LinuxSecurity.com

Moving a patient portal from one data center to another moves where the service runs. But it does not move who has to secure the patient data associated with the portal.

Two security flaws in NVIDIA Linux drivers could allow someone with limited access to a server to gain full control of it. NVIDIA has already released fixes for both issues, but they came in separate updates. This means your driver might have received a fix for one flaw while still being vulnerable to the other. 

Be very careful of this newly discovered vulnerability in the Apache web server. Specifically, the vulnerability could allow attackers to execute code of their choice on your Linux web server(s) by targeting HTTP/2-enabled servers. So, first determine if your site(s) even use HTTP/2 and then check if a fix is already available for your specific version of Apache.

Someone managed to use stolen developer and bot accounts to fetch build credentials through ordinary-looking GitHub pull requests. The activity started on November 10, 2026, and two days later, security researchers from Aikido and StepSecurity uncovered the details of the campaign in their blog posts.

November 12, 2026, was a big day for security fixes to PostgreSQL. Now that there is a new version of the software, some database indexes may need rebuilding and new backups may need to be made, in addition to installing the update and restarting PostgreSQL.

BusyBox is a set of small Unix apps all packed into one executable. In this post, seven newly disclosed security flaws in some of the tools and even parts of the filesystem code are discussed. However, their impact greatly depends on the set of tools and filesystem code included in a given device or image and how it’s used in the particular setup.

Clone safely after the Git security fix with a patched Git client, verify the project’s source, and use git clone without --recurse-submodules to fetch the repository without loading all submodules for that project first.

A certificate authority (CA) verifies a name or identity and then signs a digital certificate linking it to a public key.

To update Chrome on Linux, use the package manager (e.g., apt, dnf, zypper) to update the Google Chrome package.

Most cloud access keys don’t persist on a Linux server intentionally. Key pairs can simply get pasted into a file, and forgotten once the job runs.

After scanning through the report of your managed security service provider (MSSP), you are faced with a huge number of blocked connections and hundreds of analyzed alerts, all colored green. Reading through all of this does not necessarily give you a complete idea of what has been going on to monitor your systems, react as quickly as possible in case of an incident, and close any remaining security holes.

A customer tags your company in a complaint about a refund that they haven’t received yet. Below this post is another account posting with your company’s logo as its profile picture. The name of this new account looks similar to another one of your company accounts, but with a slight change in the name. This impersonator account then replies to the customer’s post with a link to the impersonator’s website in order to collect the refund from that customer.

We must remember that exposing customer information in a database export left in a public folder, for example, or even worse, in a backup archive with passwords, email addresses, or even private documents, means that information has been made publicly available on the internet—even if the server has since been fixed. This means that, in addition to fixing the server, we must also try to remove information from search results and even from copies that have been mirrored on other websites.

CISA added a FreeSWITCH flaw to its list of bugs used in attacks on November 9, 2026. Tracked as CVE-2026-116779, the bug lets an accepted chat message reach commands that control the phone server.

An AI assistant that can explain a cluster problem may also have permission to change it.

A Linux security protection can appear to be available but still be switched off when a system needs it.

Microsoft shipped Azure Linux 3.0.2022 on November 7.

When a Linux server's kernel crashes, applications can go offline until the machine starts again.