Threat watch / Campaign
GSocket: attackers keep a hidden way back into hacked Linux web servers
On November 11, 2026, Microsoft described several incidents in which threat actors broke into internet-facing Linux web servers, mostly PHP applications on cPanel hosting, and installed GSocket, an open-source remote access tool. Both the server and the operator connect out to a public relay network, so there is no attacker address to block, and access survives the patch of the original flaw. Microsoft says devices with GSocket-related detections rose 356.2% from March through August 2026.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- cPanel, Apache, Linux kernel
- How it happened
- The attackers exploit internet-facing web applications, then use curl to download and run a remote script that profiles the host and stages the GSocket client in writable or memory-backed paths such as /dev/shm, under names that look like kernel threads. They keep access through cron jobs, systemd services, shell startup files and watchdogs, and delete their staging files. In a few incidents they tried the Linux kernel flaw CVE-2026-43284 ("Dirty Frag") to get root. Microsoft warns: "Do not treat application patching as complete remediation."[1][2] Checked 12 Nov 2026
- What was stolen
- Not public yet Checked 12 Nov 2026
- Who was impacted
- Organizations running exposed Linux web servers. In Microsoft's attributable incidents, 87.1% involved web applications and hosting, 63.9% PHP web applications and cPanel hosting, and 24.3% Apache. Education and research make up 30.7% of affected organizations, technology and telecommunications 22.9%; Microsoft says these shares "do not indicate that threat actors selected these sectors deliberately". No victim count is public.[1][2] Checked 12 Nov 2026
- Threat actor
- Not attributed. No group named. Microsoft says the tool is used by "multiple unrelated threat actors".
- CVE
- CVE-2026-43284
Timeline
- Microsoft publishes its research: devices with GSocket-related detections rose 356.2% from March through August 2026, though not steadily month to month. It advises deny-by-default outbound traffic, auditing cron, systemd and shell startup files, and patching local privilege escalation flaws on internet-facing servers. [1]
- BleepingComputer reports the campaign. [2]