Server Security Blog

CISA KEV October 2026: What Linux Server Owners Should Check

CISA added 24 actively exploited flaws to KEV in October 2026 so far. Which matter for Linux servers (Plex, Zammad, Atlassian, BIND) and how to check yours.

Yandex Data Center Attacks: What the Outages Mean for Resilience

Drone strikes took three Yandex data centers offline in October 2026. What is confirmed, what was never a cyberattack, and the lessons for any server owner.

NGINX Rift, CVE-2026-42945: An 18-Year-Old Bug in the Rewrite Module

A critical, unauthenticated buffer overflow sat in the rewrite module for 18 years. What triggers it and how to check your config.

Let's Encrypt Is Moving to 45-Day Certificates: What Changes for Your Renewal Automation

90-day certificates are being phased out in favor of 45-day and 6-day options. What breaks if your automation assumes a fixed interval.

OpenSSH CVE-2026-35414: How a Comma in a Certificate Bypassed Root Login

A comma in an SSH certificate's principal name bypassed authorized_keys restrictions. What it does, who it affects, and how to check your server.

Cloudflare's H1 2026 DDoS Report: What a 31.4 Tbps Record Means for a Small Business Server

Record attack volumes made headlines, but 96.62% of real attacks stayed under 500 Mbps. What actually matters for a small server.

CISA's Exploited Vulnerabilities List Keeps Growing: What Small VPS Operators Should Take From It

A recent KEV addition was used for reverse shells and crypto miners on Docker hosts. The pattern small VPS operators should notice.

SSH Hardening: Best Practices to Stop Brute-Force Attacks

Key-based auth, sshd_config settings, ciphers, fail2ban, and firewall rules that stop brute-force attacks.

Linux Firewall Guide: iptables vs nftables vs ufw

A practical comparison with setup steps, so you can pick and configure the right Linux host firewall.

Fail2ban Setup Guide: Automated Intrusion Prevention

How fail2ban works and how to configure jails, filters, bantime, findtime and maxretry correctly.

Server Patch Management: Why Unpatched Servers Get Hacked

Unattended-upgrades, patch windows, testing, kernel live patching, and why n-day exploits matter.

Nginx Security Best Practices

TLS configuration, security headers, rate limiting, request limits, and security-focused logging.

DDoS Protection for Small Business Websites

Attack types and realistic, budget-appropriate mitigation for small business Linux servers and websites.

Server Monitoring and Log Analysis

What to monitor, how to separate signal from noise, and why centralized log analysis catches attacks earlier.

How to Detect and Respond to a Server Breach

A phase-by-phase guide to detecting, containing, eradicating, and recovering from a compromised server.

Managed Security vs DIY: What SMBs Need to Know

An honest comparison: time cost, coverage gaps, and a framework for deciding what your business actually needs.

Ransomware Protection for a Small VPS: Entry Points, Blast Radius and Recovery

How ransomware reaches small servers and the layered defences that matter most: entry points, blast radius, backups and the first hour.

Exposed Databases on a VPS: How to Lock Down MySQL, PostgreSQL, Redis and MongoDB

How to find databases and caches reachable from the internet, close them, and keep MySQL, PostgreSQL, MongoDB and Redis private.

VPS Backup Strategy: The 3-2-1 Rule, Immutable Copies and Restore Tests

What to back up, the 3-2-1 rule, encrypted and append-only copies, object lock, and restore tests that prove it works.

Docker Host Security on a VPS: Published Ports, the Docker Socket and Rootless Mode

Why published ports bypass your firewall, how to protect the Docker socket and API, and which container flags to avoid.

SSH Two-Factor Authentication: Hardware Keys and TOTP Without Locking Yourself Out

Add FIDO2 hardware keys or TOTP to SSH, with a rollout order that never locks you out of your own server.

Exposed .env and .git Files: How to Find Them, Block Them and Rotate Secrets

Test whether your server exposes .env and .git files, block them in nginx or Apache, and rotate secrets that leaked.

Linux Users, sudo and Least Privilege on a VPS: A Practical Audit

Audit UID 0 accounts, sudo rules and service users, apply least privilege, and patch the sudo chroot flaw.

Fail2ban Not Banning IPs: How to Find and Fix the Cause

Fail2ban runs but bans nothing? Check the jail, the log source, the filter, the thresholds and the firewall action in order, then prove it with a test ban.

Do You Need a SIEM on a Small VPS? Wazuh vs journald

Do you need a SIEM on a small VPS? Usually not for one to five servers. Persistent journald plus off-server log copies covers most needs until Wazuh pays off.

How to Stop SSH Brute-Force Attacks on a VPS

Measure SSH brute-force attacks first, then stop them in order: no passwords, no root login, AllowUsers, sshd limits, fail2ban or ufw limit. Tested steps.

Locked Out of Your VPS After Changing SSH? How to Recover

Locked out of your VPS after an SSH change? Tell refused from denied, get in via console or rescue mode, then fix sshd_config, firewall, keys, PAM or fail2ban.

SSH Permission Denied (publickey): Causes and Fixes

Fix SSH Permission denied (publickey): read ssh -v and the sshd log, then check username, key, permissions, authorized_keys and sshd_config in order.