LowEndBox

/

Oct 24, 2026

/

What an awful graph.

A Graph Showing Why It’s Not a Fun Time to Work in IT

Patch Your PHP! The PHPopaclypse is Upon Us!

/

Oct 21, 2026

/

On Wednesday, October 21, 2026, a pair of PHP vulnerabilities will be unveiled at 14:00 UTC, which is 10:00 Eastern or 07:00 Pacific. News has rocketed around the Internet because these are very serious CVEs.

Patch Your PHP! The PHPopaclypse is Upon Us!

Browser Fingerprinting is Frighteningly Accurate

/

Oct 18, 2026

/

Recently, I read an article about device fingerprinting, which argues that we're in the post-tracking-cookie era. They're no longer needed, because every browser can be fingerprinted with 100% accuracy. Naturally, I had to test it.

Browser Fingerprinting is Frighteningly Accurate

Debian’s Unattended Upgrades is Not Enabled After You Install It – Why? Let’s Deep Dive That

/

Aug 22, 2026

/

I installed unattended-upgrades, but Debian wasn't upgrading. Let's get to the bottom of this puzzle.

Debian’s Unattended Upgrades is Not Enabled After You Install It – Why? Let’s Deep Dive That

The Contagious Interview: The Slimeyness of LinkedIn is Truly Becoming Next Level

/

Jul 24, 2026

/

I was chatting with my eldest daughter, a software dev, last night and we got on the topic of LinkedIn recruiters. Some of the tactics used by these people are familiar to anyone who's been looking for a job. But now there's a new risk.

The Contagious Interview: The Slimeyness of LinkedIn is Truly Becoming Next Level

Yeee-ouch! Guest-to-Host Escape Vulnerability in Linux KVM/x86

/

Jul 07, 2026

/

There's a pretty grisly CVE making the rounds. It's being marketed as Januscape (CVE-2026-53359), and if you're a hosting provider, it's a headache.

Yeee-ouch! Guest-to-Host Escape Vulnerability in Linux KVM/x86

ELI5: Why is Everything Being Rewritten in Rust?

/

Jun 17, 2026

/

Comments (5)

MannDude wanted to know why everything is being rewritten in Rust. Here's the answer.

ELI5: Why is Everything Being Rewritten in Rust?

The YouTube App is an Authenticator…and That’s a Problem

/

Jun 13, 2026

/

The YouTube app is actually an authenticator. And that's an inconvenience.

Whatever Happened About that Provider Who Claimed a Virtualizor Bug Caused a Breach?

/

Dec 11, 2025

/

Comments (3)

Provider says Virtualizor caused a breach. Virtualizor says no way. Providers says "video incoming..." Aaaaaaand...we're still waiting.

Whatever Happened About that Provider Who Claimed a Virtualizor Bug Caused a Breach?

Nyr’s Legendary Road Warrior Script: Still the Rock Solid Go-To for Easy VPN!

/

Dec 08, 2025

/

Nyr's Road Warrior script makes setting up VPNs trivially easy. It's still my go-to!

Nyr’s Legendary Road Warrior Script: Still the Rock Solid Go-To for Easy VPN!

Provider Claims Virtualizor WHMCS Plugin Vulnerability Caused Breach. Virtualizor Doesn’t Agree.

/

Nov 14, 2025

/

Provider says Virtualizor caused a breach. Virtualizor says no way. Providers says "video incoming..."

Provider Claims Virtualizor WHMCS Plugin Vulnerability Caused Breach. Virtualizor Doesn’t Agree.

If Your Biometric Data is Stolen, Should You Care? Probably Not.

/

Oct 21, 2025

/

"I Can Change My Password, But I Can't Change My Eyes!" Does this frequently-made comment even make sense?

If Your Biometric Data is Stolen, Should You Care? Probably Not.

Knock, Knock: How to Shield Your VPS From Port Scanning with Port Knocking

/

Sep 21, 2025

/

xposing port 22 to the internet invites bots and brute-force attacks. There are different ways to prevent this: changing your SSH port or implementing fail2ban. There's also port knocking, which we'll implement using knockd and the knock client.

Knock, Knock: How to Shield Your VPS From Port Scanning with Port Knocking

So How Exactly Do You Learn About Security Issues on Your VPS?

/

Sep 10, 2025

/

If you're a sysadmin - and if you've got a VPS, you are - how do you learn about new security threats?

So How Exactly Do You Learn About Security Issues on Your VPS?

