#security

39 tutorials tagged with "security"

Docker Security Hardening: 9 Steps to Lock Down Production Containers

Practical commands and configurations to harden Docker in production. From rootless mode to network segmentation, these steps reduce your attack surface.

security

Automating Linux Server Hardening with CIS Benchmarks: Stop Doing This Manually

The CIS benchmarks define over 200 security controls for a typical Linux server. Running through them manually takes hours and guarantees you'll miss something. Here's how to automate the entire process.

server-config

Microsoft Defender for Endpoint on Linux Just Started Silently Disabling Itself — Here's How to Check Yours

A recent Microsoft Defender for Endpoint update leaves the agent disabled on Linux servers after reboot. If you haven't checked since your last patch cycle, your production fleet might be running without protection.

troubleshooting

Docker Hardened Images: What They Are and Why Your Production Containers Need Them

Docker's new Hardened Images (DHIs) bring signed attestations, distroless variants, and compliance-ready configurations to container security. Here's what sysadmins and DevOps engineers need to know about deploying them in production.

docker

SleeperGem Attack Hid Malware in Dormant RubyGems Packages for Years Before Striking Developer Machines

The SleeperGem supply chain attack reactivated packages dormant since 2017, impersonated Microsoft's Git Credential Manager, and avoided CI/CD detection. Here's how it worked and what to check on your systems.

devops

NGINX CVE-2026-42533: A Critical 9.2-Severity Flaw Affects Every Version Since 2011 — Here's How to Fix It

A critical heap buffer overflow vulnerability in NGINX (CVE-2026-42533, CVSS 9.2) affects every version from 0.9.6 through 1.31.2. This guide covers how to check if you're vulnerable, upgrade paths for every distribution, and what to do if you can't patch immediately.

server-config

CVE-2026-20896: The Gitea Docker Flaw That Takes One Header to Own Your Server

A critical Docker image default in Gitea lets attackers gain admin access with a single HTTP header. Here's how CVE-2026-20896 works, how to check if you're vulnerable, and how to fix it in five minutes.

docker

CISA Didn't Have an Incident Response Playbook When Its Own AWS Keys Leaked. Here's What Every DevOps Team Should Learn.

The US government's cybersecurity agency got caught without an incident response plan when a contractor exposed AWS GovCloud keys on GitHub. The post-mortem is a masterclass in what not to do — and a checklist for teams that think 'it won't happen to us.'

devops

Critical Gitea Docker Vulnerability (CVE-2026-20896): Patch Your Self-Hosted Git Server Now

A CVSS 9.8 critical vulnerability in Gitea Docker images allows attackers to impersonate any user via reverse proxy misconfiguration. The flaw is under active exploitation. Here's how to check if you're affected and patch immediately.

docker

GhostLock CVE-2026-43499: 15-Year-Old Linux Root Exploit

GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel that sat undetected for 15 years, allowing any local user to escalate to root with 97% reliability. Here's how to check and patch your servers.

security

Argo CD Vulnerability Shows Why GitOps Infrastructure Must Be Treated as Tier Zero

A newly disclosed flaw in Argo CD's repo-server lets attackers manipulate Kubernetes deployments through the GenerateManifest gRPC endpoint. Here's what happened, how the exploit works, and how to lock down your GitOps pipeline.

devops

DirtyClone (CVE-2026-43503): What Linux Admins Need to Know and How to Mitigate Right Now

A newly disclosed kernel vulnerability in the packet cloning subsystem affects every major Linux distribution running kernel 6.1 through 6.12. Here's a practical mitigation guide with step-by-step instructions for Ubuntu, Debian, RHEL, and containerized environments.

security

Critical libssh2 Flaw (CVE-2026-55200): How to Check If Your Servers Are Affected and Patch Immediately

A public PoC is now circulating for CVE-2026-55200, a critical libssh2 vulnerability with a 9.2 CVSS score. Here's how to identify affected systems, verify your version, and apply the fix across your server fleet.

server-config

PinTheft CVE-2026-43494: Linux Kernel Privilege Escalation — What Server Admins Must Know

A deep dive into the PinTheft vulnerability (CVE-2026-43494) that grants local root access through a chain of bugs in the Linux kernel's RDS and io_uring subsystems. Learn how to detect exposure, apply patches, and harden your servers.

security

Linux Kernel Drops strncpy After Six Years: What Server Admins Need to Know

Linux 7.2 finally removes the decades-old strncpy API after 360+ patches. Here's why this matters for your servers and what you should check before upgrading.

linux

How to Check if Your Linux Server Is Affected by the PAM Backdoor Discovered in 2026

A decade-long supply chain compromise in Linux PAM modules has been uncovered. Here's how to audit your servers, detect the backdoor, and secure your authentication stack.

linux

Docker Multi-Stage Builds: The Complete Production Optimization Guide

Master Docker multi-stage builds to shrink image sizes by up to 98%, harden container security, and speed up deployments. Practical examples for Node.js, Python, and Go with production-ready patterns.

