linux

Breaches & attacks · Exploited · since 12 Nov 2026

Multiple threat actors are actively abusing the legitimate GSocket tool to maintain persistent access on compromised Linux servers. The technique allows attackers to retain control even after underlying initial access vulnerabilities are patched.

Do:Audit Linux servers for unauthorized GSocket installations and inspect network connections.

Supply chain · Exploited · —No fix needed · since 5 Nov 2026 · updated 6 Nov 2026

Threat actors are distributing a new Linux backdoor named CWPdoor via a trojanized version of the Control Web Panel web server. The malicious binary enables attackers to execute commands silently without generating logs.

Do:Check servers for unauthorized modifications to the cwpsrv binary and remove any instances of CWPdoor.

Research · since Oct 2026 (approx.)

OpenAI disclosed that its upcoming AI model automatically created working exploits for 948 Linux kernel bugs and produced patches for each. The research shows AI can be used to mass‑generate privilege‑escalation exploits.

Research · since 2 Nov 2026

Researchers uncovered a cyber espionage campaign targeting government Linux infrastructure using SysGoRAT and suspected AI-generated scripts. The activity was tracked between October 2025 and April 2026 by Unit 42.

Patch now · Exploited · ○No patch yet · since 29 Oct 2026

CISA issued a warning regarding a high-severity Linux kernel privilege escalation vulnerability being actively chained in the wild with PHP2Shell flaws. Federal agencies have been instructed to apply patches.

Do:Patch the affected Linux kernel components as advised by CISA.

Patch now · Exploited · ◐Partly patched · since 28 Oct 2026 · CVE-2026-46300

The Linux Kernel contains a variable initialization flaw that causes ESP input processing to decrypt shared fragments in place, allowing for unintended page-cache data modification. CISA added this vulnerability to its KEV catalog following confirmed exploitation.

Do:Apply mitigations according to vendor instructions.

Research · since 27 Oct 2026 · updated 3 Nov 2026 · CVE-2026-98432

Breaches & attacks · Exploited · since 15 Oct 2026