Tighten Up Your VPS With an SSH Audit! Let’s Look at the ssh-audit Package…Does OpenBSD Score Higher Than Debian?

/

Aug 25, 2025

/

The SSH protocol is surprisingly complex, though the reason why it has to be makes sense once you think about everything it has to do. Using the ssh-audit package, you can audit your SSH server and tighten it up with an easy step-by-step instructions.

Tighten Up Your VPS With an SSH Audit! Let’s Look at the ssh-audit Package…Does OpenBSD Score Higher Than Debian?

Hackers Love Default Windows RDP Ports: Here’s Why You Should Change Yours, and How to Do It

/

Aug 22, 2025

/

Should your change your Windows RDP port? In LowEndBox's opinion, yes. Let's discuss why, and how to do it.

Hackers Love Default Windows RDP Ports: Here’s Why You Should Change Yours, and How to Do It

One Third of the Web Will Stop Working in 4 Days: Massive-Scale CDN Compromise Starts Wednesday

/

Aug 02, 2025

/

About 34% of the web is still powered by HTTP/1.1 and that protocol will likely come under severe attack starting on Wednesday. Get a preview of what's in store for the latest security headache.

One Third of the Web Will Stop Working in 4 Days: Massive-Scale CDN Compromise Starts Wednesday

How to Add Two-Factor Authentication (2FA) to WordPress in About 2 Minutes

/

Jul 21, 2025

/

The world is a dangerous place. Take some of the edge off by enabling Two Factor Authentication (2FA) on your WordPress sites in about 60 seconds.

How to Add Two-Factor Authentication (2FA) to WordPress in About 2 Minutes

How to Keep Your VPS Safe From Hackers in Less Than 10 Minutes

/

May 26, 2025

/

You're busy. We get that. So let's see how you can improve your VPS security if you've only got 10 minutes to spend.

How to Keep Your VPS Safe From Hackers in Less Than 10 Minutes

Five Times When Updating Your OS Would Have Saved You From Being Hacked

/

Apr 17, 2025

/

Every checklist you've ever seen for securing your VPS includes "update your system regularly". But is that one of those "best practices" that is more theoretical than a real-world necessity? To be honest, it's easy to not get around to running "apt update && apt upgrade". In my experience, at least with Debian, updates rarely break things but it's always a small risk. Nevertheless, it requires remembering to do it, spending the commands run, maybe rebooting, etc. Unfortunately, history has shown time and time again that skipping OS updates can leave even the best admins wide open to disaster.

Five Times When Updating Your OS Would Have Saved You From Being Hacked

Get Ready to Scan Your Passport If You Want to Buy a VM This Summer

/

Mar 07, 2024

/

New requirements are coming for providers to Know Your Customer (KYC). Is just verifying the email address and taking a credit card enough or do they need to get into those "what was your street address four years ago" kinds of questions? Will we have to scan passports and send copies of utility bills?

Get Ready to Scan Your Passport If You Want to Buy a VM This Summer

My Server Was Getting Constantly Hacked Until I Changed This One Parameter

/

Feb 09, 2024

/

Comments (3)

If your server (VPS or dedicated) has been hacked, there is a simple parameter change you an make that will vastly improve its security. It takes a couple steps to login, but it will protect you against brute force attacks, keyloggers, and other attacks. And you have a couple of options.

My Server Was Getting Constantly Hacked Until I Changed This One Parameter

No, ‘airforce’ is Not a Good Password: Check Out This Honeypot

/

Apr 12, 2023

/

LowEndTalk user htop setup a honeypot to trap ssh passwords. Watch skiddies in real time!

No, ‘airforce’ is Not a Good Password: Check Out This Honeypot

Motherboard MSI Warns of Rogue Firmware

/

Apr 11, 2023

/

MSI recently suffered a cyber attack and has issued a warning about dodgy imposter firmware that might be in the wild.

RackNerd and Ezeelogin: Securing and Scaling SSH

/

Feb 10, 2023

/

Ezeelogin is an SSH management platform that provides two factor authentication, SAML Authentication, session recording, IAM, RBAC, PAM, and lots of other important acronyms. Community provider RackNerd recently deployed it and explains the product's benefits to providers and users.

Here Come the RackSpace Lawsuits

/

Dec 17, 2022

/

"That Rackspace offered opaque updates for days, then admitted to a ransomware event without further customer assistance is outrageous," according to one attorney. Class-action lawsuits against Rackspace are popping up around the country.

Just Stop Using LastPass: They’ve Been Hacked for the 9th Time