Making Tech Headlines · Page 1

Linux intruders stay online after the patch takes its victory lap

November 12, 2026 at 6:01 AM EST · New York time

Multiple attackers are using GSocket, a legitimate open-source remote-access tool, to retain access to Linux servers after exploiting vulnerabilities to enter them. Their access can persist even after the original vulnerability is patched. The distinction turns an apparently neat repair into a longer job. A security update can close a known opening without removing a tool that an intruder has already installed. GSocket itself has legitimate uses, so the issue is not simply the existence of remote-access software. It is who put it there and who can use it. Organizations rely on Linux servers for websites and other services, making the persistence of an unwanted connection consequential beyond a single administrator's screen. Fixing the entry point addresses one part of the problem. Establishing what happened after entry is another. The case also gives the progress bar a rather awkward supporting role. It can announce that a patch has finished, but it cannot announce that every unwanted visitor has departed. Security teams are left with the less photogenic work of examining access and tools rather than celebrating the installation alone. In the ideal software story, the update rolls out and the curtain falls. Here the curtain falls while somebody else may still have a remote control.

Satire. Not factual reporting. Read the original reporting from the linked publishers.