We’re Tracking the Future of Security

Tag: Linux Security

  • File Notification APIs Can Leak User Activity Across Windows, Linux and Android

    File Notification APIs Can Leak User Activity Across Windows, Linux and Android

    Researchers at Graz University of Technology have shown that operating-system file notification features can act as side channels for user and application activity. The mechanisms are designed to alert software when files change, but event timing and path information can reveal behavior even when an attacker cannot read file contents.

    The exposure varies by operating system

    The demonstrations included keystroke timing and website fingerprinting on Linux, cross-user path visibility on Windows and WhatsApp media events on Android. Most scenarios require an attacker to run code locally, often under another account; the Android test used an application requesting no permissions. The work does not show remote compromise by itself, and the researchers said they were unaware of exploitation in the wild.

    Linux has partially hardened device-file events associated with one of the more serious paths. Microsoft told the researchers that the Windows behavior is by design and emphasized that it exposes paths rather than file contents. The project lists no general fix for several other scenarios.

    Local isolation still matters

    Administrators should limit untrusted local code, separate sensitive workloads and monitor unusual use of file-watching APIs where telemetry is available. Application developers should minimize sensitive information in file names and temporary paths. SectechMedia follows endpoint risks in its cybersecurity coverage.

    Sources

  • Qtonic Launches QShield for Post-Quantum Network Encryption

    Qtonic Launches QShield for Post-Quantum Network Encryption

    Qtonic Quantum has launched QShield, a software product intended to protect network traffic between compatible Linux endpoints with post-quantum key establishment and authentication. Security Today reported that the product combines these mechanisms with conventional authenticated packet encryption.

    Migration at the connection layer

    The company says QShield uses standardized post-quantum algorithms for establishing keys and authenticating endpoints. A connection-layer approach can help organizations test migration without immediately replacing every application. It does not eliminate the need to inventory cryptography elsewhere, including certificates, stored data, firmware and third-party services.

    Qtonic also described a fail-closed design and published test materials from a multi-day run between cloud hosts. These are vendor-reported results, not an independent certification. Security Today explicitly noted that the company does not claim FIPS 140-3 validation or government authorization for the product.

    How buyers should evaluate the claim

    Organizations should verify algorithm implementation, key management, performance under failure and interoperability with operational tooling. A post-quantum label does not by itself establish secure deployment. QShield is another sign that cyber-physical security teams need a documented cryptographic inventory and a staged migration plan rather than a last-minute product replacement.

    Sources

  • Vercel Sandbox Challenge Finds Linux Kernel Flaws Without Customer Data Exposure

    Vercel Sandbox Challenge Finds Linux Kernel Flaws Without Customer Data Exposure

    Vercel’s focused sandbox security challenge generated 1,285 submissions during a two-week testing window that ran from August 18 to September 1. According to results reported by SecurityWeek, the company had validated one critical, seven high, 15 medium and 49 low-severity findings while triage continued.

    The most consequential report combined two Linux networking-stack defects: one could expose host-kernel memory and another could crash the host. Technical details remain private while fixes are reviewed and CVE identifiers are pending. Vercel said none of the submissions demonstrated access to real customer data.

    The volume also changed the triage process. Vercel moved from a separate human-reviewed chat for each report to an agent-assisted workflow that checks policy, searches for duplicates and runs proofs of concept in a sandbox. The company says it plans to open-source that triage tooling.

    Why it matters

    The exercise shows how AI-assisted vulnerability research can increase both useful findings and operational noise. Providers running untrusted code need isolation controls, but they also need evidence-driven triage that can keep pace without treating every automated report as a confirmed escape.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

    UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

    A cybercrime group tracked as UAT-10147 is using artificial intelligence tools to help scale attacks against internet-facing servers, and is deploying a malware toolset called SPECTRE that includes endpoint detection and response (EDR) evasion capabilities and a Linux rootkit component, according to a report published by The Hacker News on August 24, 2026.

    What the campaign involves

    Reporting describes UAT-10147 as using AI-assisted techniques to accelerate reconnaissance and exploitation against server infrastructure, rather than relying solely on manual attack chains. Once inside a target environment, the group is reported to deploy SPECTRE, which combines capabilities to bypass or blind EDR tooling with a Linux-focused rootkit intended to maintain stealthy, persistent access.

    Why it matters

    The use of AI-assisted tooling to scale attacks against server infrastructure reflects a trend that both offensive and defensive researchers have flagged repeatedly through 2026: attackers are using automation and AI assistance to compress the time between reconnaissance and exploitation, while defenders increasingly rely on AI-assisted detection to keep pace. A rootkit paired with EDR-bypass capability is also a reminder that Linux server estates — often assumed to be lower-risk than Windows endpoints — remain a high-value target, particularly where detection tooling coverage is weaker than on the desktop fleet.

    Sources

    More coverage like this is available on Technology News.