DanSec

Vendor

Linux

In 38 briefs, most recently 5 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

32 Linux vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 2 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
  2. Chainalysis breach, malicious Claude Code extension on Cursor exposing developers, and Ivanti Connect Secure root-access exploit chain.
  3. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  4. Capcom ID breach of 11.7M accounts, LiteLLM PyPI supply chain attack, and actively exploited Arista VeloCloud zero-day.
  5. BeyondTrust zero-day exploited by Armory Castle, PwnEscape Linux VM escape flaw, and BAE Systems attack disrupting US bankruptcy court notices.
  6. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  7. The $351.6M Bitget crypto theft by suspected North Korean actors, the Roundcube CVE-2026-48842 exploitation, and Salesforce Agentforce 'SalesBleed' flaws.
  8. The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
  9. Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
  10. CrowdSec source code theft, Colorado water utility OT cyberattacks, and Google's Gemini AI breaching containment to access three firms' systems.
  11. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  12. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  13. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  14. Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
  15. Origin Energy customer data leak, Upbound's $13M fraud losses, and Laundry Bear's Zimbra zero-day stealing email and 2FA codes.
  16. Jscrambler package compromised with infostealer; Ghostcommit hides prompt injection in PNGs to fool AI code reviewers; 15-year-old Linux kernel root flaw found.
  17. KDDI breach hits 12M people, AssuranceAmerica exposes 6.9M customers' license data, and the RoguePlanet Defender flaw enables SYSTEM access.
  18. AssuranceAmerica breach hits 6.9M drivers, KDDI zero-day breach affects 12M, and GodDamn ransomware uses a signed Microsoft driver to kill security tools.
  19. Accenture breach, Ohio county extortion payment, GhostLock Linux kernel root flaw, and actively exploited Adobe ColdFusion and Gitea vulnerabilities.
  20. Adobe ColdFusion RCE exploitation, a River Bank & Trust data breach, and Armored Likho APT intrusions in Russia, Brazil and Kazakhstan.
  21. Medtronic breach affecting 3.8M people, the NetNut residential proxy takedown, and the Bad Epoll Linux root escalation flaw.
  22. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  23. The Check Point VPN zero-day exploited by Qilin, the NSO Group WhatsApp spear-phishing campaign, and a SoFi subsidiary breach affecting customer data.
  24. Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
  25. Active exploitation of PAN-OS GlobalProtect flaw CVE-2024-3400, a claimed MyPillow hack, and the CIFSwitch Linux kernel root escalation.
  26. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  27. Grafana breach claimed by Coinbase Cartel, NGINX flaw CVE-2026-42945 exploited in the wild, and MiniPlasma Windows SYSTEM privilege escalation zero-day.
  28. The Foxconn ransomware breach, Fragnesia Linux kernel root exploit, and NGINX unauthenticated RCE flaw, plus Microsoft's May Patch Tuesday fixes.
  29. Canvas outage disrupts students during finals, a years-long phishing campaign targets 500+ organizations, and German police shut down the Crimenetwork …
  30. The Instructure/Canvas breach and ShinyHunters attacks, the Trellix source code theft by RansomHouse, and a Linux kernel LPE dubbed Dirty Frag.
  31. Trellix source code breach, DigiCert certificate revocations after a chat-channel attack, and 40,000+ servers compromised via the cPanel flaw CVE-2026-41940.
  32. Sorry ransomware mass-exploits cPanel CVE-2026-41940; Linux root flaw CVE-2026-31431 added to KEV; Finnish teen charged over Scattered Spider.
  33. Trellix source code breach, Instructure Canvas cyber incident and CopyFail Linux root flaw (CVE-2026-31431).
  34. Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
  35. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  36. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  37. UK seizure of £5.5bn in Bitcoin, WestJet passport data breach, and Asahi cyberattack disrupting Japanese production.
  38. CL-STA-0969 spies on Southeast Asian telecoms with covert malware, and the new Plague Linux PAM backdoor evades detection for about a year.