NewsThe Hacker News2026-07-28 15:01 UTCICS / OT (industrial control)SME

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (

Other advisories

CVE-2026-107812none
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
CVE-2026-107812high
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
CVE-2026-102677high
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
CVE-2026-102677none
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
osv:CVE-2026-102677none
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
osv:GO-2026-6262none
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers in github.com/opentofu/opentofu
ghsa:GHSA-22w5-2fxg-vrwxlow
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
osv:GHSA-22w5-2fxg-vrwxnone
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers

Other news entries

Newsthehackernews2026-10-09
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Newssecurityweek2026-10-09
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Newsthehackernews2026-10-08
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Newsthehackernews2026-10-07
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Newsthehackernews2026-10-07
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Newsbleepingcomputer2026-10-07
PoeLLM malware infects exposed AI servers in cryptomining attacks
Newssecurityweek2026-10-07
ASOS Confirms Cyberattack, Data Breach
Newsthehackernews2026-10-07
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

Source: https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html

More on Compromised