docker

Securing Your CI/CD Pipeline: A Practical Guide to GitHub Actions Secrets Management in 2026

Hardcoded secrets in CI/CD pipelines remain one of the most common attack vectors. Here's how to manage GitHub Actions secrets properly, from repository-level configuration to enterprise-grade vaults.

devops

7 Docker Security Best Practices You Should Implement Before Your Next Deployment

Container security isn't optional anymore. From image scanning to network policies, these seven practices will harden your Docker deployments against the most common attack vectors in 2026.

docker

Linux Kernel 7.1 Is Here: What Server Administrators Need to Know

A practical breakdown of Linux Kernel 7.1's most impactful changes for server environments, covering the new NTFS driver, Landlock security improvements, power management updates, and upgrade strategies.

linux

OpenSSL CVE-2026-45447: Critical PKCS#7 Vulnerability and Server Patch Guide

A heap use-after-free bug in OpenSSL's PKCS#7 verification enables remote code execution. Learn how to check your systems, apply the patch, and harden against related attacks.

security

Securing the AI-Powered DevOps Pipeline: A Practical Guide for 2026

As AI tools become integral to CI/CD workflows, the artifact supply chain has emerged as a new attack surface. Learn how to secure your DevOps pipeline against AI-specific threats.

devops

systemd Service Hardening: Sandboxing with ProtectSystem, PrivateTmp, and CapabilityBoundingSet

A hands-on guide covering configuration, troubleshooting, and best practices for systemd service hardening: sandboxing with protectsystem, privatetmp, and capabilityboundingset.

linux

File Integrity Monitoring with AIDE: Detect Unauthorized Changes on Linux Servers

A hands-on guide covering configuration, troubleshooting, and best practices for file integrity monitoring with aide: detect unauthorized changes on linux servers.

security

Docker Secrets Management: Securing Sensitive Data in Swarm and Compose

A hands-on guide covering configuration, troubleshooting, and best practices for docker secrets management - securing sensitive data in swarm and compose.

docker

Automated Linux Security Auditing with Lynis: Full System Scan and Remediation

A hands-on guide covering configuration, troubleshooting, and best practices for automated linux security auditing with lynis - full system scan and remediation.

security

OpenVPN vs WireGuard: Choosing the Right VPN Server for Your Infrastructure

A hands-on guide covering configuration, troubleshooting, and best practices for openvpn vs wireguard - choosing the right vpn server for your infrastructure.

security

Docker Rootless Mode: Running Containers Without Root Privileges for Better Security

A hands-on guide covering configuration, troubleshooting, and best practices for docker rootless mode - running containers without root privileges for better security.

docker

SSH Certificate-Based Authentication: Moving Beyond Key Pairs for Enterprise Scale

A hands-on guide covering configuration, troubleshooting, and best practices for ssh certificate-based authentication - moving beyond key pairs for enterprise scale.

security

Advanced Fail2ban Configuration: Custom Jails, Filters, and Actions

A hands-on guide covering configuration, troubleshooting, and best practices for advanced fail2ban configuration - custom jails, filters, and actions.

security

Linux Auditd Monitoring: Track Every System Call for Security Compliance

A hands-on guide covering configuration, troubleshooting, and best practices for linux auditd monitoring - track every system call for security compliance.

security

Configuring Nginx Rate Limiting: Protect Your Server from Abuse

A hands-on guide covering configuration, troubleshooting, and best practices for configuring nginx rate limiting - protect your server from abuse.

server-config

SELinux vs AppArmor: Choosing the Right Linux Security Module in 2026

A hands-on guide covering configuration, troubleshooting, and best practices for selinux vs apparmor - choosing the right linux security module in 2026.

security

Nginx 1.29.5 Security Update: Critical Patches and Upgrade Guide

Nginx 1.29.5 addresses critical security vulnerabilities. Learn about the CVEs fixed, impact assessment, and step-by-step upgrade instructions.

security

Mastering iptables: Linux Firewall Fundamentals

Learn to configure iptables for Linux server security. This comprehensive guide covers chain management, rule configuration, logging, and production deployment best practices.

linux

Securing Websites with Let's Encrypt SSL Certificates

Learn how to obtain and renew free SSL/TLS certificates using Certbot. This comprehensive guide covers automatic renewal, multiple domains, and production-ready configurations.

security

SSH Server Hardening: Securing Remote Server Access

Protect your Linux servers from unauthorized access with comprehensive SSH hardening techniques. Learn about key-based authentication, fail2ban configuration, and advanced security measures for production environments.

security

SSH Key-Based Authentication for Secure Server Access

Implement passwordless SSH authentication using key pairs. This guide covers key generation, server configuration, and security best practices for production environments.

security

UFW Firewall Configuration: Securing Linux Servers

Master UFW (Uncomplicated Firewall) for Linux server security. Learn rules configuration, rate limiting, application profiles, and integration with Docker networks for production environments.

security