privileges before the normal authentication process begins, allowing attackers to gain full control of the system.

To successfully exploit the vulnerability, an attacker must:

• Have local access to the system.
• Be able to mount a FUSE filesystem.
• Create a specially crafted directory entry.
• Trigger the vulnerable code path through FUSE operations.

Affected Systems and Mitigation

The vulnerability becomes practically exploitable on Linux kernel v6.16-rc1 and later, after changes that increased the FUSE directory read buffer size. Systems using a 4 KB page size are affected, while systems with larger page sizes are not vulnerable to this specific overflow.

The Linux kernel developers have released a patch that prevents oversized directory entries from being cached, eliminating the overflow condition.

Organizations should take the following steps to reduce risk:

• Update affected Linux systems with the latest kernel patches.
• Restrict or disable unprivileged FUSE mounts where possible.
• Disable unprivileged user namespaces if they are not required.
• Remove the setuid permission from fusermount3 when it is not needed.
• Monitor systems for unauthorized local privilege escalation attempts.
• Review systems for unusual activity involving FUSE filesystems and SUID binaries.

Although this vulnerability requires local access, it highlights how a small flaw in a kernel subsystem can lead to complete system compromise. Prompt patching, restricting unnecessary FUSE access, and limiting local privileges are the most effective ways to reduce the risk of exploitation.

The post Linux FUSE Vulnerability Allows Root Access appeared first on First Hackers News.

This activity has been closely analyzed by Mauro Eldritch, who has documented how this campaign is impacting high-value macOS users, especially in fintech and crypto sectors.

Initial Access and Social Engineering Flow

The attack typically begins with targeted outreach on Telegram, where threat actors impersonate trusted contacts such as colleagues or business partners. Victims—often executives or developers—receive urgent meeting requests designed to trigger quick action.

They are then redirected to phishing pages that closely resemble platforms like Zoom, Microsoft Teams, or Google Meet. These pages claim a technical issue and instruct the user to fix it manually.

Instead of a traditional exploit, the victim is guided to copy and execute a Terminal command. Because this action is user-initiated, many security tools interpret it as legitimate behavior.

Execution Chain and Malware Behavior

Once the command is executed, the infection chain unfolds in multiple stages designed to blend in with normal macOS activity.

• The first-stage binary (commonly seen as teamsSDK.bin) acts as a downloader that retrieves additional components
• Fake macOS applications are dropped, mimicking meeting tools or system prompts to appear legitimate
• These apps repeatedly request user passwords, often using poorly written prompts to trick the victim
• A secondary module (such as D1YrHRTg.bin) performs deep system profiling using native tools like sysctl

The profiling stage gathers extensive system intelligence, including host identifiers, operating system details, running processes, network configuration, and browser-related data from Chrome, Safari, Brave, and similar applications.

Interestingly, researchers observed flaws in parts of the malware. Some profiling components enter continuous loops, repeatedly sending the same data to command-and-control infrastructure, which can cause noticeable performance issues on infected machines.

To avoid execution barriers, the malware leverages macOS utilities like codesign to apply ad-hoc signatures, helping malicious binaries run under standard policies without raising immediate suspicion.

Credential Theft and Data Exfiltration

The final stage of the attack is handled by a stealer component referred to as macrasv2. This module focuses on extracting high-value data from the compromised system.

Targets include:

• Browser-stored credentials and active session cookies
• macOS Keychain entries containing saved secrets
• Files that can grant access to SaaS platforms, internal systems, or crypto wallets

All collected data is compressed into archive files (for example, user_ext.zip) and exfiltrated to attacker-controlled servers.

Persistence Mechanism

To maintain long-term access, additional components like minst2.bin are deployed. These create persistence by placing disguised binaries—often pretending to be legitimate services like OneDrive—inside directories labeled as security-related (such as an “Antivirus Service” folder).

The malware then registers itself as a LaunchAgent, ensuring execution every time the user logs in.

Why This Campaign Is Effective

This attack stands out because it avoids traditional exploitation techniques. By relying on user-executed commands and built-in macOS tools, the activity appears normal to many EDR solutions until after credentials and access tokens are already compromised.

For organizations where macOS devices are widely used—especially among developers and leadership—this creates a serious risk. A single compromised system can lead to broader access across internal infrastructure and financial assets.

Detection and Defensive Considerations

To counter this type of campaign, defenders need to shift focus toward behavior rather than just exploits.

