# Hackers plant GSocket on Linux servers for persistent access

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/) · 2026-11-12 · Security
Page: https://themorning.dev/story/hackers-plant-gsocket-on-linux-servers-for-persistent-access-3ca0085eba4f5e00
Kind: security · Impact: medium

## In brief

- Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, on Linux servers.
- Attackers use GSocket to keep access after the vulnerabilities used for initial access have been patched.

## Why it matters

Patching the initial entry point may not remove an attacker's access if GSocket has already been installed on the server.

## What to do

- Audit Linux servers for unauthorized GSocket installations and remove any found

## Coverage

- [Hackers plant GSocket on Linux servers for persistent access](https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/) — BleepingComputer, 2026-11-12

Tags: linux, malware, persistence, remote-access, threat-intel

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev