Security Issues in Cisco and Jenkins Passed Off as "Linux" Problems
Fear, Uncertainty, Doubt (FUD) tactics
There has been some FUD lately in several slopfarms that we mentioned in Slopwatch. The one we mentioned 2 days ago painted a Cisco issue as "Linux" [1-3] and last night we showed how eBPF was painted as GNU and Linux, even if the underlying issue was in Jenkins [4]. Evidence found in AWS, which is proprietary, just like Cisco.
The corporate media is generally bad, but those sites claim to be tech sites. How can they get their reporting this wrong? They repeat and recycle the same lies/spin. █
Related/contextual items from the news:
-
Intrusions with Cisco SNMP bug facilitate Linux rootkit deployment [Ed: It's a Cisco issue, which they try to twist as "Linux"]
Older Linux systems have been compromised with rootkits in attacks involving the exploitation of a high-severity Cisco IOS and IOS XE Simple Network Management Protocol vulnerability, tracked as CVE-2025-20352, part of the Operation Zero Disco campaign, reports Security Affairs.
-
Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits
Hackers exploit Cisco SNMP flaw CVE-2025-20352 in “Zero Disco” attacks to deploy Linux rootkits on outdated systems, researchers report.
-
Threat Actors Exploit Cisco SNMP Vulnerability To Install Linux Rootkits
Security researchers from Trend Micro have revealed the details of a sophisticated new cyber campaign dubbed Operation Zero Disco, which leverages a recently disclosed vulnerability in Cisco IOS and IOS XE Software to compromise aging network infrastructure. The attackers have reportedly been exploiting this flaw to implant Linux-based rootkits on unprotected or end-of-life devices, giving them long-term, stealthy access within enterprise environments.
-
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets [Ed: This issue is in Jenkins]
The infection, per the French cybersecurity company, involved the attackers exploiting an exposed Jenkins server vulnerable to CVE-2024-23897 (CVSS score: 9.8) as the starting point, following which a malicious Docker Hub image named "kvlnt/vv" (now removed) was deployed on several Kubernetes clusters.