• Monitor unusual Terminal activity and command execution patterns
• Identify and block ClickFix-style phishing workflows
• Regularly audit LaunchAgents for suspicious or disguised entries
• Track outbound connections to uncommon ports or Telegram-related infrastructure
• Use sandbox environments like ANY.RUN to safely analyze suspicious files, URLs, and execution chains

Interactive sandboxing plays a key role in understanding how these multi-stage attacks operate, allowing defenders to reconstruct the full infection path and extract indicators for detection.

The post Lazarus Delivers “Mach-O Man” macOS Malware via ClickFix appeared first on First Hackers News.

This campaign involves a Linux version of the GoGra backdoor, showing that the group is expanding beyond its earlier Windows-based operations. By using trusted cloud services, the malware blends into normal network traffic, allowing it to bypass many standard security tools that typically look for suspicious external connections.

The attack appears to focus on espionage rather than financial gain. Evidence suggests that targets are mainly located in South Asia, with attackers using region-specific document names to make their phishing attempts more convincing. This level of targeting shows a carefully planned and strategic operation.

Outlook Mailbox Malware Explained

The attackers gain access through social engineering, tricking users into opening files that appear harmless. These files are often disguised as official documents, but they actually contain hidden malicious code.

Once the file is opened, the malware quietly installs itself in the background. It avoids drawing attention while setting up persistence, ensuring it can continue running even after the system is restarted.

Some key characteristics of the infection process include:

• Disguised files that look like PDFs or official documents
• Malware hidden inside Linux executable files
• Silent installation without visible signs
• Persistence mechanisms that allow it to survive reboots

This approach makes it difficult for users to realize they have been infected until much later.

How the Backdoor Uses Microsoft Infrastructure

What makes this attack particularly sophisticated is how it uses Microsoft’s own services as a communication channel. Instead of connecting to suspicious servers, the malware interacts with legitimate cloud infrastructure, which helps it stay hidden.

After installation, the backdoor uses Microsoft APIs to communicate with a real Outlook mailbox. It regularly checks for new messages that contain instructions from the attacker. These commands are processed on the infected system, and the results are sent back through email responses.

The malware is designed to clean up after itself, deleting messages once they are used. This reduces traces of the attack and makes forensic investigation more difficult.

The main capabilities of the backdoor include:

• Receiving commands through Outlook mailbox messages
• Executing those commands on the infected machine
• Sending results back via email
• Removing evidence after communication

Because all of this happens through trusted services, the activity can easily go unnoticed in normal network monitoring.

Why This Attack Is Concerning

This campaign highlights a growing trend where attackers abuse legitimate platforms to hide their operations. By using trusted services like Microsoft’s cloud, they can bypass many traditional defenses that rely on detecting suspicious traffic.

The impact of such an attack can be serious. Attackers may gain long-term access to systems, collect sensitive data, and monitor user activity without being detected. Since the malware operates quietly and removes traces of its actions, it can remain active for extended periods.

This also shows how threat actors are evolving their techniques, moving toward more stealthy and persistent methods. Organizations can no longer rely only on basic perimeter defenses and must adopt more advanced monitoring strategies.

To reduce risk, security teams should pay close attention to unusual system behavior, unexpected background services, and abnormal use of cloud APIs. Monitoring activity from endpoints that do not typically interact with such services can help identify potential threats early.

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

The post Hackers Hide GoGra Backdoor in Outlook Mailboxes appeared first on First Hackers News.

This issue, identified as CVE-2024-3094, impacts versions 5.6.0 and 5.6.1. The injected code is designed to stay hidden during normal review processes and only becomes active during the software build stage. Once active, it can interfere with SSH authentication, potentially allowing attackers to gain unauthorized access to affected systems.

Technical Impact and Mitigation

The attack is highly sophisticated, as the malicious components are not fully visible in the main source code. Instead, they rely on additional build-time elements to assemble and execute the payload. This makes detection difficult using standard code inspection methods.

Once deployed, the compromised library can alter how SSH authentication behaves, creating an opportunity for attackers to bypass normal security checks and access systems remotely.

Key highlights:

• CVE-2024-3094 affects xz and xz-libs versions 5.6.0 and 5.6.1
• Malicious code is triggered during the build process
• Targets SSH authentication mechanisms
• Impacts Fedora Rawhide, Fedora 40 Beta, Debian unstable, and openSUSE
• Red Hat Enterprise Linux (RHEL) remains unaffected

‍Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!

Immediate Actions

• Downgrade to trusted xz version 5.4.x
• Stop using Fedora Rawhide until systems are secured
• Apply official patches and updates from Red Hat
• Monitor systems for unusual SSH behavior

Even though active exploitation has not been widely reported, the nature of this compromise makes it a high-risk issue. Prompt action is necessary to protect systems from potential unauthorized access.

