@Squid_Sec: LIVE: SquidSec Threat Feed update. Hackers are breaching F5 BIG-IP APM devices and dropping a Linux rootkit with a file…
Summary
Hackers are exploiting vulnerabilities in F5 BIG-IP APM devices to deploy a Linux rootkit with a fileless web shell, as reported in the SquidSec Threat Feed.
View Cached Full Text
Cached at: 09/09/26, 01:54 PM
LIVE: SquidSec Threat Feed update. Hackers are breaching F5 BIG-IP APM devices and dropping a Linux rootkit with a fileless web shell. HIGH severity. https://t.co/jtjHGtMckl
SquidSec Threat Feed
Source: https://squidhacker.com/brief/ SQUID SEC
Cybersecurity research, penetration testing tradecraft, and agentic recon — by SquidSec.
🇺🇸 U.S. Veteran Owned
Explore
SquidSec Network
© 2026 SQUID SECCleveland, OH · High-signal security content
Similar Articles
A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Four long-standing Linux kernel vulnerabilities—DirtyAH6, PPPoEject, TUNderflow, and DiagSpill—are disclosed, allowing local privilege escalation with potential remote impact, and fixes have been released in stable kernel versions.
Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
Dream researchers uncovered an AI-assisted Chinese attack campaign that chained a custom PHP2Shell RCE exploit with a kernel privilege-escalation flaw to root 25 servers—including US government-affiliated systems—then pivoted into Active Directory for credential extraction and persistent access.
Securing Internet-Critical Software: How We Could Have Backdoored Bash
Security researchers at Hacktron disclosed a chain of 26 vulnerabilities in GNU Savannah (the forge hosting Bash and Coreutils), including an email-address shell injection that granted RCE, superuser access, and the ability to push to the upstream Bash repository; the FSF has since fixed the issues and published an incident report.
@tobi: What a disaster
Linux's stable kernels shipped fixes for CVE-2026-98432, a critical (CVSS 9.8) use-after-free in the IPv4 TCP handshake reachable by remote unauthenticated attackers; Anthropic reported the bug and says its Claude model wrote a working remote root exploit, while Ubuntu and RHEL remain unfixed.
@kl_secservices: Attackers don't need fancy tricks to breach schools: stolen accounts, Potato privesc, then PsExec to move around. Outda…
Attackers are breaching schools using simple methods like stolen accounts and outdated systems, with ransomware groups DragonForce and LockBit 3 targeting private schools for payments. A report analyzes incidents in Brazil and provides recommendations for protection.