writeupas affected products2026-10-30
articleas classification.technologies2026-10-30
writeupas affected products2026-10-30
articleas classification.technologies2026-10-29
threadas affected products2026-10-29It is written here as Linux (servers with a multipath TCP listener).
servers with a multipath TCP listener
writeupas classification.technologies2026-10-28
articleas classification.technologies2026-10-27
advisoryas classification.technologies2026-10-22
articleas classification.technologies2026-10-22
paperas classification.technologies2026-10-21
advisoryas classification.technologies2026-10-21
articleas classification.technologies2026-10-20
articleas classification.technologies2026-10-20
writeupas classification.technologies2026-10-20
articleas classification.technologies2026-10-19
advisoryas classification.technologies2026-10-17
writeupas classification.technologies2026-10-16
paperas classification.technologies2026-10-16
advisoryas classification.technologies2026-10-16
articleas classification.technologies2026-10-15
articleas classification.technologies2026-10-14
threadas classification.technologies2026-10-12
articleas affected products2026-10-08
Not affected; payloads silently fail on this platform
articleas classification.technologies2026-10-07
writeupas classification.technologies2026-10-06
articleas affected products2026-10-06
platform using Landlock plus seccomp for sandbox enforcement
writeupas affected products2026-10-06It is written here as Linux (SSH/SSHD).
Linux machines using SSH with PAM authentication, targeted after gaining root access during a pentest
paperas affected products2026-10-05
writeupas affected products2026-10-02
writeupas affected products2026-10-02It is written here as Linux (generic).
Target OS for BPFDoor, Rekoobe, and AVERAT samples; raw PF_PACKET/BPF sockets used on Linux systems
articleas classification.technologies2026-09-29
writeupas classification.technologies2026-09-28
paperas classification.technologies2026-09-25
articleas classification.technologies2026-09-24
writeupas affected products2026-09-17
Targeted for Chrome extension storage theft
articleas affected products2026-09-15
articleas classification.technologies2026-09-11
articleas affected products2026-09-10
Platform targeted by North Korean Linux espionage toolkit, affecting automotive and media organizations in South Korea.
repoas affected products2026-09-05
amd64/arm64, single-binary numbat distribution; WSL uses separate Linux home
repoas affected products2026-08-31
supported platform for pre-built age binaries
writeupas classification.technologies2026-08-20
repoas affected products2026-08-19
repoas classification.technologies2026-08-15
writeupas affected products2026-08-06
x64 and ARM64, targeted via package/package-arm64 payloads
repoas affected products2026-08-01
amd64 or arm64, supported by shell installer
repoas affected products2026-07-31
Target platform for rootkit detection (chkrootkit, Rootkit Hunter), ELF analysis (HaboMalHunter, Limon), and REMnux/Tsurugi Linux distros
repoas classification.technologies2026-07-31
repoas affected products2026-07-31It is written here as Linux (Kali, Parrot, Debian/Ubuntu, Arch).
supported platform, requires Python 3.10+
repoas affected products2026-07-31
target OS for privilege escalation scanning; backport-aware 2026 Linux kernel vulnerabilities detected
articleas classification.technologies2026-07-30
writeupas affected products2026-07-29
Persistence via binary payload downloaded to /tmp, run detached, then deleted from disk after loading into memory
articleas classification.technologies2026-07-27
articleas affected products2026-07-27It is written here as Linux (Unix-like systems; filesystems Ext4, XFS, Btrfs).
Unix-like systems; filesystems Ext4, XFS, Btrfs
articleas affected products2026-07-24It is written here as Linux (glibc-based systems).
now Tier 2 (no new bottles, brew doctor warns) due to Ubuntu 24.04 CI migration raising baseline to glibc 2.39
articleas affected products2026-07-21
platform supported by bubblewrap-based sandboxing
articleas affected products2026-07-21
Page cache exploitation via CopyFail LPE technique
advisoryas classification.technologies2026-07-20
repoas affected products2026-07-18
platform covered under Linux Privilege Escalation
repoas affected products2026-07-15
Supported OS platform
writeupas affected products2026-07-12
Targeted by ELF native binary payload with libbpf-based eBPF instrumentation
writeupas affected products2026-07-11It is written here as Linux (x86-64).
Targeted by dropped ELF native binary payload
repoas classification.technologies2026-07-11
repoas affected products2026-07-06
OS internals track; ELF reversing track
repoas affected products2026-07-04
supported install target (tar.gz + install.sh, systemd user service)
writeupas affected products2026-06-23
Referenced via payload_path_linux, persist_name_linux, persist_type_linux config fields, though not exercised in this sample
articleas affected products2026-06-21It is written here as Linux (sshd, sudo, su, passwd authentication).