The post xz Backdoor Vulnerability Exposes Linux Systems to Remote Access appeared first on First Hackers News.

ShadowHS is built from a modified version of a legitimate utility and turned into a full post-exploitation toolkit. It avoids writing anything to disk, hides its process identity, and executes through memory-based techniques that bypass many antivirus and file-monitoring defenses. The infection chain uses encrypted loaders and carefully rebuilds the payload directly in memory before running it.

The final program is launched directly from memory and often imitates trusted processes, such as Python-related services, to reduce suspicion.

Human-Controlled and Stealth Focused

ShadowHS stands out because it does not behave like typical automated malware. Instead of launching noisy actions right away, it stays quiet at first. The framework focuses on studying the system, identifying security defenses, and ensuring the environment is safe for continued access. This careful, low-profile behavior suggests direct human control rather than a fully automated attack.

The tool gathers detailed information about installed security products by checking system paths, running services, and protection components. The findings help operators understand what defenses are active before deciding on the next step.

It also includes logic to remove other malicious programs that may already be present. By scanning for known malware, cryptominers, hidden kernel components, and suspicious in-memory programs, it tries to take exclusive control of the system.

Beyond that, the framework examines the system’s overall defense posture, reviewing kernel protections, loaded modules, and process activity to detect monitoring or security instrumentation.

For data theft, ShadowHS uses less common communication methods instead of standard tools like SSH or file transfer utilities. It creates hidden channels using user-space tunneling techniques, allowing files to be moved without triggering typical network monitoring alerts. Because of how these tunnels work, the traffic can appear local while actually being redirected externally, helping the activity remain unnoticed.

Security Measures

When fully activated, ShadowHS can start hidden crypto mining, scan networks to move sideways, and try to collect credentials from systems, cloud services, and virtual platforms.

Since it runs in memory and avoids writing files, regular antivirus tools may not detect it. Protection depends more on watching system behavior than scanning files.

To lower the risk:

• Monitor unusual process and memory activity
• Track suspicious command-line behavior
• Use deeper system and kernel-level monitoring
• Limit what applications can do at runtime
• Watch for strange or hidden network connections

This threat shows that modern Linux attacks are becoming quieter and more controlled, making behavior-based detection more important than ever.

Indicators of Compromise (IOCs)

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post ShadowHS Linux Malware Spreading Quietly appeared first on First Hackers News.

What Are These Linux Vulnerabilities?

CVE-2025-6018: PAM Misconfiguration

This flaw in openSUSE Leap 15’s Pluggable Authentication Modules (PAM) lets unprivileged users gain “allow_active” status, granting unauthorized Polkit actions. By treating SSH sessions as local, attackers can escalate privileges, paving the way for deeper exploits.

CVE-2025-6019: Udisks Daemon Flaw

Exploiting libblockdev via the udisks daemon—a default component in most Linux distributions—this vulnerability allows attackers with “allow_active” status to achieve root privileges. Qualys TRU’s proof-of-concept exploits confirmed rapid root access on Ubuntu, Debian, and Fedora.

CVE-2025-6020: PAM Namespace Issue

A path traversal vulnerability (CVSS: 7.8) in Linux PAM (up to 1.7.0) enables symlink attacks and race conditions in pam_namespace. Fixed in Linux PAM 1.7.1, it poses a root escalation risk if unpatched.

Chained together, these flaws create a dangerous “local-to-root” path, enabling data theft, ransomware, and backdoor implantation.

Why These Flaws Matter

With udisks installed by default, most Linux systems are vulnerable. As Qualys TRU’s Saeed Abbasi noted, “The exploit’s simplicity and udisks’ ubiquity make this a universal threat.” Root access allows attackers to cause operational downtime or lateral movement in networks, threatening enterprises and individuals.

Protect against these Linux security flaws with these steps:

• Patch Immediately: Update to Linux PAM 1.7.1, patched libblockdev, and udisks. Check Ubuntu’s Security Notices or Fedora’s Updates.
• Disable PAM Namespace: Mitigate CVE-2025-6020 by disabling pam_namespace or securing namespace.init.
• Monitor Systems: Use threat intelligence tools to detect exploit attempts.
• Limit Access: Restrict privileges to minimize lateral movement risks.

The post Critical Linux Vulnerabilities Expose Systems to Root Access Exploits appeared first on First Hackers News.