{"id":871,"date":"2026-05-11T14:26:19","date_gmt":"2026-05-11T14:26:19","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=871"},"modified":"2026-05-11T14:26:19","modified_gmt":"2026-05-11T14:26:19","slug":"linux-rootkit-macos-crypto-stealer-websocket-skimmers-and-more","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=871","title":{"rendered":"Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 11, 2026<\/span><\/span>Cybersecurity \/ Hacking<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Rough Monday.<\/p>\n

Somebody poisoned a trusted download again, somebody else turned cloud servers into public housing, and a few crews are still getting into boxes with bugs that should\u2019ve died years ago \u2014 the same old holes, same lazy access paths, same \u201chow the hell is this still open\u201d feeling. One report this week basically reads like a guy tripped over root access by accident and decided to stay there.<\/p>\n

The weird part is how normal this all sounds now. Fake updates. Quiet backdoors. Remote tools are used like skeleton keys. Forum rats swapping stolen access while defenders burn another weekend chasing logs and praying the weird traffic is just monitoring noise. The Internet\u2019s held together with duct tape and bad sleep.<\/p>\n

Anyway, Monday recap time. Same fire. New smoke.<\/p>\n

\u26a1 Threat of the Week<\/strong><\/h2>\n

Ivanti EPMM and Palo Alto Networks PAN-OS Flaws Under Attack<\/strong>\u2014Ivanti warned customers that attackers have successfully weaponized CVE-2026-6973, an improper input validation defect in Endpoint Manager Mobile (EPMM) that allows authenticated users with administrative privileges to run code remotely. The company did not say when the first instance of exploitation occurred, or precisely how many customers have been impacted. In a related development, attackers are actively exploiting a zero-day vulnerability affecting some Palo Alto Networks’ customers’ firewalls. As in the case of Ivanti, Palo Alto Networks did not say when or how it became aware of active exploitation, but said threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as early as April 9, 2026. The memory corruption vulnerability, tracked as CVE-2026-0300, affects the authentication portal of PAN-OS and allows unauthenticated attackers to run code with root privileges on the PA-Series and VM-Series firewalls. Attack surface management platform Censys said<\/a> it detected about 263,000 Internet-exposed hosts running PAN-OS. Patches are expected to be released starting May 13, 2026.\u00a0<\/p>\n

\ud83d\udd14 Top News<\/strong><\/h2>\n