Targeted via ptrace-based memory reading (3snake) and PAM module abuse for clear-text credential capture.
writeupas affected products2026-06-20
writeupas affected products2026-06-18
Platform targeted by implant persistence via systemd user unit nvmconf.service
repoas affected products2026-06-05
supported implant/operator platform
articleas affected products2026-06-02
Platform on which IDE extension scanning works identically
videoas technologies2026-06-02
writeupas classification.technologies2026-05-14
advisoryas classification.technologies2026-05-13
repoas affected products2026-05-13
repoas affected products2026-05-12
focus platform for offensive/defensive security course
repoas affected products2026-05-08It is written here as Linux (Debian/Ubuntu, Fedora/RHEL/openSUSE).
.deb and .rpm packages recommend tpm-udev + tpm2-tools (Debian/Ubuntu) or tpm2-tss + tpm2-tools (Fedora/RHEL/openSUSE)
repoas classification.technologies2026-05-08
repoas affected products2026-05-07
recommended platform; Fedora supported
repoas classification.technologies2026-05-06
advisoryas classification.technologies2026-05-01
paperas classification.technologies2026-04-28
videoas technologies2026-04-25
writeupas affected products2026-04-22
Compromised endpoint targeted by multiple threat actors; also cross-platform malware referenced BSD/macOS variants (chflags uchg)
writeupas affected products2026-04-17It is written here as Linux (host/endpoint).
Compromised Linux host belonging to a tech-sector organization, targeted by multiple threat actors between March 20 and April 7.
writeupas affected products2026-03-31
Targeted via Python RAT script downloaded to /tmp/ld.py
articleas affected products2026-03-25
Native OS functionality abused by ClickFix attacks.
otheras classification.technologies2026-03-08
articleas affected products2026-03-03
Operating system powering enterprise applications, web servers, cloud infrastructure, hypervisors, containers, CI/CD pipelines; targeted by evolving threats
articleas affected products2026-01-13
Newest platform for Huntress Managed EDR, only a few months old; uses eBPF for telemetry; ransomware attacks against Linux hosts remain rare though not hypothetical
writeupas classification.technologies2025-12-10
writeupas classification.technologies2025-10-30
writeupas affected products2025-05-16
POSIX capabilities mechanism dividing root/superuser privileges into fine-grained units
writeupas classification.technologies2025-04-27
writeupas classification.technologies2025-04-21
writeupas classification.technologies2025-01-14
writeupas classification.technologies2024-12-17
writeupas classification.technologies2024-11-10
writeupas classification.technologies2024-10-19
writeupas affected products2024-10-01
C programs with setUID/setGID bits set that call setuid() and setgid() to drop privileges; vulnerable if setuid() is called before setgid(), allowing regain of privileges via a subsequent setgid(0) call
writeupas classification.technologies2024-07-12
writeupas classification.technologies2024-07-10
writeupas affected products2024-06-22
systemd-based Linux systems, used for path unit file integrity monitoring
writeupas affected products2024-05-16
Operating system whose /proc filesystem is abused via bind mounts to hide processes
writeupas classification.technologies2024-04-14
writeupas classification.technologies2024-02-21
writeupas affected products2024-02-01
Malware targets Linux servers; uses /dev/shm ramdisk, /var/run, BPF socket filtering, and process name spoofing via prctl PR_SET_NAME
advisoryas classification.technologies2023-08-14
writeupas classification.technologies2022-06-12
writeupas classification.technologies2022-05-12
writeupas classification.technologies2022-04-27
articleas affected products2021-08-08
Covered in the course but with fewer examples/TTPs than Windows; author notes enterprise servers often run Linux
courseas classification.technologies
repoas affected products
repoas affected products
Platform malcontent analyzes best
repoas affected products
Client platform supported by Strelka (OS-native client application); build/deploy environment used Ubuntu 23.04
videoas technologies
repoas affected products
repoas classification.technologies
repoas affected products
Supported platform
repoas affected products
Platform target for Scout build matrix (POSIX library)
repoas classification.technologies
repoas affected products
should work, not yet actively tested
courseas classification.technologies
courseas classification.technologies
articleas classification.technologies
advisoryas classification.technologies
repoas affected products
Open-source community whose vulnerabilities were fixed with help from Tencent Zhuque Lab
repoas affected products
required for the Pipelock reference adapter lane and its Landlock/seccomp confinement; the only OS on which that lane runs
articleas classification.technologies